fix: : add support new structure

fix: replace m_linkDefaultRoutes map with single m_gatewayIfindex
fix: solve infinite reconnect NM down
2026-08-07 08:16:38 +03:00 · 2026-04-30 17:30:59 +03:00 · 2026-04-30 16:30:15 +03:00 · 2026-04-30 16:30:14 +03:00 · 2026-04-30 16:30:14 +03:00 · 2026-04-30 16:30:14 +03:00
459 changed files with 9962 additions and 28948 deletions
--- a/.github/actions/apple-install-cert/action.yml
+++ b/.github/actions/apple-install-cert/action.yml
@@ -1,38 +0,0 @@
-# .github/actions/apple-install-cert/action.yml
-
-name: Setup apple keychain
-description: Creates and configures a temporary build keychain
-
-inputs:
-  keychain-path:
-    description: Path to the keychain
-    required: true
-  keychain-password:
-    description: Password to the keychain
-    required: true
-  cert-base64:
-    description: Base64-encoded certificate
-    required: true
-  cert-password:
-    description: Certificate password
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Create keychain
-      shell: bash
-      env:
-        KEYCHAIN_PATH: ${{ inputs.keychain-path }}
-        KEYCHAIN_PASSWORD: ${{ inputs.keychain-password }}
-        CERT_BASE64: ${{ inputs.cert-base64 }}
-        CERT_PASSWORD: ${{ inputs.cert-password }}
-      run: |
-        CERT_PATH=$(mktemp /tmp/cert_XXXXXX.p12)
-        trap "rm -f '$CERT_PATH'" EXIT
-
-        echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
-
-        security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-        security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$CERT_PASSWORD" -A -t cert -f pkcs12
-        security set-key-partition-list -S apple-tool:,apple:,codesign: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
--- a/.github/actions/apple-setup-keychain/AppleWWDRCAG3.cer
+++ b/.github/actions/apple-setup-keychain/AppleWWDRCAG3.cer
--- a/.github/actions/apple-setup-keychain/action.yml
+++ b/.github/actions/apple-setup-keychain/action.yml
@@ -1,57 +0,0 @@
-# .github/actions/apple-setup-keychain/action.yml
-
-name: Setup apple keychain
-description: Creates and configures a temporary build keychain
-
-inputs:
-  keychain-name:
-    description: Name of the keychain
-    required: false
-    default: "ci-amnezia"
-  keychain-password:
-    description: The keychain password
-    required: true
-  lock-timeout:
-    description: A timeout after exceeding which the keychain would be locked
-    required: false
-    default: "0"
-
-outputs:
-  keychain-path:
-    description: "Full path to the keychain created"
-    value: ${{ steps.setup.outputs.keychain-path }}
-  keychain-name:
-    description: "Actual name of the keychain created"
-    value: ${{ steps.setup.outputs.keychain-name }}
-
-runs:
-  using: composite
-  steps:
-    - name: Setup keychain
-      id: setup
-      shell: bash
-      env:
-        KEYCHAIN_NAME: ${{ inputs.keychain-name }}
-        KEYCHAIN_PASSWORD: ${{ inputs.keychain-password }}
-        LOCK_TIMEOUT: ${{ inputs.lock-timeout }}
-      run: |
-        KEYCHAIN_PATH="$HOME/Library/Keychains/$KEYCHAIN_NAME.keychain-db"
-
-        security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-
-        if [[ "$LOCK_TIMEOUT" == "0" ]]; then
-          security set-keychain-settings "$KEYCHAIN_PATH"
-        else
-          security set-keychain-settings -u -t "$LOCK_TIMEOUT" "$KEYCHAIN_PATH"
-        fi
-
-        security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-
-        security import "${{ github.action_path }}/DeveloperIDG2CA.cer" -k "$KEYCHAIN_PATH" -A
-        security import "${{ github.action_path }}/AppleWWDRCAG3.cer" -k "$KEYCHAIN_PATH" -A
-
-        security list-keychains -d user -s "$KEYCHAIN_PATH"
-        security default-keychain -s "$KEYCHAIN_PATH"
-
-        echo "keychain-name=$KEYCHAIN_NAME" >> $GITHUB_OUTPUT
-        echo "keychain-path=$KEYCHAIN_PATH" >> $GITHUB_OUTPUT
--- a/.github/actions/apple-setup-provisioning-profile/action.yml
+++ b/.github/actions/apple-setup-provisioning-profile/action.yml
@@ -1,31 +0,0 @@
-# .github/actions/apple-setup-provisioning-profile/action.yml
-
-name: Setup provisioning profiles
-description: Decodes and installs provisioning profiles
-
-inputs:
-  provisioning_profile_base64:
-    description: Base64-encoded provisioning profile
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Setup provisioning profile
-      shell: bash
-      run: |
-        PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
-        TEMP_FILE=$(mktemp)
-
-        echo "${{ inputs.provisioning_profile_base64 }}" | base64 --decode > "$TEMP_FILE"
-
-        PROFILE_UUID=$(grep UUID -A1 -a "$TEMP_FILE" | grep -io "[-A-F0-9]\{36\}")
-        if [[ -z "$PROFILE_UUID" ]]; then
-          echo "Failed to extract UUID from provisioning profile"
-          rm -f "$TEMP_FILE"
-          exit 1
-        fi
-
-        mkdir -p "$PROFILES_DIR"
-        mv "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.mobileprovision"
-        echo "Installed profile: $PROFILE_UUID"
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
--- a/.gitignore
+++ b/.gitignore
@@ -10,8 +10,6 @@ deploy/build_64/*
 winbuild*.bat
 .cache/
 .vscode/
-.venv/
-.cursor*


 # Qt-es
@@ -83,7 +81,6 @@ client/.DS_Store
 ._.DS_Store
 ._*
 *.dmg
-deploy/data/macos/pf/amn.400.allowPIA.conf

 # tmp files
 *.*~
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,9 +4,16 @@
 [submodule "client/3rd/SortFilterProxyModel"]
 	path = client/3rd/SortFilterProxyModel
 	url = https://github.com/mitchcurtis/SortFilterProxyModel.git
+[submodule "client/3rd-prebuilt"]
+	path = client/3rd-prebuilt
+	url = https://github.com/amnezia-vpn/3rd-prebuilt
+	branch = feature/special-handshake
 [submodule "client/3rd/amneziawg-apple"]
 	path = client/3rd/amneziawg-apple
 	url = https://github.com/amnezia-vpn/amneziawg-apple
+[submodule "client/3rd/QSimpleCrypto"]
+	path = client/3rd/QSimpleCrypto
+	url = https://github.com/amnezia-vpn/QSimpleCrypto.git
 [submodule "client/3rd/qtgamepad"]
 	path = client/3rd/qtgamepad
 	url = https://github.com/amnezia-vpn/qtgamepad.git
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,34 +1,18 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)

-set(CMAKE_CXX_STANDARD 17)
-set(CMAKE_CXX_STANDARD_REQUIRED ON)
-
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 5.0.1.0)
-
-set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
-set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
-    ${CMAKE_SOURCE_DIR}/cmake/platform_settings.cmake
-    ${CMAKE_SOURCE_DIR}/cmake/recipes_bootstrap.cmake
-    ${CMAKE_SOURCE_DIR}/cmake/conan_provider.cmake
-    CACHE STRING "" FORCE)
+set(AMNEZIAVPN_VERSION 4.8.15.4)

 project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
        DESCRIPTION "AmneziaVPN"
        HOMEPAGE_URL "https://amnezia.org/"
 )

-# trigger conan to kick off `conan install` globally
-find_package(OpenSSL REQUIRED)
-if (PREBUILTS_ONLY)
-    return()
-endif()
-
 string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")

 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2141)
+set(APP_ANDROID_VERSION_CODE 2120)

 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
    set(MZ_PLATFORM_NAME "linux")
@@ -45,34 +29,59 @@ elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Emscripten")
 endif()

 set(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)

-if(APPLE AND NOT IOS)
-    if(CMAKE_BUILD_TYPE STREQUAL "Debug")
-        set(AMN_PF_RULE_IDENTITY "user { root }")
+if(APPLE)
+    if(IOS)
+        set(CMAKE_OSX_ARCHITECTURES "arm64")
+    elseif(MACOS_NE)
+        set(CMAKE_OSX_ARCHITECTURES "arm64;x86_64")
    else()
-        set(AMN_PF_RULE_IDENTITY "group { amnvpn }")
+        set(CMAKE_OSX_ARCHITECTURES "x86_64")
    endif()
-
-    configure_file(
-        "${CMAKE_SOURCE_DIR}/deploy/data/pf-templates/amn.400.allowPIA.conf.in"
-        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
-        @ONLY
-    )
-
-    file(COPY_FILE
-        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
-        "${CMAKE_SOURCE_DIR}/deploy/data/macos/pf/amn.400.allowPIA.conf"
-        ONLY_IF_DIFFERENT
-    )
 endif()

-
 add_subdirectory(client)

 if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
    add_subdirectory(service)
+
+    include(${CMAKE_SOURCE_DIR}/deploy/installer/config.cmake)
 endif()

-if ((LINUX AND NOT ANDROID) OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (WIN32))
-    include(${CMAKE_SOURCE_DIR}/cmake/CPack.cmake)
+set(AMNEZIA_STAGE_DIR "${CMAKE_BINARY_DIR}/stage")
+
+if(WIN32 AND NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+    file(TO_CMAKE_PATH "${AMNEZIA_STAGE_DIR}" AMNEZIA_STAGE_DIR_CMAKE)
+
+    set(CPACK_GENERATOR "WIX")
+    set(CPACK_WIX_VERSION 4)
+    set(CPACK_PACKAGE_NAME "AmneziaVPN")
+    set(CPACK_PACKAGE_VENDOR "AmneziaVPN")
+    set(CPACK_PACKAGE_VERSION ${AMNEZIAVPN_VERSION})
+    set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "AmneziaVPN client")
+    set(AMNEZIA_LICENSE_TXT "${CMAKE_BINARY_DIR}/LICENSE.txt")
+    configure_file("${CMAKE_SOURCE_DIR}/LICENSE" "${AMNEZIA_LICENSE_TXT}" COPYONLY)
+    set(CPACK_RESOURCE_FILE_LICENSE "${AMNEZIA_LICENSE_TXT}")
+    set(CPACK_PACKAGE_INSTALL_DIRECTORY "AmneziaVPN")
+    set(CPACK_PACKAGE_DIRECTORY "${CMAKE_BINARY_DIR}")
+    set(CPACK_PACKAGE_EXECUTABLES "AmneziaVPN" "AmneziaVPN")
+    set(CPACK_WIX_UPGRADE_GUID "{2D55AC62-96D6-4692-8C05-0D85BBF95485}")
+    set(CPACK_WIX_PRODUCT_ICON "${CMAKE_SOURCE_DIR}/client/images/app.ico")
+
+    # WiX patches
+    set(_AMNEZIA_WIX_PATCH_SERVICE "${CMAKE_SOURCE_DIR}/deploy/installer/wix/service_install_patch.xml")
+    set(_AMNEZIA_WIX_PATCH_CLOSE_APP "${CMAKE_SOURCE_DIR}/deploy/installer/wix/close_client_patch.xml")
+    file(TO_CMAKE_PATH "${_AMNEZIA_WIX_PATCH_SERVICE}" _AMNEZIA_WIX_PATCH_SERVICE_CMAKE)
+    file(TO_CMAKE_PATH "${_AMNEZIA_WIX_PATCH_CLOSE_APP}" _AMNEZIA_WIX_PATCH_CLOSE_APP_CMAKE)
+    set(CPACK_WIX_PATCH_FILE "${_AMNEZIA_WIX_PATCH_SERVICE_CMAKE};${_AMNEZIA_WIX_PATCH_CLOSE_APP_CMAKE}")
+
+    # WiX v4 Util extension for CloseApplication + namespace for util
+    set(CPACK_WIX_EXTENSIONS "${CPACK_WIX_EXTENSIONS};WixToolset.Util.wixext")
+    set(CPACK_WIX_CUSTOM_XMLNS "util=http://wixtoolset.org/schemas/v4/wxs/util")
+
+    set(CPACK_INSTALLED_DIRECTORIES "${AMNEZIA_STAGE_DIR_CMAKE};/")
+
+    include(CPack)
 endif()
--- a/README.md
+++ b/README.md
@@ -38,14 +38,14 @@

 ## Links

- [https://amnezia.org](https://amnezia.org/?utm_source=github&utm_campaign=amnezia_website-read) - Project website | [Alternative link (mirror)](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-read)
- [https://docs.amnezia.org](https://docs.amnezia.org/?utm_source=github&utm_campaign=amnezia_website-read) - Documentation | [Alternative link (mirror)](https://storage.googleapis.com/amnezia/docs?utm_source=github&utm_campaign=amnezia_website-read)
+- [https://amnezia.org](https://amnezia.org) - Project website | [Alternative link (mirror)](https://storage.googleapis.com/kldscp/amnezia.org)
+- [https://docs.amnezia.org](https://docs.amnezia.org) - Documentation
 - [https://www.reddit.com/r/AmneziaVPN](https://www.reddit.com/r/AmneziaVPN) - Reddit  
- [https://telegram.me/amnezia_vpn_en](https://telegram.me/amnezia_vpn_en) - Telegram support channel (English) 
- [https://telegram.me/amnezia_vpn_ir](https://telegram.me/amnezia_vpn_ir) - Telegram support channel (Farsi) 
- [https://telegram.me/amnezia_vpn_mm](https://telegram.me/amnezia_vpn_mm) - Telegram support channel (Myanmar)  
- [https://telegram.me/amnezia_vpn](https://telegram.me/amnezia_vpn) - Telegram support channel (Russian)
- [Get Premium for 6 or 12 months](https://storage.googleapis.com/amnezia/pay?utm_source=github&utm_campaign=ampay-read)
+- [https://t.me/amnezia_vpn_en](https://t.me/amnezia_vpn_en) - Telegram support channel (English) 
+- [https://t.me/amnezia_vpn_ir](https://t.me/amnezia_vpn_ir) - Telegram support channel (Farsi) 
+- [https://t.me/amnezia_vpn_mm](https://t.me/amnezia_vpn_mm) - Telegram support channel (Myanmar)  
+- [https://t.me/amnezia_vpn](https://t.me/amnezia_vpn) - Telegram support channel (Russian)
+- [https://vpnpay.io/en/amnezia-premium/](https://vpnpay.io/en/amnezia-premium/) - Amnezia Premium

 ## Tech

@@ -53,14 +53,24 @@ AmneziaVPN uses several open-source projects to work:

 - [OpenSSL](https://www.openssl.org/)
 - [OpenVPN](https://openvpn.net/)
+- [Shadowsocks](https://shadowsocks.org/)
 - [Qt](https://www.qt.io/)
- [LibSsh](https://libssh.org)
- [WireGuard](https://www.wireguard.com/)
- [Xray-core](https://xtls.github.io/en/)
- [Conan](https://conan.io/)
+- [LibSsh](https://libssh.org) - forked from Qt Creator
 - and more...

-## Help us with translations
+## Checking out the source code
+
+Make sure to pull all submodules after checking out the repo.
+
+```bash
+git submodule update --init --recursive
+```
+
+## Development
+
+Want to contribute? Welcome!
+
+### Help with translations

 Download the most actual translation files.

@@ -73,98 +83,99 @@ Each *.ts file contains strings for one corresponding language.
 Translate or correct some strings in one or multiple *.ts files and commit them back to this repository into the ``client/translations`` folder.
 You can do it via a web-interface or any other method you're familiar with.

-## Checking out the source code
+### Building sources and deployment

-Make sure to pull all submodules after checking out the repo.
+Check deploy folder for build scripts. 

+### How to build an iOS app from source code on MacOS
+
+1. First, make sure you have [XCode](https://developer.apple.com/xcode/) installed, at least version 14 or higher.
+
+2. We use QT to generate the XCode project. We need QT version 6.6.2. Install QT for MacOS [here](https://doc.qt.io/qt-6/macos.html) or [QT Online Installer](https://www.qt.io/download-open-source). Required modules:
+   - MacOS
+   - iOS
+   - Qt 5 Compatibility Module
+   - Qt Shader Tools
+   - Additional Libraries:
+     - Qt Image Formats
+     - Qt Multimedia
+     - Qt Remote Objects 
+
+3. Install CMake if required. We recommend CMake version 3.25. You can install CMake [here](https://cmake.org/download/)
+
+4. You also need to install go >= v1.16. If you don't have it installed already,
+download go from the [official website](https://golang.org/dl/) or use Homebrew. 
+The latest version is recommended. Install gomobile
 ```bash
-git submodule update --init --recursive
+export PATH=$PATH:~/go/bin
+go install golang.org/x/mobile/cmd/gomobile@latest
+gomobile init
 ```

-## Hacking guide
-
-Want to contribute? Welcome!
-
-### Build requirements
-
-* [`CMake`](https://cmake.org/download/)
-* Compiler and underlying build system, depending on the target:
-  - [Linux] Any of `make` and `gcc`
-  - [Apple] [`Xcode`](https://developer.apple.com/xcode/) or [`Xcode command line tools`](https://developer.apple.com/xcode/)
-  - [Windows] [`Visual Studio 2022`](https://aka.ms/vs/17/release/vs_community.exe) or [`VS 2022 Build Tools`](https://aka.ms/vs/17/release/vs_buildtools.exe)
-  - [Android] [`Android SDK`](#installing-android-sdk) and [`Ninja`](https://ninja-build.org/)
-* [`Qt 6.10+`](https://www.qt.io/download-open-source) with the following modules:
-  - Core module for targeting platform (Desktop/Android/iOS)
-  - Qt 5 Compatibility module
-  - Qt Remote Objects
-* [`Conan`](https://conan.io/downloads) package manager
-  - On MacOS is enough just to use `homebrew` or install it in `.venv` in project root
-  - Other systems must have it in `PATH`
-* (Optional) Installer dependencies:
-  - [Windows/Linux] [`Qt Installer Framework`](https://www.qt.io/download-open-source)
-  - [Windows] [`WIX toolset`](https://github.com/wixtoolset/wix/releases)
-
-### Building the project using scripts
-
-* Run scripts located in `deploy` directory
-* Basically, if dependencies are located in default installation paths, the scripts will find them automatically.
-* If they differ, specify them using the following variables:
-  - `QT_INSTALL_DIR` - Qt root installation folder
-  - `QT_ROOT_PATH`   - Qt framework root directory
-  - `QIF_ROOT_PATH`  - Qt Installer Framework root path
-  - `ANDROID_HOME`   - Path to Android SDK root folder
-  - and others. Check scripts for more
-
-Unix-like:
+5. Build the project
 ```bash
-# Build executables for the host platform
-deploy/build.sh
+export QT_BIN_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/ios/bin"
+export QT_MACOS_ROOT_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/macos"
+export QT_IOS_BIN=$QT_BIN_DIR
+export PATH=$PATH:~/go/bin
+mkdir build-ios
+$QT_IOS_BIN/qt-cmake . -B build-ios -GXcode -DQT_HOST_PATH=$QT_MACOS_ROOT_DIR
+```
+Replace PATH-TO-QT-FOLDER and QT-VERSION to your environment

-# Or just
-deploy/build.sh

-# Build executables and installers for the host platform
-deploy/build.sh --installer all
-
-# Build Android APK and AAB
-deploy/build.sh -t android --aab
-
-# Call for help
-deploy/build.sh -h
+If you get `gomobile: command not found` make sure to set PATH to the location 
+of the bin folder where gomobile was installed. Usually, it's in `GOPATH`.
+```bash
+export PATH=$(PATH):/path/to/GOPATH/bin
 ```

-Windows:
-```batch
-:: Build executables for Windows
-deploy/build.bat
+6. Open the XCode project. You can then run /test/archive/ship the app.

-:: Build executables with IFW installer for Windows
-deploy/build.bat --installer ifw
+If the build fails with the following error
+```
+make: *** 
+[$(PROJECTDIR)/client/build/AmneziaVPN.build/Debug-iphoneos/wireguard-go-bridge/goroot/.prepared] 
+Error 1
+```
+Add a user-defined variable to both AmneziaVPN and WireGuardNetworkExtension targets' build settings with
+key `PATH` and value `${PATH}/path/to/bin/folder/with/go/executable`, e.g. `${PATH}:/usr/local/go/bin`.

-:: Build executables with IFW and WIX installer for Windows
-deploy/build.bat --installer ifw --installer wix
-
-:: Or just
-deploy/build.bat --installer all
+if the above error persists on your M1 Mac, then most probably you need to install arch based CMake 
+```
+arch -arm64 brew install cmake
 ```

-### Developing the project in IDEs
+Build might fail with the "source files not found" error the first time you try it, because the modern XCode build system compiles dependencies in parallel, and some dependencies end up being built after the ones that
+require them. In this case, simply restart the build.

-* Basically, you can use any IDE that handles CMake and Qt kits properly to run configure and build steps, and to navigate through the code nicely. For example:
-  - `Qt Creator`
-  - `Visual Studio Code` with `Qt Extension Pack`
-  - and so on
+## How to build the Android app

-* To use `Xcode`, you have to configure project first by using `cmake`. The easiest way to do it is to use `Qt Creator` for configuration. Then open `AmneziaVPN.xcodeproj` file from the build folder by using `Xcode`. Note that none of the files changed are saved - the files actually getting changed in build directory. Copy them manually if necessary
+_Tested on Mac OS_

-* `Android studio` could be used in the same way - just configure the project by using `cmake` manually or by using `Qt Creator`. Open `<build-dir>/client/android-build` in `Android studio` then. Do not forget to copy the changes - everything you do is saved under the build directory actually.
+The Android app has the following requirements:
+* JDK 11
+* Android platform SDK 33
+* CMake 3.25.0

-### Installing Android SDK
+After you have installed QT, QT Creator, and Android Studio, you need to configure QT Creator correctly.

-* Android SDK could be installed using the following methods:
-  - Using `Qt Creator`. Use `Preferences`->`SDKs`
-  - Using `Android studio`. By default it installs necessary `SDKs` automatically during the installation
-  - Manually by using `sdk-manager`. Check [this](https://developer.android.com/tools) page for details
+- Click in the top menu bar on `QT Creator` -> `Preferences` -> `Devices` and select the tab `Android`.
+- Set path to JDK 11
+- Set path to Android SDK (`$ANDROID_HOME`)
+
+In case you get errors regarding missing SDK or 'SDK manager not running', you cannot fix them by correcting the paths. If you have some spare GBs on your disk, you can let QT Creator install all requirements by choosing an empty folder for `Android SDK location` and clicking on `Set Up SDK`. Be aware: This will install a second Android SDK and NDK on your machine! 
+Double-check that the right CMake version is configured:  Click on `QT Creator` -> `Preferences` and click on the side menu on `Kits`. Under the center content view's `Kits` tab, you'll find an entry for `CMake Tool`. If the default selected CMake version is lower than 3.25.0, install on your system CMake >= 3.25.0 and choose `System CMake at <path>` from the drop-down list. If this entry is missing, you either have not installed CMake yet or QT Creator hasn't found the path to it. In that case, click in the preferences window on the side menu item `CMake`, then on the tab `Tools` in the center content view, and finally on the button `Add` to set the path to your installed CMake. 
+Please make sure that you have selected Android Platform SDK 33 for your project: click in the main view's side menu on `Projects`, and on the left, you'll see a section `Build & Run` showing different Android build targets. You can select any of them, Amnezia VPN's project setup is designed in a way that all Android targets will be built. Click on the targets submenu item `Build` and scroll in the center content view to `Build Steps`. Click on `Details` at the end of the headline `Build Android APK` (the `Details` button might be hidden in case the QT Creator Window is not running in full screen!). Here we are: Choose `android-33` as `Android Build Platform SDK`.
+
+That's it! You should be ready to compile the project from QT Creator!
+
+### Development flow
+
+After you've hit the build button, QT-Creator copies the whole project to a folder in the repository parent directory. The folder should look something like `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>`.
+If you want to develop Amnezia VPNs Android components written in Kotlin, such as components using system APIs, you need to import the generated project in Android Studio with `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>/client/android-build` as the projects root directory. While you should be able to compile the generated project from Android Studio, you cannot work directly in the repository's Android project. So whenever you are confident with your work in the generated project, you'll need to copy and paste the affected files to the corresponding path in the repository's Android project so that you can add and commit your changes!
+
+You may face compiling issues in QT Creator after you've worked in Android Studio on the generated project. Just do a `./gradlew clean` in the generated project's root directory (`<path>/client/android-build/.`) and you should be good to go.

 ## License

--- a/README_RU.md
+++ b/README_RU.md
@@ -28,21 +28,21 @@

 - Простой в использовании — введите IP-адрес, SSH-логин и пароль, и Amnezia автоматически установит VPN-контейнеры Docker на ваш сервер и подключится к VPN.
 - Классические VPN-протоколы: OpenVPN, WireGuard и IKEv2.
- Протоколы с маскировкой трафика (обфускацией): OpenVPN с плагином [Cloak](https://github.com/cbeuw/Cloak), Shadowsocks (OpenVPN over Shadowsocks), [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) и XRay.
+- Протоколы с маскировкой трафика (обфускацией): OpenVPN с плагином [Cloak](https://github.com/cbeuw/Cloak), Shadowsocks (OpenVPN over Shadowsocks), [AmneziaWG](https://docs.amnezia.org/documentation/amnezia-wg/) and XRay.
 - Поддержка Split Tunneling — добавляйте любые сайты или приложения в список, чтобы включить VPN только для них.
 - Поддерживает платформы: Windows, macOS, Linux, Android, iOS.
 - Поддержка конфигурации протокола AmneziaWG на [бета-прошивке Keenetic](https://docs.keenetic.com/ua/air/kn-1611/en/6319-latest-development-release.html#UUID-186c4108-5afd-c10b-f38a-cdff6c17fab3_section-idm33192196168192-improved).

 ## Ссылки

- [https://amnezia.org](https://amnezia.org/?utm_source=github&utm_campaign=amnezia_website-read) - Веб-сайт проекта | [Альтернативная ссылка (зеркало)](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-read)
- [https://docs.amnezia.org](https://docs.amnezia.org/?utm_source=github&utm_campaign=amnezia_website-read) - Документация | [Альтернативная ссылка (зеркало)](https://storage.googleapis.com/amnezia/docs?utm_source=github&utm_campaign=amnezia_website-read)
+- [https://amnezia.org](https://amnezia.org) - Веб-сайт проекта | [Альтернативная ссылка (зеркало)](https://storage.googleapis.com/kldscp/amnezia.org)
+- [https://docs.amnezia.org](https://docs.amnezia.org) - Документация
 - [https://www.reddit.com/r/AmneziaVPN](https://www.reddit.com/r/AmneziaVPN) - Reddit  
- [https://telegram.me/amnezia_vpn_en](https://telegram.me/amnezia_vpn_en) - Канал поддержки в Telegram (Английский)
- [https://telegram.me/amnezia_vpn_ir](https://telegram.me/amnezia_vpn_ir) - Канал поддержки в Telegram (Фарси)
- [https://telegram.me/amnezia_vpn_mm](https://telegram.me/amnezia_vpn_mm) - Канал поддержки в Telegram (Мьянма) 
- [https://telegram.me/amnezia_vpn](https://telegram.me/amnezia_vpn) - Канал поддержки в Telegram  (Русский)
- [Оформите Premium на 6 или 12 месяцев](https://storage.googleapis.com/amnezia/pay?utm_source=github&utm_campaign=ampay-read)
+- [https://t.me/amnezia_vpn_en](https://t.me/amnezia_vpn_en) - Канал поддержки в Telegram (Английский)
+- [https://t.me/amnezia_vpn_ir](https://t.me/amnezia_vpn_ir) - Канал поддержки в Telegram (Фарси)
+- [https://t.me/amnezia_vpn_mm](https://t.me/amnezia_vpn_mm) - Канал поддержки в Telegram (Мьянма) 
+- [https://t.me/amnezia_vpn](https://t.me/amnezia_vpn) - Канал поддержки в Telegram  (Русский)
+- [https://vpnpay.io/en/amnezia-premium/](https://vpnpay.io/en/amnezia-premium/) - Amnezia Premium | [Зеркало](https://storage.googleapis.com/kldscp/vpnpay.io/ru/amnezia-premium\)

 ## Технологии

@@ -50,14 +50,23 @@ AmneziaVPN использует несколько проектов с откр

 - [OpenSSL](https://www.openssl.org/)
 - [OpenVPN](https://openvpn.net/)
+- [Shadowsocks](https://shadowsocks.org/)
 - [Qt](https://www.qt.io/)
 - [LibSsh](https://libssh.org)
- [WireGuard](https://www.wireguard.com/)
- [Xray-core](https://xtls.github.io/en/)
- [Conan](https://conan.io/)
 - и другие...

-## Помощь с переводами
+## Проверка исходного кода
+После клонирования репозитория обязательно загрузите все подмодули.
+
+```bash
+git submodule update --init --recursive
+```
+
+
+## Разработка
+Хотите внести свой вклад? Добро пожаловать!
+
+### Помощь с переводами

 Загрузите самые актуальные файлы перевода.

@@ -67,98 +76,90 @@ AmneziaVPN использует несколько проектов с откр

 Переведите или исправьте строки в одном или нескольких файлах *.ts и загрузите их обратно в этот репозиторий в папку ``client/translations``. Это можно сделать через веб-интерфейс или любым другим знакомым вам способом.

-## Проверка исходного кода
+### Сборка исходного кода и деплой
+Проверьте папку deploy для скриптов сборки.

-После клонирования репозитория обязательно загрузите все подмодули.
+### Как собрать iOS-приложение из исходного кода на MacOS
+1. Убедитесь, что у вас установлен Xcode версии 14 или выше.
+2. Для генерации проекта Xcode используется QT. Требуется версия QT 6.6.2. Установите QT для MacOS здесь или через QT Online Installer. Необходимые модули:
+- MacOS
+- iOS
+- Модуль совместимости с Qt 5
+- Qt Shader Tools
+- Дополнительные библиотеки:
+ - Qt Image Formats
+ - Qt Multimedia
+ - Qt Remote Objects
+
+   
+3. Установите CMake, если это необходимо. Рекомендуемая версия — 3.25. Скачать CMake можно здесь.
+4. Установите Go версии >= v1.16. Если Go ещё не установлен, скачайте его с  [официального сайта](https://golang.org/dl/) или используйте Homebrew. Установите gomobile:

 ```bash
-git submodule update --init --recursive
+export PATH=$PATH:~/go/bin
+go install golang.org/x/mobile/cmd/gomobile@latest
+gomobile init
 ```

-## Руководство по разработке
-
-Хотите внести свой вклад? Добро пожаловать!
-
-### Требования для сборки
-
-* [`CMake`](https://cmake.org/download/)
-* Компилятор и система сборки, в зависимости от таргета:
-  - [Linux] Любые `make` и `gcc`
-  - [Apple] [`Xcode`](https://developer.apple.com/xcode/) или [`Xcode command line tools`](https://developer.apple.com/xcode/)
-  - [Windows] [`Visual Studio 2022`](https://aka.ms/vs/17/release/vs_community.exe) или [`VS 2022 Build Tools`](https://aka.ms/vs/17/release/vs_buildtools.exe)
-  - [Android] [`Android SDK`](#установка-android-sdk) и [`Ninja`](https://ninja-build.org/)
-* [`Qt 6.10+`](https://www.qt.io/download-open-source) со следующими модулями:
-  - Основные модули для таргета (Desktop/Android/iOS)
-  - Qt 5 Compatibility module
-  - Qt Remote Objects
-* Пакетный менеджер [`Conan`](https://conan.io/downloads)
-  - На MacOS достаточно использовать `homebrew` или установить в `.venv` в корень проекта 
-  - Для остальных систем необходимо прописать пути в `PATH`
-* (Необязательно) Заивисимости для установщиков:
-  - [Windows/Linux] [`Qt Installer Framework`](https://www.qt.io/download-open-source)
-  - [Windows] [`WIX toolset`](https://github.com/wixtoolset/wix/releases)
-
-### Сборка проекта через скрипты
-
-* Запустите скрипты, находящиеся в папке `deploy`
-* Если все зависимости установлены в стандартных локациях, скрипт найдёт их самостоятельно
-* Если пути отличаются, их нужно явно указать используя:
-  - `QT_INSTALL_DIR` - корневая папка установки Qt
-  - `QT_ROOT_PATH`   - корневая папка Qt Framework
-  - `QIF_ROOT_PATH`  - корневая папка Qt Installer Framework
-  - `ANDROID_HOME`   - путь к Android SDK
-  - и другие. Их можно получить из вышеуказанных скриптов
-
-Unix-like:
+5. Соберите проект:
 ```bash
-# Build executables for the host platform
-deploy/build.sh
+export QT_BIN_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/ios/bin"
+export QT_MACOS_ROOT_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/macos"
+export QT_IOS_BIN=$QT_BIN_DIR
+export PATH=$PATH:~/go/bin
+mkdir build-ios
+$QT_IOS_BIN/qt-cmake . -B build-ios -GXcode -DQT_HOST_PATH=$QT_MACOS_ROOT_DIR
+```
+Замените <PATH-TO-QT-FOLDER> и <QT-VERSION> на ваши значения.

-# Or just
-deploy/build.sh
-
-# Build executables and installers for the host platform
-deploy/build.sh --installer all
-
-# Build Android APK and AAB
-deploy/build.sh -t android --aab
-
-# Call for help
-deploy/build.sh -h
+Если появляется ошибка gomobile: command not found, убедитесь, что PATH настроен на папку bin, где установлен gomobile:
+```bash
+export PATH=$(PATH):/path/to/GOPATH/bin
 ```

-Windows:
-```batch
-:: Build executables for Windows
-deploy/build.bat
+6. Откройте проект в Xcode. Теперь вы можете тестировать, архивировать или публиковать приложение.
+   
+Если сборка завершится с ошибкой:
+```
+make: *** 
+[$(PROJECTDIR)/client/build/AmneziaVPN.build/Debug-iphoneos/wireguard-go-bridge/goroot/.prepared] 
+Error 1
+```
+Добавьте пользовательскую переменную PATH в настройки сборки для целей AmneziaVPN и WireGuardNetworkExtension с ключом `PATH` и значением `${PATH}/path/to/bin/folder/with/go/executable`, e.g. `${PATH}:/usr/local/go/bin`.

-:: Build executables with IFW installer for Windows
-deploy/build.bat --installer ifw
-
-:: Build executables with IFW and WIX installer for Windows
-deploy/build.bat --installer ifw --installer wix
-
-:: Or just
-deploy/build.bat --installer all
+Если ошибка повторяется на Mac с M1, установите версию CMake для архитектуры ARM:
+```
+arch -arm64 brew install cmake
 ```

-### Разработка в IDE
+ При первой попытке сборка может завершиться с ошибкой source files not found. Это происходит из-за параллельной компиляции зависимостей в XCode. Просто перезапустите сборку.

-* Можно использовать любые IDE которые умеют работать с CMake и находить Qt Kits. Например:
-  - `Qt Creator`
-  - `Visual Studio Code` with `Qt Extension Pack`
-  - и так далее

-* Для использования `Xcode` нужно сконфигурировать проект с помощью `cmake`. Самый простой способ это сделать - использовать `Qt Creator` для конфигурации. Затем, нужно открыть файл `AmneziaVPN.xcodeproj` из папки сборки с помощью `Xcode`. Учтите, что никакие файлы фактически не сохраняются - они сохраняются в директории сборки. Если требуется, скопируйте файлы вручную
+## Как собрать Android-приложение
+Сборка тестировалась на MacOS. Требования:
+- JDK 11
+- Android SDK 33
+- CMake 3.25.0
+  
+Установите QT, QT Creator и Android Studio.
+Настройте QT Creator:

-* `Android studio` может быть использована подобным вышеуказанному способу - нужно использовать `cmake` вручную или через `Qt Creator` для конфигурации. Далее, откройте `<build-dir>/client/android-build` в `Android studio`. Не забудьте скопировать изменённые файлы в папку с исходным кодом - все файлы, изменённые в IDE, сохраняются фактически в папке сборки.
+- В меню QT Creator перейдите в  `QT Creator` -> `Preferences` -> `Devices` ->`Android`.
+- Укажите путь к JDK 11.
+- Укажите путь к Android SDK (`$ANDROID_HOME`)

-### Установка Android SDK
+Если вы сталкиваетесь с ошибками, связанными с отсутствием SDK или сообщением «SDK manager not running», их нельзя исправить просто корректировкой путей. Если у вас есть несколько свободных гигабайт на диске, вы можете позволить Qt Creator установить все необходимые компоненты, выбрав пустую папку для расположения Android SDK и нажав кнопку **Set Up SDK**. Учтите: это установит второй Android SDK и NDK на вашем компьютере!
+
+Убедитесь, что настроена правильная версия CMake: перейдите в **Qt Creator -> Preferences** и в боковом меню выберите пункт **Kits**. В центральной части окна, на вкладке **Kits**, найдите запись для инструмента **CMake Tool**. Если выбранная по умолчанию версия CMake ниже 3.25.0, установите на свою систему CMake версии 3.25.0 или выше, а затем выберите опцию **System CMake at <путь>** из выпадающего списка. Если этот пункт отсутствует, это может означать, что вы еще не установили CMake, или Qt Creator не смог найти путь к нему. В таком случае в окне **Preferences** перейдите в боковое меню **CMake**, затем во вкладку **Tools** в центральной части окна и нажмите кнопку **Add**, чтобы указать путь к установленному CMake.
+
+Убедитесь, что для вашего проекта выбрана Android Platform SDK 33: в главном окне на боковой панели выберите пункт **Projects**, и слева вы увидите раздел **Build & Run**, показывающий различные целевые Android-платформы. Вы можете выбрать любую из них, так как настройка проекта Amnezia VPN разработана таким образом, чтобы все Android-цели могли быть собраны. Перейдите в подраздел **Build** и прокрутите центральную часть окна до раздела **Build Steps**. Нажмите **Details** в заголовке **Build Android APK** (кнопка **Details** может быть скрыта, если окно Qt Creator не запущено в полноэкранном режиме!). Вот здесь выберите **android-33** в качестве Android Build Platform SDK.
+
+### Разработка Android-компонентов
+
+После сборки QT Creator копирует проект в отдельную папку, например, `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>`. Для разработки Android-компонентов откройте сгенерированный проект в Android Studio, указав папку `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>/client/android-build` в качестве корневой.
+Изменения в сгенерированном проекте нужно вручную перенести в репозиторий. После этого можно коммитить изменения.
+Если возникают проблемы со сборкой в QT Creator после работы в Android Studio, выполните команду `./gradlew clean` в корневой папке сгенерированного проекта (`<path>/client/android-build/.`).

-* Android SDK может быть установлен следующими способами:
-  - Используя `Qt Creator`, через настройки в пунктах `Preferences`->`SDKs`
-  - Используя `Android studio`. По умолчанию необходимые `SDK` устанавливаются автоматически.
-  - Вручную, используя `sdk-manager`. Подробности можно найти [здесь](https://developer.android.com/tools)

 ## Лицензия

--- a/client/3rd-prebuilt
+++ b/client/3rd-prebuilt
--- a/client/3rd/QSimpleCrypto
+++ b/client/3rd/QSimpleCrypto
--- a/client/3rd/amneziawg-apple
+++ b/client/3rd/amneziawg-apple
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -39,7 +39,6 @@ if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
 endif()

 find_package(Qt6 REQUIRED COMPONENTS ${PACKAGES})
-find_package(OpenSSL REQUIRED)

 set(LIBS ${LIBS}
    Qt6::Core Qt6::Gui
@@ -66,12 +65,13 @@ endif()
 qt6_add_resources(QRC ${QRC}
    ${CMAKE_CURRENT_LIST_DIR}/images/images.qrc
    ${CMAKE_CURRENT_LIST_DIR}/images/flagKit.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/client_scripts/clientScripts.qrc
    ${CMAKE_CURRENT_LIST_DIR}/ui/qml/qml.qrc
    ${CMAKE_CURRENT_LIST_DIR}/server_scripts/serverScripts.qrc
 )

 # -- i18n begin
+set(CMAKE_AUTORCC ON)
+
 set(AMNEZIAVPN_TS_FILES
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_ru_RU.ts
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_zh_CN.ts
@@ -83,10 +83,20 @@ set(AMNEZIAVPN_TS_FILES
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_hi_IN.ts
 )

-qt6_add_translations(${PROJECT}
-    TS_FILES ${AMNEZIAVPN_TS_FILES}
-    RESOURCE_PREFIX "/translations"
-)
+file(GLOB_RECURSE AMNEZIAVPN_TS_SOURCES *.qrc *.cpp *.h *.ui)
+list(FILTER AMNEZIAVPN_TS_SOURCES EXCLUDE REGEX "qtgamepad/examples")
+
+qt_create_translation(AMNEZIAVPN_QM_FILES ${AMNEZIAVPN_TS_SOURCES} ${AMNEZIAVPN_TS_FILES})
+
+set(QM_FILE_LIST "")
+foreach(FILE ${AMNEZIAVPN_QM_FILES})
+    get_filename_component(QM_FILE_NAME ${FILE} NAME)
+    list(APPEND QM_FILE_LIST "<file>${QM_FILE_NAME}</file>")
+endforeach()
+string(REPLACE ";" "" QM_FILE_LIST ${QM_FILE_LIST})
+
+configure_file(${CMAKE_CURRENT_LIST_DIR}/translations/translations.qrc.in ${CMAKE_CURRENT_BINARY_DIR}/translations.qrc)
+qt6_add_resources(QRC ${I18NQRC} ${CMAKE_CURRENT_BINARY_DIR}/translations.qrc)
 # -- i18n end

 set(IS_CI ${CI})
@@ -104,7 +114,6 @@ include(${CMAKE_CURRENT_LIST_DIR}/cmake/sources.cmake)
 include_directories(
    ${CMAKE_CURRENT_LIST_DIR}/../ipc
    ${CMAKE_CURRENT_LIST_DIR}/../common/logger
-    ${CMAKE_CURRENT_LIST_DIR}/../common/crypto
    ${CMAKE_CURRENT_LIST_DIR}
    ${CMAKE_CURRENT_BINARY_DIR}
 )
@@ -166,16 +175,11 @@ if(APPLE)
    set(CMAKE_XCODE_GENERATE_SCHEME FALSE)
    set(CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM ${BUILD_VPN_DEVELOPMENT_TEAM})
    set(CMAKE_XCODE_ATTRIBUTE_GROUP_ID_IOS ${BUILD_IOS_GROUP_IDENTIFIER})
-    
-    if (BUILD_VPN_KEYCHAIN)
-        set(CMAKE_XCODE_ATTRIBUTE_OTHER_CODE_SIGN_FLAGS "--keychain ${BUILD_VPN_KEYCHAIN}")
-    endif()
 endif()

 if(LINUX AND NOT ANDROID)
    set(LIBS ${LIBS} -static-libstdc++ -static-libgcc -ldl)
    link_directories(${CMAKE_CURRENT_LIST_DIR}/platforms/linux)
-    set(LIBS ${LIBS} -Wl,--no-as-needed $<TARGET_LINKER_FILE:Qt6::RemoteObjects> -Wl,--as-needed)
 endif()

 if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
@@ -196,11 +200,45 @@ elseif(APPLE)
    include(cmake/macos.cmake)
 endif()

-list(APPEND SOURCES ${CMAKE_CURRENT_LIST_DIR}/main.cpp)
-
 target_link_libraries(${PROJECT} PRIVATE ${LIBS})
 target_compile_definitions(${PROJECT} PRIVATE "MZ_$<UPPER_CASE:${MZ_PLATFORM_NAME}>")

+# deploy artifacts required to run the application to the debug build folder
+if(WIN32)
+    if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "8")
+        set(DEPLOY_PLATFORM_PATH "windows/x64")
+    else()
+        set(DEPLOY_PLATFORM_PATH "windows/x32")
+    endif()
+elseif(LINUX)
+    set(DEPLOY_PLATFORM_PATH "linux/client")
+elseif(APPLE AND NOT IOS)
+    set(DEPLOY_PLATFORM_PATH "macos")
+endif()
+
+if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+    add_custom_command(
+        TARGET ${PROJECT} POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E $<IF:$<CONFIG:Debug>,copy_directory,true>
+        ${CMAKE_SOURCE_DIR}/deploy/data/${DEPLOY_PLATFORM_PATH}
+        $<TARGET_FILE_DIR:${PROJECT}>
+        COMMAND_EXPAND_LISTS
+    )
+    add_custom_command(
+        TARGET ${PROJECT} POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E $<IF:$<CONFIG:Debug>,copy_directory,true>
+        ${CMAKE_SOURCE_DIR}/client/3rd-prebuilt/deploy-prebuilt/${DEPLOY_PLATFORM_PATH}
+        $<TARGET_FILE_DIR:${PROJECT}>
+        COMMAND_EXPAND_LISTS
+    )
+endif()
+
+if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+    add_subdirectory(tests)
+endif()
+
+list(APPEND SOURCES ${CMAKE_CURRENT_LIST_DIR}/main.cpp)
+
 target_sources(${PROJECT} PRIVATE ${SOURCES} ${HEADERS} ${RESOURCES} ${QRC} ${I18NQRC})

 # Finalize the executable so Qt can gather/deploy QML modules and plugins correctly (Android needs this).
@@ -212,76 +250,3 @@ if(COMMAND qt_finalize_executable)
 else()
    qt_finalize_target(${PROJECT})
 endif()
-
-install(TARGETS ${PROJECT}
-    DESTINATION ${CMAKE_INSTALL_BINDIR}
-    RUNTIME_DEPENDENCY_SET client_deps
-    COMPONENT AmneziaVPN
-)
-
-if(APPLE)
-    set(RUNTIME_DEPS_DIR ${CMAKE_INSTALL_BINDIR}/AmneziaVPN.app/Contents/Frameworks)
-else()
-    set(RUNTIME_DEPS_DIR ${CMAKE_INSTALL_BINDIR})
-endif()
-
-install(RUNTIME_DEPENDENCY_SET client_deps
-    PRE_EXCLUDE_REGEXES
-        [[api-ms-win-.*]]
-        [[ext-ms-.*]]
-        [[kernel32\.dll]]
-        [[hvsifiletrust\.dll]]
-        [[libc\.so\..*]] [[libgcc_s\.so\..*]] [[libm\.so\..*]] [[libstdc\+\+\.so\..*]]
-        [[.*\.framework]]
-        [[^(lib)?[Qq]t.*]]
-    POST_EXCLUDE_REGEXES
-        [[^.*[\\/]system32[\\/].*\.dll$]]
-        [[^/lib.*]]
-        [[^/usr/lib.*]]
-    DIRECTORIES ${CONAN_RUNTIME_LIB_DIRS}
-    COMPONENT AmneziaVPN
-    DESTINATION "${RUNTIME_DEPS_DIR}"
-)
-
-set(deploy_tool_options "")
-if(WIN32)
-    set(deploy_tool_options "--force-openssl --force")
-endif()
-
-qt_generate_deploy_qml_app_script(
-    TARGET ${PROJECT}
-    OUTPUT_SCRIPT QT_DEPLOY_SCRIPT
-    NO_UNSUPPORTED_PLATFORM_ERROR
-    DEPLOY_TOOL_OPTIONS ${deploy_tool_options}
-)
-install(SCRIPT ${QT_DEPLOY_SCRIPT}
-    COMPONENT AmneziaVPN
-)
-
-if (APPLE AND NOT IOS AND NOT MACOS_NE)
-    list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/macos/update-resolv-conf.sh")
-    set_target_properties(${PROJECT} PROPERTIES
-        XCODE_ATTRIBUTE_CODE_SIGNING_ALLOWED "NO"
-        XCODE_ATTRIBUTE_CODE_SIGNING_REQUIRED "NO"
-    )
-endif()
-if (LINUX AND NOT ANDROID)
-    list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/linux/update-resolv-conf.sh")
-endif()
-
-if(OVPN_SCRIPTS)
-    add_custom_command(TARGET ${PROJECT} POST_BUILD
-        COMMAND ${CMAKE_COMMAND} -E copy_if_different
-        ${OVPN_SCRIPTS}
-        "$<TARGET_FILE_DIR:${PROJECT}>"
-    )
-
-    install(FILES ${OVPN_SCRIPTS}
-        DESTINATION ${CMAKE_INSTALL_BINDIR}
-        COMPONENT AmneziaVPN
-        PERMISSIONS
-            OWNER_READ OWNER_EXECUTE
-            GROUP_READ GROUP_EXECUTE
-            WORLD_READ WORLD_EXECUTE
-    )
-endif()
--- a/client/amneziaApplication.cpp
+++ b/client/amneziaApplication.cpp
@@ -22,13 +22,9 @@
 #include "logger.h"
 #include "ui/controllers/qml/pageController.h"
 #include "ui/models/installedAppsModel.h"
-#include "ui/utils/mtProxyPublicHostInput.h"
 #include "version.h"

 #include "platforms/ios/QRCodeReaderBase.h"
-#ifdef Q_OS_IOS
-    #include "platforms/ios/ioscontextmenu.h"
-#endif
         

 bool AmneziaApplication::m_forceQuit = false;
@@ -123,13 +119,7 @@ void AmneziaApplication::init()
                win->setPersistentSceneGraph(true);
                win->setPersistentGraphics(true);
 #endif
-#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
                win->show();
-#else
-                if (!m_coreController || !m_coreController->pageController()->shouldStartMinimized()) {
-                    win->show();
-                }
-#endif
            }
        },
        Qt::QueuedConnection);
@@ -142,19 +132,12 @@ void AmneziaApplication::init()
    m_engine->rootContext()->setContextProperty("IsMacOsNeBuild", false);
 #endif

-#ifdef Q_OS_IOS
-    m_engine->rootContext()->setContextProperty("IosContextMenu", new IosContextMenu(this));
-#endif
-
    m_vpnConnection.reset(new VpnConnection(nullptr, nullptr));
    m_vpnConnection->moveToThread(&m_vpnConnectionThread);
    m_vpnConnectionThread.start();

    m_coreController.reset(new CoreController(m_vpnConnection, m_settings, m_engine));

-    m_marketplaceUpdateController.reset(new MarketplaceUpdateController());
-    m_marketplaceUpdateController->start();
-
    m_engine->addImportPath("qrc:/ui/qml/Modules/");

    if (m_parser.isSet(m_optImport)) {
@@ -232,9 +215,6 @@ void AmneziaApplication::registerTypes()

    qmlRegisterType<InstalledAppsModel>("InstalledAppsModel", 1, 0, "InstalledAppsModel");

-    qmlRegisterType<PublicHostInputValidator>("MtProxyConfig", 1, 0, "PublicHostInputValidator");
-    qmlRegisterType<PublicHostInputValidator>("TelemtConfig", 1, 0, "PublicHostInputValidator");
-
    amnezia::declareQmlProtocolEnum();
    Vpn::declareQmlVpnConnectionStateEnum();
    PageLoader::declareQmlPageEnum();
--- a/client/amneziaApplication.h
+++ b/client/amneziaApplication.h
@@ -15,7 +15,6 @@

 #include "core/controllers/coreController.h"
 #include "secureQSettings.h"
-#include "ui/controllers/marketplaceUpdateController.h"
 #include "vpnConnection.h"
 #include "ui/models/containerProps.h"
 #include "ui/models/protocolProps.h"
@@ -57,7 +56,6 @@ private:
    SecureQSettings* m_settings;

    QScopedPointer<CoreController> m_coreController;
-    QScopedPointer<MarketplaceUpdateController> m_marketplaceUpdateController;

    QSharedPointer<ContainerProps> m_containerProps;
    QSharedPointer<ProtocolProps> m_protocolProps;
--- a/client/android/build.gradle.kts
+++ b/client/android/build.gradle.kts
@@ -39,7 +39,6 @@ android {

        // keeps language resources for only the locales specified below
        resourceConfigurations += listOf("en", "ru", "b+zh+Hans")
-        ndk.abiFilters += qtTargetAbiList.split(",")
    }

    sourceSets {
@@ -53,12 +52,50 @@ android {
        }
    }

+    signingConfigs {
+        register("release") {
+            storeFile = providers.environmentVariable("ANDROID_KEYSTORE_PATH").orNull?.let { file(it) }
+            storePassword = providers.environmentVariable("ANDROID_KEYSTORE_KEY_PASS").orNull
+            keyAlias = providers.environmentVariable("ANDROID_KEYSTORE_KEY_ALIAS").orNull
+            keyPassword = providers.environmentVariable("ANDROID_KEYSTORE_KEY_PASS").orNull
+        }
+    }
+
    buildTypes {
        release {
            // exclude coroutine debug resource from release build
            packaging {
                resources.excludes += "DebugProbesKt.bin"
            }
+            signingConfig = signingConfigs["release"]
+        }
+
+        create("fdroid") {
+            initWith(getByName("release"))
+            signingConfig = null
+            matchingFallbacks += "release"
+        }
+    }
+
+    splits {
+        abi {
+            isEnable = true
+            reset()
+            include(*qtTargetAbiList.split(',').toTypedArray())
+            isUniversalApk = false
+        }
+    }
+
+    // fix for Qt Creator to allow deploying the application to a device
+    // to enable this fix, add the line outputBaseName=android-build to local.properties
+    if (outputBaseName.isNotEmpty()) {
+        applicationVariants.all {
+            outputs.map { it as BaseVariantOutputImpl }
+                .forEach { output ->
+                    if (output.outputFileName.endsWith(".apk")) {
+                        output.outputFileName = "$outputBaseName-${buildType.name}.apk"
+                    }
+                }
        }
    }

--- a/client/android/gradle/libs.versions.toml
+++ b/client/android/gradle/libs.versions.toml
@@ -1,11 +1,11 @@
 [versions]
-agp = "8.6.1"
+agp = "8.5.2"
 kotlin = "1.9.24"
 androidx-core = "1.13.1"
 androidx-activity = "1.9.1"
 androidx-annotation = "1.8.2"
 androidx-biometric = "1.2.0-alpha05"
-androidx-camera = "1.5.3"
+androidx-camera = "1.3.4"
 androidx-fragment = "1.8.2"
 androidx-security-crypto = "1.1.0-alpha06"
 androidx-datastore = "1.1.1"
--- a/client/android/res/drawable/ic_launcher_background.xml
+++ b/client/android/res/drawable/ic_launcher_background.xml
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<shape xmlns:android="http://schemas.android.com/apk/res/android"
-    android:shape="rectangle">
-    <gradient
-        android:type="linear"
-        android:angle="135"
-        android:startColor="#2A2A2E"
-        android:centerColor="#17171A"
-        android:endColor="#0E0E11" />
-</shape>
--- a/client/android/res/drawable/ic_launcher_monochrome.xml
+++ b/client/android/res/drawable/ic_launcher_monochrome.xml
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<inset xmlns:android="http://schemas.android.com/apk/res/android"
-    android:drawable="@drawable/ic_amnezia_round"
-    android:insetLeft="19.5%"
-    android:insetTop="19.5%"
-    android:insetRight="19.5%"
-    android:insetBottom="19.5%" />
--- a/client/android/res/mipmap-anydpi-v26/icon.xml
+++ b/client/android/res/mipmap-anydpi-v26/icon.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background" />
-    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_monochrome" />
-</adaptive-icon>
--- a/client/android/res/mipmap-anydpi-v26/icon_round.xml
+++ b/client/android/res/mipmap-anydpi-v26/icon_round.xml
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@drawable/ic_launcher_background" />
-    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
-    <monochrome android:drawable="@drawable/ic_launcher_monochrome" />
-</adaptive-icon>
--- a/client/android/res/mipmap-hdpi/ic_launcher_foreground.png
+++ b/client/android/res/mipmap-hdpi/ic_launcher_foreground.png
--- a/client/android/res/mipmap-mdpi/ic_launcher_foreground.png
+++ b/client/android/res/mipmap-mdpi/ic_launcher_foreground.png
--- a/client/android/res/mipmap-xhdpi/ic_launcher_foreground.png
+++ b/client/android/res/mipmap-xhdpi/ic_launcher_foreground.png
--- a/client/android/res/mipmap-xxhdpi/ic_launcher_foreground.png
+++ b/client/android/res/mipmap-xxhdpi/ic_launcher_foreground.png
--- a/client/android/res/mipmap-xxxhdpi/ic_launcher_foreground.png
+++ b/client/android/res/mipmap-xxxhdpi/ic_launcher_foreground.png
--- a/client/android/res/values-v31/styles.xml
+++ b/client/android/res/values-v31/styles.xml
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <style name="NoActionBar">
-        <item name="android:windowBackground">@color/black</item>
-        <item name="android:colorBackground">@color/black</item>
-        <item name="android:windowActionBar">false</item>
-        <item name="android:windowNoTitle">true</item>
-        <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
-        <item name="android:enforceNavigationBarContrast">false</item>
-        <item name="android:enforceStatusBarContrast">false</item>
-
-        <item name="android:windowSplashScreenBackground">@color/ic_launcher_background</item>
-        <item name="android:windowSplashScreenIconBackgroundColor">@color/ic_launcher_background</item>
-        <item name="android:windowSplashScreenAnimatedIcon">@mipmap/icon</item>
-    </style>
-</resources>
--- a/client/android/res/values/colors.xml
+++ b/client/android/res/values/colors.xml
@@ -1,4 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<resources>
-    <color name="ic_launcher_background">#0E0E11</color>
-</resources>
--- a/client/android/settings.gradle.kts
+++ b/client/android/settings.gradle.kts
@@ -26,6 +26,7 @@ plugins {
    id("settings-property-delegate")
 }

+rootProject.name = "AmneziaVPN"
 rootProject.buildFileName = "build.gradle.kts"

 include(":qt")
@@ -46,7 +47,15 @@ val qtMinSdkVersion: String by gradleProperties
 // set default values for all modules
 configure<SettingsExtension> {
    buildToolsVersion = androidBuildToolsVersion
-    compileSdk = androidCompileSdkVersion.split('-')[1].toInt()
+    compileSdk = androidCompileSdkVersion.substringAfter('-').toInt()
    minSdk = qtMinSdkVersion.toInt()
    ndkVersion = androidNdkVersion
 }
+
+// stop Gradle running by androiddeployqt
+gradle.taskGraph.whenReady {
+    if (providers.environmentVariable("ANDROIDDEPLOYQT_RUN").isPresent
+        && !providers.systemProperty("explicitRun").isPresent) {
+        allTasks.forEach { it.enabled = false }
+    }
+}
--- a/client/android/src/org/amnezia/vpn/AmneziaActivity.kt
+++ b/client/android/src/org/amnezia/vpn/AmneziaActivity.kt
@@ -3,13 +3,6 @@ package org.amnezia.vpn
 import android.Manifest
 import android.annotation.SuppressLint
 import android.app.AlertDialog
-import android.app.Dialog
-import android.graphics.Typeface
-import android.graphics.drawable.GradientDrawable
-import android.view.Gravity
-import android.widget.Button
-import android.widget.LinearLayout
-import android.widget.TextView
 import android.app.NotificationManager
 import android.content.ActivityNotFoundException
 import android.content.BroadcastReceiver
@@ -49,7 +42,6 @@ import androidx.core.view.OnApplyWindowInsetsListener
 import androidx.core.view.ViewCompat
 import androidx.core.view.WindowInsetsCompat
 import androidx.core.view.WindowInsetsControllerCompat
-import java.io.File
 import java.io.IOException
 import kotlin.LazyThreadSafetyMode.NONE
 import kotlin.coroutines.CoroutineContext
@@ -107,8 +99,6 @@ class AmneziaActivity : QtActivity() {
    private var pendingOpenFileUri: String? = null
    private var openFileDeliveryScheduled = false

-    private var updateCoverDialog: Dialog? = null
-
    private val vpnServiceEventHandler: Handler by lazy(NONE) {
        object : Handler(Looper.getMainLooper()) {
            override fun handleMessage(msg: Message) {
@@ -224,7 +214,10 @@ class AmneziaActivity : QtActivity() {

    private fun loadLibs() {
        listOf(
-            "rsapss"
+            "rsapss",
+            "crypto_3",
+            "ssl_3",
+            "ssh"
        ).forEach {
            loadSharedLibrary(this.applicationContext, it)
        }
@@ -496,116 +489,6 @@ class AmneziaActivity : QtActivity() {
        super.onDestroy()
    }

-    fun showUpdateCover() {
-        runOnUiThread {
-            if (isFinishing || isDestroyed || updateCoverDialog != null) return@runOnUiThread
-            val dialog = Dialog(this, android.R.style.Theme_Black_NoTitleBar_Fullscreen)
-            dialog.setCancelable(false)
-            val root = LinearLayout(this).apply {
-                orientation = LinearLayout.VERTICAL
-                gravity = Gravity.CENTER
-                setBackgroundColor(0xFF0E0E11.toInt())
-            }
-            dialog.setContentView(root)
-            dialog.show()
-            updateCoverDialog = dialog
-        }
-    }
-
-    fun hideUpdateCover() {
-        runOnUiThread {
-            updateCoverDialog?.dismiss()
-            updateCoverDialog = null
-        }
-    }
-
-    fun showUpdatePrompt(title: String, message: String, updateTitle: String, skipTitle: String, storeUrl: String) {
-        runOnUiThread {
-            if (isFinishing || isDestroyed) return@runOnUiThread
-
-            val dialog = updateCoverDialog ?: Dialog(this, android.R.style.Theme_Black_NoTitleBar_Fullscreen).also {
-                it.setCancelable(false)
-                it.show()
-                updateCoverDialog = it
-            }
-
-            val density = resources.displayMetrics.density
-            fun dp(value: Int) = (value * density).toInt()
-
-            val root = LinearLayout(this).apply {
-                orientation = LinearLayout.VERTICAL
-                gravity = Gravity.CENTER
-                setBackgroundColor(0xFF0E0E11.toInt())
-                setPadding(dp(32), dp(32), dp(32), dp(32))
-            }
-
-            val titleView = TextView(this).apply {
-                text = title
-                textSize = 22f
-                setTextColor(0xFFFFFFFF.toInt())
-                gravity = Gravity.CENTER
-                typeface = Typeface.create(typeface, Typeface.BOLD)
-            }
-
-            val messageView = TextView(this).apply {
-                text = message
-                textSize = 16f
-                setTextColor(0xFFC7C8CB.toInt())
-                gravity = Gravity.CENTER
-                setPadding(0, dp(16), 0, dp(28))
-            }
-
-            val updateButton = Button(this).apply {
-                text = updateTitle
-                isAllCaps = false
-                textSize = 17f
-                setTextColor(0xFF0E0E11.toInt())
-                stateListAnimator = null
-                background = GradientDrawable().apply {
-                    cornerRadius = dp(12).toFloat()
-                    setColor(0xFFFBB26A.toInt())
-                }
-                setOnClickListener {
-                    try {
-                        startActivity(Intent(Intent.ACTION_VIEW, Uri.parse(storeUrl)))
-                    } catch (e: ActivityNotFoundException) {
-                        Log.w(TAG, "open store failed: ${e.message}")
-                    }
-                    hideUpdateCover()
-                }
-            }
-
-            val skipButton = Button(this).apply {
-                text = skipTitle
-                isAllCaps = false
-                textSize = 17f
-                setTextColor(0xFFD7D8DB.toInt())
-                stateListAnimator = null
-                background = GradientDrawable().apply {
-                    cornerRadius = dp(12).toFloat()
-                    setColor(0x00000000)
-                    setStroke(dp(1), 0xFF2C2D30.toInt())
-                }
-                setOnClickListener { hideUpdateCover() }
-            }
-
-            val updateParams = LinearLayout.LayoutParams(
-                ViewGroup.LayoutParams.MATCH_PARENT, dp(52)
-            ).apply { topMargin = dp(8) }
-
-            val skipParams = LinearLayout.LayoutParams(
-                ViewGroup.LayoutParams.MATCH_PARENT, dp(52)
-            ).apply { topMargin = dp(12) }
-
-            root.addView(titleView)
-            root.addView(messageView)
-            root.addView(updateButton, updateParams)
-            root.addView(skipButton, skipParams)
-
-            dialog.setContentView(root)
-        }
-    }
-
    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
        Log.d(TAG, "Process activity result, code: ${actionCodeToString(requestCode)}, " +
                "resultCode: $resultCode, data: $data")
@@ -883,13 +766,7 @@ class AmneziaActivity : QtActivity() {
    fun openFile(filter: String?) {
        Log.v(TAG, "Open file with filter: $filter")
        mainScope.launch {
-            val systemPickerPackage = listOf("com.google.android.documentsui", "com.android.documentsui")
-                .firstOrNull { pkg ->
-                    try { packageManager.getPackageInfo(pkg, 0); true }
-                    catch (_: PackageManager.NameNotFoundException) { false }
-                }
-
-            val intent = if (!isOnTv() && systemPickerPackage != null) {
+            val intent = if (!isOnTv()) {
                val mimeTypes = if (!filter.isNullOrEmpty()) {
                    val extensionRegex = "\\*\\.([a-z0-9]+)".toRegex(IGNORE_CASE)
                    val mime = MimeTypeMap.getSingleton()
@@ -915,7 +792,6 @@ class AmneziaActivity : QtActivity() {
                            else -> type = "*/*"
                        }
                    }
-                    `package` = systemPickerPackage
                }
            } else {
                Intent(this@AmneziaActivity, TvFilePicker::class.java)
@@ -927,11 +803,8 @@ class AmneziaActivity : QtActivity() {
                        if (isOnTv() && it?.hasExtra("activityNotFound") == true) {
                            showNoFileBrowserAlertDialog()
                        }
-                        val uri = it?.data?.let { u ->
-                            if (u.scheme == "content") {
-                                try { grantUriPermission(packageName, u, Intent.FLAG_GRANT_READ_URI_PERMISSION) } catch (_: Exception) {}
-                            }
-                            u
+                        val uri = it?.data?.apply {
+                            grantUriPermission(packageName, this, Intent.FLAG_GRANT_READ_URI_PERMISSION)
                        }?.toString() ?: ""
                        Log.v(TAG, "Open file: $uri")
                        if (uri.isNotEmpty()) {
@@ -971,12 +844,7 @@ class AmneziaActivity : QtActivity() {
        Log.v(TAG, "Get fd for $fileName")
        return blockingCall(Dispatchers.IO) {
            try {
-                val uri = Uri.parse(fileName)
-                pfd = if (uri.scheme == "file") {
-                    ParcelFileDescriptor.open(File(uri.path!!), ParcelFileDescriptor.MODE_READ_ONLY)
-                } else {
-                    contentResolver.openFileDescriptor(uri, "r")
-                }
+                pfd = contentResolver.openFileDescriptor(Uri.parse(fileName), "r")
                pfd?.fd ?: -1
            } catch (e: Exception) {
                Log.e(TAG, "Failed to get fd: $e")
@@ -1196,10 +1064,12 @@ class AmneziaActivity : QtActivity() {
    @Suppress("unused")
    fun sendTouch(x: Float, y: Float) {
        Log.v(TAG, "Send touch: $x, $y")
-        findQtWindow(window.decorView)?.let {
-            Log.v(TAG, "Send touch to $it")
-            it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_DOWN))
-            it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_UP))
+        blockingCall {
+            findQtWindow(window.decorView)?.let {
+                Log.v(TAG, "Send touch to $it")
+                it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_DOWN))
+                it.dispatchTouchEvent(createEvent(x, y, SystemClock.uptimeMillis(), MotionEvent.ACTION_UP))
+            }
        }
    }

--- a/client/android/src/org/amnezia/vpn/TvFilePicker.kt
+++ b/client/android/src/org/amnezia/vpn/TvFilePicker.kt
@@ -1,36 +1,30 @@
 package org.amnezia.vpn

-import android.Manifest
-import android.app.AlertDialog
 import android.content.ActivityNotFoundException
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
-import android.net.Uri
 import android.os.Build
 import android.os.Bundle
-import android.os.Environment
 import androidx.activity.ComponentActivity
 import androidx.activity.result.contract.ActivityResultContracts
 import org.amnezia.vpn.util.Log
-import java.io.File

 private const val TAG = "TvFilePicker"
-private const val READ_STORAGE_REQUEST_CODE = 1001

 class TvFilePicker : ComponentActivity() {

-    // SAF launcher for Android 10+ where File API is blocked by scoped storage
-    private val safLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
+    private val fileChooseResultLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
        override fun createIntent(context: Context, input: Array<String>): Intent {
            val intent = super.createIntent(context, input)
-            val activities = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+
+            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
            } else {
                @Suppress("DEPRECATION")
                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
            }
-            if (activities.all {
+            if (activitiesToResolveIntent.all {
                    val name = it.activityInfo.packageName
                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
                }) {
@@ -38,140 +32,38 @@ class TvFilePicker : ComponentActivity() {
            }
            return intent
        }
-    }) { uri ->
+    }) {
        setResult(RESULT_OK, Intent().apply {
-            data = uri
+            data = it
            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
        })
        finish()
    }

-    private val directoryStack = ArrayDeque<File>()
-
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        Log.v(TAG, "onCreate")
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-            launchSaf()
-        } else {
-            checkPermissionAndBrowse()
-        }
+        getFile()
    }

-    @Deprecated("Deprecated in Java")
-    override fun onBackPressed() {
-        navigateBack()
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        Log.v(TAG, "onNewIntent")
+        getFile()
    }

-    private fun launchSaf() {
+    private fun getFile() {
        try {
-            safLauncher.launch(arrayOf("*/*"))
+            Log.v(TAG, "getFile")
+            fileChooseResultLauncher.launch(arrayOf("*/*"))
        } catch (_: ActivityNotFoundException) {
-            Log.w(TAG, "No SAF activity found")
+            Log.w(TAG, "Activity not found")
            setResult(RESULT_CANCELED, Intent().apply { putExtra("activityNotFound", true) })
            finish()
        } catch (e: Exception) {
-            Log.e(TAG, "SAF launch failed: $e")
+            Log.e(TAG, "Failed to get file: $e")
            setResult(RESULT_CANCELED)
            finish()
        }
    }
-
-    private fun checkPermissionAndBrowse() {
-        if (checkSelfPermission(Manifest.permission.READ_EXTERNAL_STORAGE) != PackageManager.PERMISSION_GRANTED) {
-            requestPermissions(arrayOf(Manifest.permission.READ_EXTERNAL_STORAGE), READ_STORAGE_REQUEST_CODE)
-        } else {
-            showRootDirectory()
-        }
-    }
-
-    override fun onRequestPermissionsResult(requestCode: Int, permissions: Array<String>, grantResults: IntArray) {
-        super.onRequestPermissionsResult(requestCode, permissions, grantResults)
-        if (requestCode == READ_STORAGE_REQUEST_CODE &&
-            grantResults.firstOrNull() == PackageManager.PERMISSION_GRANTED) {
-            showRootDirectory()
-        } else {
-            setResult(RESULT_CANCELED)
-            finish()
-        }
-    }
-
-    private fun showRootDirectory() {
-        @Suppress("DEPRECATION")
-        val primaryExternal = Environment.getExternalStorageDirectory()
-        val storageDir = File("/storage")
-        // Pre-seed stack with /storage so Back from primary storage goes there (USB drives etc.)
-        if (storageDir.exists() && storageDir.canonicalPath != primaryExternal.canonicalPath) {
-            directoryStack.addLast(storageDir)
-        }
-        showDirectory(primaryExternal)
-    }
-
-    private fun navigateBack() {
-        if (directoryStack.size > 1) {
-            directoryStack.removeLast()
-            val parent = directoryStack.removeLast()
-            showDirectory(parent)
-        } else {
-            setResult(RESULT_CANCELED)
-            finish()
-        }
-    }
-
-    private fun showDirectory(dir: File) {
-        directoryStack.addLast(dir)
-        Log.v(TAG, "Showing directory: ${dir.absolutePath}")
-
-        val entries = try {
-            dir.listFiles()
-                ?.sortedWith(compareBy({ !it.isDirectory }, { it.name.lowercase() }))
-                ?: emptyList()
-        } catch (e: Exception) {
-            Log.e(TAG, "Failed to list directory: $e")
-            emptyList()
-        }
-
-        val names = entries.map { if (it.isDirectory) "[${it.name}]" else it.name }.toTypedArray()
-
-        val builder = AlertDialog.Builder(this)
-            .setTitle(dir.absolutePath)
-
-        if (entries.isEmpty()) {
-            builder.setMessage("No files available")
-        } else {
-            builder.setItems(names) { dialog, which ->
-                dialog.dismiss()
-                val selected = entries[which]
-                if (selected.isDirectory) {
-                    showDirectory(selected)
-                } else {
-                    Log.v(TAG, "Selected file: ${selected.absolutePath}")
-                    setResult(RESULT_OK, Intent().apply {
-                        data = Uri.fromFile(selected)
-                        addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-                    })
-                    finish()
-                }
-            }
-        }
-
-        if (directoryStack.size > 1) {
-            builder.setNegativeButton("↑ Back") { dialog, _ ->
-                dialog.dismiss()
-                navigateBack()
-            }
-        } else {
-            builder.setNegativeButton(android.R.string.cancel) { _, _ ->
-                setResult(RESULT_CANCELED)
-                finish()
-            }
-        }
-
-        builder.setOnCancelListener {
-            setResult(RESULT_CANCELED)
-            finish()
-        }
-
-        builder.show()
-    }
 }
--- a/client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/Wireguard.kt
+++ b/client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/Wireguard.kt
@@ -111,7 +111,7 @@ open class Wireguard : Protocol() {
            configExtensionParameters(configData)
        }

-        configData.optStringOrNull("persistent_keep_alive")?.let { setPersistentKeepalive(it) }
+        configData.optStringOrNull("persistent_keep_alive")?.let { setPersistentKeepalive(it.toInt()) }
        configData.getString("client_priv_key").let { setPrivateKeyHex(it.base64ToHex()) }
        configData.getString("server_pub_key").let { setPublicKeyHex(it.base64ToHex()) }
        configData.optStringOrNull("psk_key")?.let { setPreSharedKeyHex(it.base64ToHex()) }
@@ -134,20 +134,6 @@ open class Wireguard : Protocol() {
        configData.optStringOrNull("I3")?.let { setI3(it) }
        configData.optStringOrNull("I4")?.let { setI4(it) }
        configData.optStringOrNull("I5")?.let { setI5(it) }
-        configData.optStringOrNull("HeaderProtectionKey")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setHeaderProtectionKey(it.base64ToHex()) }
-        configData.optStringOrNull("ContentPaddingAddition")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setContentPaddingAddition(it) }
-        configData.optStringOrNull("RekeyAfterTime")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setRekeyAfterTime(it) }
-        configData.optStringOrNull("RekeyTimeout")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setRekeyTimeout(it) }
-        configData.optStringOrNull("RejectAfterTime")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setRejectAfterTime(it) }
-        configData.optStringOrNull("KeepaliveTimeout")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setKeepaliveTimeout(it) }
-        configData.optStringOrNull("MaxHandshakeAttempts")?.trim()?.takeIf { it.isNotEmpty() }
-            ?.let { setMaxHandshakeAttempts(it) }
    }

    private fun start(
--- a/client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/WireguardConfig.kt
+++ b/client/android/wireguard/src/main/kotlin/org/amnezia/vpn/protocol/wireguard/WireguardConfig.kt
@@ -10,7 +10,7 @@ private const val WIREGUARD_DEFAULT_MTU = 1280
 open class WireguardConfig protected constructor(
    protocolConfigBuilder: ProtocolConfig.Builder,
    val endpoint: InetEndpoint,
-    val persistentKeepalive: String?,
+    val persistentKeepalive: Int,
    val publicKeyHex: String,
    val preSharedKeyHex: String?,
    val privateKeyHex: String,
@@ -31,13 +31,6 @@ open class WireguardConfig protected constructor(
    var i3: String?,
    var i4: String?,
    var i5: String?,
-    val headerProtectionKeyHex: String?,
-    val contentPaddingAddition: String?,
-    val rekeyAfterTime: String?,
-    val rekeyTimeout: String?,
-    val rejectAfterTime: String?,
-    val keepaliveTimeout: String?,
-    val maxHandshakeAttempts: String?,
 ) : ProtocolConfig(protocolConfigBuilder) {

    protected constructor(builder: Builder) : this(
@@ -64,13 +57,6 @@ open class WireguardConfig protected constructor(
        builder.i3,
        builder.i4,
        builder.i5,
-        builder.headerProtectionKeyHex,
-        builder.contentPaddingAddition,
-        builder.rekeyAfterTime,
-        builder.rekeyTimeout,
-        builder.rejectAfterTime,
-        builder.keepaliveTimeout,
-        builder.maxHandshakeAttempts,
    )

    fun toWgUserspaceString(): String = with(StringBuilder()) {
@@ -101,13 +87,6 @@ open class WireguardConfig protected constructor(
            i4?.let { appendLine("i4=$it") }
            i5?.let { appendLine("i5=$it") }
        }
-        headerProtectionKeyHex?.takeIf { it.isNotEmpty() }?.let { appendLine("header_protection_key=$it") }
-        contentPaddingAddition?.takeIf { it.isNotEmpty() }?.let { appendLine("content_padding_addition=$it") }
-        rekeyAfterTime?.takeIf { it.isNotEmpty() }?.let { appendLine("rekey_after_time=$it") }
-        rekeyTimeout?.takeIf { it.isNotEmpty() }?.let { appendLine("rekey_timeout=$it") }
-        rejectAfterTime?.takeIf { it.isNotEmpty() }?.let { appendLine("reject_after_time=$it") }
-        keepaliveTimeout?.takeIf { it.isNotEmpty() }?.let { appendLine("keepalive_timeout=$it") }
-        maxHandshakeAttempts?.takeIf { it.isNotEmpty() }?.let { appendLine("max_handshake_attempts=$it") }
    }

    private fun validateProtocolExtensionParameters() {
@@ -128,7 +107,7 @@ open class WireguardConfig protected constructor(
            appendLine("allowed_ip=${route.inetNetwork}")
        }
        appendLine("endpoint=$endpoint")
-        if (!persistentKeepalive.isNullOrEmpty() && persistentKeepalive != "0")
+        if (persistentKeepalive != 0)
            appendLine("persistent_keepalive_interval=$persistentKeepalive")
        if (preSharedKeyHex != null)
            appendLine("preshared_key=$preSharedKeyHex")
@@ -138,7 +117,7 @@ open class WireguardConfig protected constructor(
        internal lateinit var endpoint: InetEndpoint
            private set

-        internal var persistentKeepalive: String? = null
+        internal var persistentKeepalive: Int = 0
            private set

        internal lateinit var publicKeyHex: String
@@ -170,17 +149,10 @@ open class WireguardConfig protected constructor(
        internal var i3: String? = null
        internal var i4: String? = null
        internal var i5: String? = null
-        internal var headerProtectionKeyHex: String? = null
-        internal var contentPaddingAddition: String? = null
-        internal var rekeyAfterTime: String? = null
-        internal var rekeyTimeout: String? = null
-        internal var rejectAfterTime: String? = null
-        internal var keepaliveTimeout: String? = null
-        internal var maxHandshakeAttempts: String? = null

        fun setEndpoint(endpoint: InetEndpoint) = apply { this.endpoint = endpoint }

-        fun setPersistentKeepalive(persistentKeepalive: String) = apply { this.persistentKeepalive = persistentKeepalive }
+        fun setPersistentKeepalive(persistentKeepalive: Int) = apply { this.persistentKeepalive = persistentKeepalive }

        fun setPublicKeyHex(publicKeyHex: String) = apply { this.publicKeyHex = publicKeyHex }

@@ -206,13 +178,6 @@ open class WireguardConfig protected constructor(
        fun setI3(i3: String) = apply { this.i3 = i3 }
        fun setI4(i4: String) = apply { this.i4 = i4 }
        fun setI5(i5: String) = apply { this.i5 = i5 }
-        fun setHeaderProtectionKey(headerProtectionKeyHex: String) = apply { this.headerProtectionKeyHex = headerProtectionKeyHex }
-        fun setContentPaddingAddition(contentPaddingAddition: String) = apply { this.contentPaddingAddition = contentPaddingAddition }
-        fun setRekeyAfterTime(rekeyAfterTime: String) = apply { this.rekeyAfterTime = rekeyAfterTime }
-        fun setRekeyTimeout(rekeyTimeout: String) = apply { this.rekeyTimeout = rekeyTimeout }
-        fun setRejectAfterTime(rejectAfterTime: String) = apply { this.rejectAfterTime = rejectAfterTime }
-        fun setKeepaliveTimeout(keepaliveTimeout: String) = apply { this.keepaliveTimeout = keepaliveTimeout }
-        fun setMaxHandshakeAttempts(maxHandshakeAttempts: String) = apply { this.maxHandshakeAttempts = maxHandshakeAttempts }

        override fun build(): WireguardConfig = configBuild().run { WireguardConfig(this@Builder) }
    }
--- a/client/client_scripts/clientScripts.qrc
+++ b/client/client_scripts/clientScripts.qrc
@@ -1,5 +0,0 @@
-<RCC>
-    <qresource prefix="/client_scripts">
-        <file>mac_installer.sh</file>
-    </qresource>
-</RCC>
--- a/client/client_scripts/mac_installer.sh
+++ b/client/client_scripts/mac_installer.sh
@@ -1,42 +0,0 @@
-#!/bin/bash
-
-EXTRACT_DIR="$1"
-INSTALLER_PATH="$2"
-
-set -e
-
-echo "[AmneziaVPN] Installer package: $INSTALLER_PATH"
-
-if [ ! -f "$INSTALLER_PATH" ]; then
-    echo "[AmneziaVPN] ERROR: Installer package not found: $INSTALLER_PATH"
-    exit 1
-fi
-
-PKG_PATH="$INSTALLER_PATH"
-echo "[AmneziaVPN] Using PKG: $PKG_PATH"
-
-# Optional: basic signature/gatekeeper checks (non-fatal)
-if command -v pkgutil >/dev/null 2>&1; then
-    pkgutil --check-signature "$PKG_PATH" || true
-fi
-if command -v spctl >/dev/null 2>&1; then
-    spctl -a -vvv -t install "$PKG_PATH" || true
-fi
-
-# Run installer with admin privileges via AppleScript (prompts for password)
-echo "[AmneziaVPN] Running installer..."
-OSA_CMD='do shell script "/usr/sbin/installer -pkg '"$PKG_PATH"' -target /" with administrator privileges'
-osascript -e "$OSA_CMD"
-
-STATUS=$?
-if [ $STATUS -ne 0 ]; then
-    echo "[AmneziaVPN] ERROR: installer exited with status $STATUS"
-    exit $STATUS
-fi
-
-echo "[AmneziaVPN] Cleaning up..."
-rm -f "$INSTALLER_PATH" || true
-rm -rf "$EXTRACT_DIR" 2>/dev/null || true
-
-echo "[AmneziaVPN] Installation completed successfully"
-exit 0
--- a/client/cmake/3rdparty.cmake
+++ b/client/cmake/3rdparty.cmake
@@ -2,33 +2,100 @@ set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)

 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/Modules;${CMAKE_MODULE_PATH}")

-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/SortFilterProxyModel ${CMAKE_BINARY_DIR}/3rd/SortFilterProxyModel)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/SortFilterProxyModel)
 set(LIBS ${LIBS} SortFilterProxyModel)
+include(${CLIENT_ROOT_DIR}/cmake/QSimpleCrypto.cmake)

 include(${CLIENT_ROOT_DIR}/3rd/qrcodegen/qrcodegen.cmake)

+set(LIBSSH_ROOT_DIR "${CLIENT_ROOT_DIR}/3rd-prebuilt/3rd-prebuilt/libssh/")
+set(OPENSSL_ROOT_DIR "${CLIENT_ROOT_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/")
+
+set(OPENSSL_LIBRARIES_DIR "${OPENSSL_ROOT_DIR}/lib")
+
+if(WIN32)
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/windows/include")
+    if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "8")
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/windows/x86_64/ssh.lib")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/windows/x86_64")
+        set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/windows/win64/libssl.lib")
+        set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/windows/win64/libcrypto.lib")
+    else()
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/windows/x86/ssh.lib")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/windows/x86")
+        set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/windows/win32/libssl.lib")
+        set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/windows/win32/libcrypto.lib")
+    endif()
+elseif(APPLE AND NOT IOS)
+    if(MACOS_NE)
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/universal2/libssh.a")
+        set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/universal2/libz.a")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/universal2")
+    else()
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libssh.a")
+        set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libz.a")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/x86_64")
+    endif()
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/macos/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libcrypto.a")    
+elseif(IOS)
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/ios/arm64")
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/ios/arm64/libssh.a")
+    set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/ios/arm64/libz.a")
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/ios/iphone/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/ios/iphone/lib/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/ios/iphone/lib/libcrypto.a")
+elseif(ANDROID)
+    set(abi ${CMAKE_ANDROID_ARCH_ABI})
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/android/${abi}")
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/android/${abi}/libssh.so")
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/android/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/android/${abi}/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/android/${abi}/libcrypto.a")
+    set(OPENSSL_LIBRARIES_DIR "${OPENSSL_ROOT_DIR}/android/${abi}")
+elseif(LINUX)
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/linux/x86_64")
+    set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/linux/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")
+endif()
+
+file(COPY ${OPENSSL_LIB_SSL_PATH} ${OPENSSL_LIB_CRYPTO_PATH}
+        DESTINATION ${OPENSSL_LIBRARIES_DIR})
+
+set(OPENSSL_USE_STATIC_LIBS TRUE)
+  
+set(LIBS ${LIBS} 
+    ${LIBSSH_LIB_PATH} 
+    ${ZLIB_LIB_PATH}
+)
+  
+set(LIBS ${LIBS}
+    ${OPENSSL_LIB_SSL_PATH}
+    ${OPENSSL_LIB_CRYPTO_PATH}
+)
+
 add_compile_definitions(_WINSOCKAPI_)

 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain ${CMAKE_BINARY_DIR}/3rd/qtkeychain EXCLUDE_FROM_ALL)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain)

 if(ANDROID)
    # Use qtgamepad from amnezia-vpn/qtgamepad repository
    # Only if Qt6CorePrivate is available (required by qtgamepad)
    find_package(Qt6CorePrivate CONFIG QUIET)
    if(Qt6CorePrivate_FOUND)
-        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad ${CMAKE_BINARY_DIR}/3rd/qtgamepad)
+        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad)
        # Link both the C++ module and QML plugin
-        if(TARGET ${PROJECT})
+        if(TARGET GamepadLegacy)
            target_link_libraries(${PROJECT} PRIVATE GamepadLegacy)
-        else()
-            list(APPEND LIBS GamepadLegacy)
        endif()
-        if(TARGET ${PROJECT})
+        if(TARGET GamepadLegacyQuickPrivate)
            target_link_libraries(${PROJECT} PRIVATE GamepadLegacyQuickPrivate)
-        else()
-            list(APPEND LIBS GamepadLegacyQuickPrivate)
        endif()
        message(STATUS "Gamepad support enabled for Android")
    else()
@@ -39,12 +106,12 @@ endif()
 set(LIBS ${LIBS} qt6keychain)

 include_directories(
+    ${OPENSSL_INCLUDE_DIR}
+    ${LIBSSH_INCLUDE_DIR}/include
+    ${LIBSSH_ROOT_DIR}/include
+    ${CLIENT_ROOT_DIR}/3rd/libssh/include
+    ${CLIENT_ROOT_DIR}/3rd/QSimpleCrypto/src/include
    ${CLIENT_ROOT_DIR}/3rd/qtkeychain/qtkeychain
    ${CMAKE_CURRENT_BINARY_DIR}/3rd/qtkeychain
+    ${CMAKE_CURRENT_BINARY_DIR}/3rd/libssh/include
 )
-
-find_package(OpenSSL REQUIRED)
-list(APPEND LIBS OpenSSL::SSL OpenSSL::Crypto)
-
-find_package(libssh REQUIRED)
-list(APPEND LIBS ssh::ssh)
--- a/client/cmake/QSimpleCrypto.cmake
+++ b/client/cmake/QSimpleCrypto.cmake
@@ -0,0 +1,21 @@
+set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
+set(QSIMPLECRYPTO_DIR ${CLIENT_ROOT_DIR}/3rd/QSimpleCrypto/src)
+
+include_directories(${QSIMPLECRYPTO_DIR})
+
+set(HEADERS ${HEADERS}
+    ${QSIMPLECRYPTO_DIR}/include/QAead.h
+    ${QSIMPLECRYPTO_DIR}/include/QBlockCipher.h
+    ${QSIMPLECRYPTO_DIR}/include/QRsa.h
+    ${QSIMPLECRYPTO_DIR}/include/QSimpleCrypto_global.h
+    ${QSIMPLECRYPTO_DIR}/include/QX509.h
+    ${QSIMPLECRYPTO_DIR}/include/QX509Store.h
+)
+
+set(SOURCES ${SOURCES}
+    ${QSIMPLECRYPTO_DIR}/sources/QAead.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QBlockCipher.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QRsa.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509.cpp
+    ${QSIMPLECRYPTO_DIR}/sources/QX509Store.cpp
+)
--- a/client/cmake/android.cmake
+++ b/client/cmake/android.cmake
@@ -42,14 +42,18 @@ set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.cpp
 )

+foreach(abi IN ITEMS ${QT_ANDROID_ABIS})
+    set_property(TARGET ${PROJECT} PROPERTY QT_ANDROID_EXTRA_LIBS
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/amneziawg/android/${abi}/libwg-go.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/libck-ovpn-plugin.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/libovpn3.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/libovpnutil.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/librsapss.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/android/${abi}/libcrypto_3.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/android/${abi}/libssl_3.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/libssh/android/${abi}/libssh.so
+    )
+endforeach()

-find_package(awg-android REQUIRED)
-set(LIBS ${LIBS} amnezia::awg-android)
-set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS ${AMNEZIA_ANDROID_LIBWG_PATH} ${AMNEZIA_ANDROID_LIBWG_QUICK_PATH})
-
-find_package(amnezia-libxray REQUIRED)
-file(COPY ${AMNEZIA_LIBXRAY_PATH} DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/android/xray/libXray)
-
-find_package(openvpn-pt-android REQUIRED)
-set(LIBS ${LIBS} amnezia::openvpn-pt-android)
-set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS ${OPENVPN_PT_ANDROID_LIBCK_OVPN_PLUGIN_PATH})
+file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/xray/android/libxray.aar
+        DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/android/xray/libXray)
--- a/client/cmake/ios.cmake
+++ b/client/cmake/ios.cmake
@@ -1,6 +1,8 @@
 message("Client iOS build")
+set(CMAKE_OSX_DEPLOYMENT_TARGET 13.0)
 set(APPLE_PROJECT_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})

+
 enable_language(OBJC)
 enable_language(OBJCXX)
 enable_language(Swift)
@@ -31,7 +33,6 @@ set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ioscontextmenu.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate-C-Interface.h
@@ -43,7 +44,6 @@ set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ioscontextmenu.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
@@ -51,17 +51,12 @@ set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/AmneziaSceneDelegateHooks.mm
 )

-# The context menu helper uses ARC-only constructs (weak references); the
-# rest of the Objective-C++ sources build with manual reference counting.
-set_source_files_properties(${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ioscontextmenu.mm
-    PROPERTIES COMPILE_OPTIONS "-fobjc-arc"
-)
-

 target_include_directories(${PROJECT} PRIVATE ${Qt6Gui_PRIVATE_INCLUDE_DIRS})


 set_target_properties(${PROJECT} PROPERTIES
+    XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
    MACOSX_BUNDLE_INFO_PLIST ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Info.plist.in
    MACOSX_BUNDLE_ICON_FILE "AppIcon"
    MACOSX_BUNDLE_INFO_STRING "AmneziaVPN"
@@ -77,6 +72,7 @@ set_target_properties(${PROJECT} PROPERTIES
    XCODE_ATTRIBUTE_PRODUCT_NAME "AmneziaVPN"
    XCODE_ATTRIBUTE_BUNDLE_INFO_STRING "AmneziaVPN"
    XCODE_GENERATE_SCHEME TRUE
+    XCODE_ATTRIBUTE_ENABLE_BITCODE "NO"
    XCODE_ATTRIBUTE_ASSETCATALOG_COMPILER_APPICON_NAME "AppIcon"
    XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1,2"
    XCODE_EMBED_FRAMEWORKS_CODE_SIGN_ON_COPY ON
@@ -85,7 +81,7 @@ set_target_properties(${PROJECT} PROPERTIES
    XCODE_EMBED_APP_EXTENSIONS networkextension
 )

-if(DEPLOY)
+if(DEFINED DEPLOY)
    set_target_properties(${PROJECT} PROPERTIES
        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Apple Distribution"
        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY[variant=Debug] "Apple Development"
@@ -128,11 +124,6 @@ target_sources(${PROJECT} PRIVATE
    ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
 )

-set_source_files_properties(
-    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Media.xcassets
-    PROPERTIES MACOSX_PACKAGE_LOCATION Resources
-)
-
 target_sources(${PROJECT} PRIVATE
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/AmneziaVPNLaunchScreen.storyboard
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Media.xcassets
@@ -141,8 +132,17 @@ target_sources(${PROJECT} PRIVATE

 set_property(TARGET ${PROJECT} APPEND PROPERTY RESOURCE
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/AmneziaVPNLaunchScreen.storyboard
+    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Media.xcassets
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
 )

 add_subdirectory(ios/networkextension)
 add_dependencies(${PROJECT} networkextension)
+
+set_property(TARGET ${PROJECT} PROPERTY XCODE_EMBED_FRAMEWORKS
+    "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-ios/OpenVPNAdapter.framework"
+)
+
+set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-ios/)
+target_link_libraries("networkextension" PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-ios/OpenVPNAdapter.framework")
+
--- a/client/cmake/macos.cmake
+++ b/client/cmake/macos.cmake
@@ -23,6 +23,9 @@ set_target_properties(${PROJECT} PROPERTIES
    MACOSX_BUNDLE_SHORT_VERSION_STRING "${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH}"
    MACOSX_BUNDLE_BUNDLE_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
 )
+set(CMAKE_OSX_ARCHITECTURES "x86_64" CACHE INTERNAL "" FORCE)
+set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)
+

 set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_SOURCE_DIR}/ui/utils/macosUtil.h
--- a/client/cmake/macos_ne.cmake
+++ b/client/cmake/macos_ne.cmake
@@ -1,11 +1,11 @@
 message("Client ==> MacOS NE build")

 set_target_properties(${PROJECT} PROPERTIES MACOSX_BUNDLE TRUE)
+set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)

 set(APPLE_PROJECT_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})

 enable_language(OBJC)
-enable_language(OBJCXX)
 enable_language(Swift)

 find_package(Qt6 REQUIRED COMPONENTS ShaderTools Widgets)
@@ -34,6 +34,7 @@ set(LIBS ${LIBS}
 set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate-C-Interface.h
@@ -44,12 +45,19 @@ set_source_files_properties(${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_contro
 set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.mm
+    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
 )

+set(ICON_FILE ${CMAKE_CURRENT_SOURCE_DIR}/images/app.icns)
+set(MACOSX_BUNDLE_ICON_FILE app.icns)
+set_source_files_properties(${ICON_FILE} PROPERTIES MACOSX_PACKAGE_LOCATION Resources)
+set(SOURCES ${SOURCES} ${ICON_FILE})
+
+
 target_include_directories(${PROJECT} PRIVATE
    ${Qt6Gui_PRIVATE_INCLUDE_DIRS}
    ${Qt6Widgets_PRIVATE_INCLUDE_DIRS}
@@ -62,7 +70,6 @@ set_target_properties(${PROJECT} PROPERTIES
    MACOSX_BUNDLE_ICON_FILE "AppIcon"
    MACOSX_BUNDLE_INFO_STRING "AmneziaVPN"
    MACOSX_BUNDLE_BUNDLE_NAME "AmneziaVPN"
-    MACOSX_BUNDLE_GUI_IDENTIFIER "${BUILD_IOS_APP_IDENTIFIER}"
    MACOSX_BUNDLE_BUNDLE_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
    MACOSX_BUNDLE_LONG_VERSION_STRING "${APPLE_PROJECT_VERSION}-${CMAKE_PROJECT_VERSION_TWEAK}"
    MACOSX_BUNDLE_SHORT_VERSION_STRING "${APPLE_PROJECT_VERSION}"
@@ -73,10 +80,14 @@ set_target_properties(${PROJECT} PROPERTIES
    XCODE_ATTRIBUTE_PRODUCT_NAME "AmneziaVPN"
    XCODE_ATTRIBUTE_BUNDLE_INFO_STRING "AmneziaVPN"
    XCODE_GENERATE_SCHEME TRUE
+    XCODE_ATTRIBUTE_ENABLE_BITCODE "NO"
    XCODE_ATTRIBUTE_ASSETCATALOG_COMPILER_APPICON_NAME "AppIcon"
+    XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1,2"
    XCODE_EMBED_FRAMEWORKS_CODE_SIGN_ON_COPY "NO"
    XCODE_EMBED_FRAMEWORKS_REMOVE_HEADERS_ON_COPY "YES"
+    XCODE_ATTRIBUTE_MACOSX_DEPLOYMENT_TARGET "11.0"

+    XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
    XCODE_ATTRIBUTE_LD_RUNPATH_SEARCH_PATHS "@executable_path/../Frameworks"
    XCODE_EMBED_APP_EXTENSIONS AmneziaVPNNetworkExtension
 )
@@ -123,17 +134,13 @@ target_sources(${PROJECT} PRIVATE
    ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
 )

-set_source_files_properties(
-    ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Images.xcassets
-    PROPERTIES MACOSX_PACKAGE_LOCATION Resources
-)
-
 target_sources(${PROJECT} PRIVATE
    ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Images.xcassets
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
 )

 set_property(TARGET ${PROJECT} APPEND PROPERTY RESOURCE
+    ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Images.xcassets
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
 )

@@ -146,6 +153,19 @@ message(${QtCore_location})

 get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)

-add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR} -no-codesign
+set_property(TARGET ${PROJECT} PROPERTY XCODE_EMBED_FRAMEWORKS
+    "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos/OpenVPNAdapter.framework"
+)
+
+set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos)
+target_link_libraries("AmneziaVPNNetworkExtension" PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos/OpenVPNAdapter.framework")
+
+add_custom_command(TARGET ${PROJECT} POST_BUILD
+    COMMAND ${CMAKE_COMMAND} -E make_directory
+            $<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks
+    COMMAND /usr/bin/find "$<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks/OpenVPNAdapter.framework" -name "*.sha256" -delete
+    COMMAND /usr/bin/codesign --force --sign "Apple Distribution: Privacy Technologies OU"
+            "$<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks/OpenVPNAdapter.framework/Versions/Current/OpenVPNAdapter"
+    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Signing OpenVPNAdapter framework"
 )
--- a/client/cmake/sources.cmake
+++ b/client/cmake/sources.cmake
@@ -15,6 +15,7 @@ set(HEADERS ${HEADERS}
    ${CLIENT_ROOT_DIR}/core/utils/constants/protocolConstants.h
    ${CLIENT_ROOT_DIR}/core/utils/constants/apiKeys.h
    ${CLIENT_ROOT_DIR}/core/utils/constants/apiConstants.h
+    ${CLIENT_ROOT_DIR}/core/utils/api/apiEnums.h
    ${CLIENT_ROOT_DIR}/core/utils/errorStrings.h
    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/scriptsRegistry.h
    ${CLIENT_ROOT_DIR}/core/utils/qrCodeUtils.h
@@ -35,8 +36,6 @@ set(HEADERS ${HEADERS}
    ${CLIENT_ROOT_DIR}/core/installers/torInstaller.h
    ${CLIENT_ROOT_DIR}/core/installers/sftpInstaller.h
    ${CLIENT_ROOT_DIR}/core/installers/socks5Installer.h
-    ${CLIENT_ROOT_DIR}/core/installers/mtProxyInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/telemtInstaller.h
    ${CLIENT_ROOT_DIR}/core/controllers/appSplitTunnelingController.h
    ${CLIENT_ROOT_DIR}/core/controllers/ipSplitTunnelingController.h
    ${CLIENT_ROOT_DIR}/core/controllers/allowedDnsController.h
@@ -46,22 +45,18 @@ set(HEADERS ${HEADERS}
    ${CLIENT_ROOT_DIR}/core/controllers/api/servicesCatalogController.h
    ${CLIENT_ROOT_DIR}/core/controllers/api/subscriptionController.h
    ${CLIENT_ROOT_DIR}/core/controllers/api/newsController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/updateController.h
    ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.h
    ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.h
    ${CLIENT_ROOT_DIR}/core/protocols/qmlRegisterProtocols.h
    ${CLIENT_ROOT_DIR}/ui/utils/pages.h
    ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.h
-    ${CLIENT_ROOT_DIR}/ui/utils/mtProxyPublicHostInput.h
    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.h
    ${CMAKE_CURRENT_BINARY_DIR}/version.h
    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.h
    ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/payloadSender.h
    ${CLIENT_ROOT_DIR}/core/utils/serialization/serialization.h
    ${CLIENT_ROOT_DIR}/core/utils/serialization/transfer.h
    ${CLIENT_ROOT_DIR}/../common/logger/logger.h
-    ${CLIENT_ROOT_DIR}/../common/crypto/cryptoUtils.h
    ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.h
    ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.h
    ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.h
@@ -115,8 +110,6 @@ set(SOURCES ${SOURCES}
    ${CLIENT_ROOT_DIR}/core/installers/torInstaller.cpp
    ${CLIENT_ROOT_DIR}/core/installers/sftpInstaller.cpp
    ${CLIENT_ROOT_DIR}/core/installers/socks5Installer.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/mtProxyInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/telemtInstaller.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/appSplitTunnelingController.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/ipSplitTunnelingController.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/allowedDnsController.cpp
@@ -126,15 +119,12 @@ set(SOURCES ${SOURCES}
    ${CLIENT_ROOT_DIR}/core/controllers/api/servicesCatalogController.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/api/subscriptionController.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/api/newsController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/updateController.cpp
    ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.cpp
    ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.cpp
    ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.cpp
-    ${CLIENT_ROOT_DIR}/ui/utils/mtProxyPublicHostInput.cpp
    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.cpp
    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.cpp
    ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/payloadSender.cpp
    ${CLIENT_ROOT_DIR}/core/utils/serialization/outbound.cpp
    ${CLIENT_ROOT_DIR}/core/utils/serialization/inbound.cpp
    ${CLIENT_ROOT_DIR}/core/utils/serialization/ss.cpp
@@ -144,10 +134,8 @@ set(SOURCES ${SOURCES}
    ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess.cpp
    ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess_new.cpp
    ${CLIENT_ROOT_DIR}/../common/logger/logger.cpp
-    ${CLIENT_ROOT_DIR}/../common/crypto/cryptoUtils.cpp
    ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.cpp
    ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serverConfigUtils.cpp
    ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.cpp
    ${CLIENT_ROOT_DIR}/core/utils/utilities.cpp
    ${CLIENT_ROOT_DIR}/core/utils/managementServer.cpp
@@ -211,14 +199,12 @@ file(GLOB UI_MODELS_H CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/models/*.h
    ${CLIENT_ROOT_DIR}/ui/models/protocols/*.h
    ${CLIENT_ROOT_DIR}/ui/models/services/*.h
-    ${CLIENT_ROOT_DIR}/ui/models/utils/*.h
    ${CLIENT_ROOT_DIR}/ui/models/api/*.h
 )
 file(GLOB UI_MODELS_CPP CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/models/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/protocols/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/services/*.cpp
-    ${CLIENT_ROOT_DIR}/ui/models/utils/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/api/*.cpp
 )

--- a/client/core/configurators/awgConfigurator.cpp
+++ b/client/core/configurators/awgConfigurator.cpp
@@ -96,17 +96,13 @@ ProtocolConfig AwgConfigurator::createConfig(const ServerCredentials &credential
    newClientConfig.specialJunk4 = configMap.value(configKey::specialJunk4);
    newClientConfig.specialJunk5 = configMap.value(configKey::specialJunk5);
    
-    newClientConfig.cookieReplyPacketJunkSize = configMap.value(configKey::cookieReplyPacketJunkSize);
-    newClientConfig.transportPacketJunkSize = configMap.value(configKey::transportPacketJunkSize);
-
-    newClientConfig.headerProtectionKey = configMap.value(configKey::headerProtectionKey);
-    newClientConfig.contentPaddingAddition = configMap.value(configKey::contentPaddingAddition);
-    newClientConfig.rekeyAfterTime = configMap.value(configKey::rekeyAfterTime);
-    newClientConfig.rekeyTimeout = configMap.value(configKey::rekeyTimeout);
-    newClientConfig.rejectAfterTime = configMap.value(configKey::rejectAfterTime);
-    newClientConfig.keepaliveTimeout = configMap.value(configKey::keepaliveTimeout);
-    newClientConfig.maxHandshakeAttempts = configMap.value(configKey::maxHandshakeAttempts);
-
+    if (container == DockerContainer::Awg2) {
+        newClientConfig.cookieReplyPacketJunkSize = configMap.value(configKey::cookieReplyPacketJunkSize);
+        newClientConfig.transportPacketJunkSize = configMap.value(configKey::transportPacketJunkSize);
+    }
+    
+    newClientConfig.isObfuscationEnabled = false;
+    
    protocolConfig.setClientConfig(newClientConfig);
    
    return protocolConfig;
--- a/client/core/configurators/openVpnConfigurator.cpp
+++ b/client/core/configurators/openVpnConfigurator.cpp
@@ -241,7 +241,7 @@ OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::createCertRequest()
    connData.clientId = Utils::getRandomString(32);

    int ret = 0;
-    int nVersion = 0;
+    int nVersion = 1;

    QByteArray clientIdUtf8 = connData.clientId.toUtf8();

--- a/client/core/configurators/wireguardConfigurator.cpp
+++ b/client/core/configurators/wireguardConfigurator.cpp
@@ -228,20 +228,11 @@ ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &cred
        }
    }
    
-    const bool isAwg3 = awgServerConfig && awgServerConfig->protocolVersion == protocols::awg::awgV3;
-
    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
    QString scriptData = amnezia::scriptData(m_configTemplate, container);
    QString config = m_sshSession->replaceVars(scriptData, vars);

-    // The template lists every possible key, but each parameter is optional -
-    // drop the lines whose value came out empty
-    static const QRegularExpression emptyValueLine(R"(^\s*\S+\s*=\s*$)");
-    auto configTemplateLines = config.split("\n");
-    configTemplateLines.removeIf([](const QString &line) { return emptyValueLine.match(line).hasMatch(); });
-    config = configTemplateLines.join("\n");
-
    ConnectionData connData = prepareWireguardConfig(credentials, container, wireguardServerConfig, awgServerConfig, dnsSettings, errorCode);
    if (errorCode != ErrorCode::NoError) {
        return WireGuardProtocolConfig{};
@@ -275,8 +266,7 @@ ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &cred
    clientConfig.presharedKey = connData.pskKey;
    clientConfig.clientId = connData.clientPubKey;
    clientConfig.allowedIps = QStringList { "0.0.0.0/0", "::/0" };
-    clientConfig.persistentKeepAlive = isAwg3 ? protocols::awg::defaultPersistentKeepAlive
-                                              : protocols::wireguard::defaultPersistentKeepAlive;
+    clientConfig.persistentKeepAlive = "25";
    clientConfig.mtu = mtu;
    clientConfig.isObfuscationEnabled = false;
    
--- a/client/core/configurators/xrayConfigurator.cpp
+++ b/client/core/configurators/xrayConfigurator.cpp
@@ -4,7 +4,6 @@
 #include <QJsonDocument>
 #include <QJsonObject>
 #include <QJsonArray>
-#include <QThread>
 #include <QUuid>
 #include "logger.h"

@@ -21,797 +20,183 @@
 #include "core/models/protocols/xrayProtocolConfig.h"

 namespace {
-    Logger logger("XrayConfigurator");
-
-    QString normalizeXhttpMode(const QString &m) {
-        const QString t = m.trimmed();
-        if (t.isEmpty() || t.compare(QLatin1String("Auto"), Qt::CaseInsensitive) == 0) {
-            return QStringLiteral("auto");
-        }
-        if (t.compare(QLatin1String("Packet-up"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("packet-up");
-        if (t.compare(QLatin1String("Stream-up"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("stream-up");
-        if (t.compare(QLatin1String("Stream-one"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("stream-one");
-        return t.toLower();
-    }
-
-    // Xray-core: empty → path; "None" in UI → omit (core default path)
-    QString normalizeSessionSeqPlacement(const QString &p)
-    {
-        if (p.isEmpty() || p.compare(QLatin1String("None"), Qt::CaseInsensitive) == 0)
-            return {};
-        return p.toLower();
-    }
-
-    QString normalizeUplinkDataPlacement(const QString &p)
-    {
-        if (p.isEmpty() || p.compare(QLatin1String("Body"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("body");
-        if (p.compare(QLatin1String("Auto"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("auto");
-        if (p.compare(QLatin1String("Query"), Qt::CaseInsensitive) == 0)
-            // "Query" is not valid for uplink payload in splithttp; closest documented mode
-            return QStringLiteral("header");
-        return p.toLower();
-    }
-
-    // splithttp: cookie | header | query | queryInHeader (not "body")
-    QString normalizeXPaddingPlacement(const QString &p)
-    {
-        QString t = p.trimmed();
-        if (t.isEmpty())
-            return QString::fromLatin1(amnezia::protocols::xray::defaultXPaddingPlacement).toLower();
-        if (t.compare(QLatin1String("Body"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("queryInHeader");
-        if (t.contains(QLatin1String("queryInHeader"), Qt::CaseInsensitive)
-            || t.compare(QLatin1String("Query in header"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("queryInHeader");
-        return t.toLower();
-    }
-
-    // splithttp: repeat-x | tokenish
-    QString normalizeXPaddingMethod(const QString &m)
-    {
-        QString t = m.trimmed();
-        if (t.isEmpty() || t.compare(QLatin1String("Repeat-x"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("repeat-x");
-        if (t.compare(QLatin1String("Tokenish"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("tokenish");
-        if (t.compare(QLatin1String("Random"), Qt::CaseInsensitive) == 0
-            || t.compare(QLatin1String("Zero"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("repeat-x");
-        return t.toLower();
-    }
-
-    // xray wants int ranges as "from-to" string, not a {from,to} object.
-    QString makeRangeString(const QString &minV, const QString &maxV)
-    {
-        return minV + QLatin1Char('-') + maxV;
-    }
-
-    void putIntRangeIfAny(QJsonObject &obj, const char *key, QString minV, QString maxV, const char *fallbackMin,
-                          const char *fallbackMax)
-    {
-        if (minV.isEmpty() && maxV.isEmpty())
-            return;
-        if (minV.isEmpty())
-            minV = QString::fromLatin1(fallbackMin);
-        if (maxV.isEmpty())
-            maxV = QString::fromLatin1(fallbackMax);
-        obj[QString::fromUtf8(key)] = makeRangeString(minV, maxV);
-    }
-
-    QString effectiveClientFlow(const amnezia::XrayServerConfig &srv)
-    {
-        const bool rawTransport = srv.transport.isEmpty() || srv.transport == QLatin1String("raw");
-        const bool secureFlow =
-                srv.security == QLatin1String("tls") || srv.security == QLatin1String("reality");
-        return (rawTransport && secureFlow) ? srv.flow : QString();
-    }
-
-    QString effectiveSecurity(const amnezia::XrayServerConfig &srv)
-    {
-        if (srv.transport == QLatin1String("mkcp") && srv.security == QLatin1String("reality")) {
-            return QStringLiteral("none");
-        }
-        return srv.security;
-    }
-
-    // Desktop applies this in XrayProtocol::start(); iOS/Android pass JSON straight to libxray — same fixes here.
-    void sanitizeXrayNativeConfig(amnezia::ProtocolConfig &pc)
-    {
-        QString c = pc.nativeConfig();
-        if (c.isEmpty()) {
-            return;
-        }
-        bool changed = false;
-        if (c.contains(QLatin1String("Mozilla/5.0"), Qt::CaseInsensitive)) {
-            c.replace(QLatin1String("Mozilla/5.0"), QString::fromLatin1(amnezia::protocols::xray::defaultFingerprint),
-                      Qt::CaseInsensitive);
-            changed = true;
-        }
-        const QString legacyListen = QString::fromLatin1(amnezia::protocols::xray::defaultLocalAddr);
-        const QString listenOk = QString::fromLatin1(amnezia::protocols::xray::defaultLocalListenAddr);
-        if (c.contains(legacyListen)) {
-            c.replace(legacyListen, listenOk);
-            changed = true;
-        }
-        if (changed) {
-            pc.setNativeConfig(c);
-        }
-    }
-} // namespace
+Logger logger("XrayConfigurator");
+}

 XrayConfigurator::XrayConfigurator(SshSession* sshSession, QObject *parent)
    : ConfiguratorBase(sshSession, parent)
 {
 }

-amnezia::ProtocolConfig XrayConfigurator::processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                                         amnezia::ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-    sanitizeXrayNativeConfig(protocolConfig);
-    return protocolConfig;
-}
-
-ErrorCode XrayConfigurator::uploadServerConfigJson(const ServerCredentials &credentials, DockerContainer container,
-                                                    const DnsSettings &dnsSettings, const QJsonObject &serverConfig) const
-{
-    const QString updatedConfig = QJsonDocument(serverConfig).toJson();
-    ErrorCode errorCode = m_sshSession->uploadTextFileToContainer(
-            container, credentials, updatedConfig, amnezia::protocols::xray::serverConfigPath,
-            libssh::ScpOverwriteMode::ScpOverwriteExisting);
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Failed to upload updated config";
-        return errorCode;
-    }
-
-    const QString restartScript = QStringLiteral("sudo docker restart $CONTAINER_NAME");
-    errorCode = m_sshSession->runScript(
-            credentials,
-            m_sshSession->replaceVars(restartScript,
-                                      amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns,
-                                                           dnsSettings.secondaryDns)));
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Failed to restart container";
-    }
-    return errorCode;
-}
-
-ErrorCode XrayConfigurator::readRealityKeyFiles(const DockerContainer container, const ServerCredentials &credentials,
-                                                QString &outPublicKey, QString &outShortId) const
-{
-    outPublicKey.clear();
-    outShortId.clear();
-
-    auto readKeyFile = [&](const QString &path, QString &out) -> ErrorCode {
-        for (int attempt = 0; attempt < 3; ++attempt) {
-            ErrorCode fileError = ErrorCode::NoError;
-            out = QString::fromUtf8(m_sshSession->getTextFileFromContainer(container, credentials, path, fileError));
-            out.replace(QLatin1Char('\n'), QString());
-            out.replace(QLatin1Char('\r'), QString());
-            if (fileError == ErrorCode::NoError && !out.isEmpty()) {
-                return ErrorCode::NoError;
-            }
-            if (attempt < 2) {
-                QThread::msleep(500);
-            }
-        }
-        logger.error() << "Xray readRealityKeyFiles: failed path=" << path;
-        return ErrorCode::XrayRealityKeysReadFailed;
-    };
-
-    ErrorCode errorCode = readKeyFile(QString::fromLatin1(amnezia::protocols::xray::PublicKeyPath), outPublicKey);
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-    return readKeyFile(QString::fromLatin1(amnezia::protocols::xray::shortidPath), outShortId);
-}
-
-QJsonObject XrayConfigurator::mergeStreamSettingsForServerInbound(const XrayServerConfig &srv,
-                                                                  const QJsonObject &existingStreamSettings) const
-{
-    QJsonObject streamSettings = buildStreamSettings(srv, QString());
-
-    if (effectiveSecurity(srv) != QLatin1String("reality")) {
-        return streamSettings;
-    }
-
-    const QJsonObject newRs = streamSettings[amnezia::protocols::xray::realitySettings].toObject();
-    QJsonObject oldRs = existingStreamSettings[amnezia::protocols::xray::realitySettings].toObject();
-    QJsonObject merged = oldRs.isEmpty() ? newRs : oldRs;
-
-    const QString siteEff = srv.site.isEmpty() ? QString::fromLatin1(amnezia::protocols::xray::defaultSite) : srv.site;
-    const QString sniEff = srv.sni.isEmpty() ? siteEff : srv.sni;
-
-    if (newRs.contains(amnezia::protocols::xray::fingerprint)) {
-        merged[amnezia::protocols::xray::fingerprint] = newRs[amnezia::protocols::xray::fingerprint];
-    }
-    merged[amnezia::protocols::xray::serverNames] = QJsonArray { sniEff };
-    if (!merged.contains(QStringLiteral("dest"))) {
-        merged[QStringLiteral("dest")] = siteEff + QStringLiteral(":443");
-    }
-
-    streamSettings[amnezia::protocols::xray::realitySettings] = merged;
-    return streamSettings;
-}
-
-ErrorCode XrayConfigurator::applyServerSettingsToRemote(const ServerCredentials &credentials, DockerContainer container,
-                                                        ContainerConfig &containerConfig, const DnsSettings &dnsSettings,
-                                                        bool appendNewClient, QString *outClientId)
-{
-    ErrorCode errorCode = ErrorCode::NoError;
-    const auto *xrayCfg = containerConfig.protocolConfig.as<XrayProtocolConfig>();
-    if (!xrayCfg) {
-        logger.error() << "Xray applyServerSettings: missing XrayProtocolConfig";
-        return ErrorCode::InternalError;
-    }
-
-    const XrayServerConfig &srv = xrayCfg->serverConfig;
-    if (srv.isThirdPartyConfig) {
-        logger.info() << "Xray applyServerSettings: skipped (third-party/native profile)";
-        if (outClientId && xrayCfg->hasClientConfig()) {
-            *outClientId = xrayCfg->clientConfig->id;
-        }
-        return ErrorCode::NoError;
-    }
-
-    logger.info() << "Xray applyServerSettings: start"
-                    << "container=" << static_cast<int>(container) << "host=" << credentials.hostName
-                    << "transport=" << srv.transport << "security=" << srv.security << "port=" << srv.port
-                    << "appendClient=" << appendNewClient;
-    const QString flowValue = effectiveClientFlow(srv);
-    QString realityPublicKey;
-    QString realityShortId;
-    if (effectiveSecurity(srv) == QLatin1String("reality")) {
-        errorCode = readRealityKeyFiles(container, credentials, realityPublicKey, realityShortId);
-        if (errorCode != ErrorCode::NoError) {
-            logger.error() << "Xray applyServerSettings: readRealityKeyFiles failed, error="
-                           << static_cast<int>(errorCode);
-            return errorCode;
-        }
-    }
-
-    QString currentConfig = m_sshSession->getTextFileFromContainer(
-            container, credentials, amnezia::protocols::xray::serverConfigPath, errorCode);
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Xray applyServerSettings: getTextFileFromContainer failed, error="
-                       << static_cast<int>(errorCode) << "path=" << amnezia::protocols::xray::serverConfigPath;
-        return errorCode;
-    }
-    logger.info() << "Xray applyServerSettings: read server config, bytes=" << currentConfig.size();
-
-    QJsonDocument doc = QJsonDocument::fromJson(currentConfig.toUtf8());
-    if (doc.isNull() || !doc.isObject()) {
-        logger.error() << "Failed to parse server config JSON";
-        return ErrorCode::XrayServerConfigInvalid;
-    }
-
-    QJsonObject serverConfig = doc.object();
-    if (!serverConfig.contains(amnezia::protocols::xray::inbounds)) {
-        logger.error() << "Server config missing 'inbounds' field";
-        return ErrorCode::XrayServerConfigInvalid;
-    }
-
-    QJsonArray inbounds = serverConfig[amnezia::protocols::xray::inbounds].toArray();
-    if (inbounds.isEmpty()) {
-        logger.error() << "Server config has empty 'inbounds' array";
-        return ErrorCode::XrayServerConfigInvalid;
-    }
-
-    QJsonObject inbound = inbounds[0].toObject();
-    if (!inbound.contains(amnezia::protocols::xray::settings)) {
-        logger.error() << "Inbound missing 'settings' field";
-        return ErrorCode::XrayServerConfigInvalid;
-    }
-
-    const QJsonObject existingStream = inbound[amnezia::protocols::xray::streamSettings].toObject();
-    inbound[amnezia::protocols::xray::streamSettings] = mergeStreamSettingsForServerInbound(srv, existingStream);
-
-    if (!srv.port.isEmpty()) {
-        inbound[amnezia::protocols::xray::port] = srv.port.toInt();
-    }
-
-    QJsonObject settings = inbound[amnezia::protocols::xray::settings].toObject();
-    if (!settings.contains(amnezia::protocols::xray::clients)) {
-        settings[amnezia::protocols::xray::clients] = QJsonArray {};
-    }
-
-    QJsonArray clients = settings[amnezia::protocols::xray::clients].toArray();
-    QString clientId;
-
-    if (appendNewClient) {
-        clientId = QUuid::createUuid().toString(QUuid::WithoutBraces);
-        QJsonObject clientEntry;
-        clientEntry[amnezia::protocols::xray::id] = clientId;
-        if (!flowValue.isEmpty()) {
-            clientEntry[amnezia::protocols::xray::flow] = flowValue;
-        }
-        clients.append(clientEntry);
-    } else {
-        if (clients.isEmpty()) {
-            logger.error() << "Server config has no VLESS clients";
-            return ErrorCode::XrayServerNoVlessClients;
-        }
-        clientId = clients[0].toObject()[amnezia::protocols::xray::id].toString();
-        if (clientId.isEmpty()) {
-            logger.error() << "Server config VLESS client has empty id";
-            return ErrorCode::XrayServerNoVlessClients;
-        }
-        QJsonArray updatedClients;
-        for (const QJsonValue &v : clients) {
-            QJsonObject c = v.toObject();
-            if (flowValue.isEmpty()) {
-                c.remove(amnezia::protocols::xray::flow);
-            } else {
-                c[amnezia::protocols::xray::flow] = flowValue;
-            }
-            updatedClients.append(c);
-        }
-        clients = updatedClients;
-    }
-
-    settings[amnezia::protocols::xray::clients] = clients;
-    inbound[amnezia::protocols::xray::settings] = settings;
-    inbounds[0] = inbound;
-    serverConfig[amnezia::protocols::xray::inbounds] = inbounds;
-
-    errorCode = uploadServerConfigJson(credentials, container, dnsSettings, serverConfig);
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Xray applyServerSettings: upload/restart failed, error=" << static_cast<int>(errorCode);
-        return errorCode;
-    }
-    logger.info() << "Xray applyServerSettings: server config uploaded and container restarted";
-
-    if (outClientId) {
-        *outClientId = clientId;
-    }
-
-    XrayProtocolConfig updated =
-            buildClientProtocolConfig(credentials, container, srv, clientId, errorCode, realityPublicKey, realityShortId);
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Xray applyServerSettings: buildClientProtocolConfig failed, error="
-                       << static_cast<int>(errorCode);
-        return errorCode;
-    }
-    containerConfig.protocolConfig = updated;
-    logger.info() << "Xray applyServerSettings: done, clientId=" << clientId;
-    return ErrorCode::NoError;
-}
-
-ErrorCode XrayConfigurator::readContainerKeyFile(DockerContainer container, const ServerCredentials &credentials,
-                                                 const QString &path, QString &out) const
-{
-    out.clear();
-    for (int attempt = 0; attempt < 3; ++attempt) {
-        ErrorCode fileError = ErrorCode::NoError;
-        out = QString::fromUtf8(m_sshSession->getTextFileFromContainer(container, credentials, path, fileError));
-        out.replace(QLatin1Char('\n'), QString());
-        out.replace(QLatin1Char('\r'), QString());
-        if (fileError == ErrorCode::NoError && !out.isEmpty()) {
-            return ErrorCode::NoError;
-        }
-        if (attempt < 2) {
-            QThread::msleep(500);
-        }
-    }
-    logger.error() << "Xray readContainerKeyFile: failed path=" << path;
-    return ErrorCode::XrayRealityKeysReadFailed;
-}
-
-ErrorCode XrayConfigurator::writeServerConfigForSetup(const ServerCredentials &credentials, DockerContainer container,
-                                                      ContainerConfig &containerConfig, const DnsSettings &dnsSettings)
-{
-    Q_UNUSED(dnsSettings);
-    namespace px = amnezia::protocols::xray;
-
-    const auto *xrayCfg = containerConfig.protocolConfig.as<XrayProtocolConfig>();
-    if (!xrayCfg) {
-        logger.error() << "Xray writeServerConfigForSetup: missing XrayProtocolConfig";
-        return ErrorCode::InternalError;
-    }
-    const XrayServerConfig &srv = xrayCfg->serverConfig;
-    if (srv.isThirdPartyConfig) {
-        logger.info() << "Xray writeServerConfigForSetup: skipped (third-party/native profile)";
-        return ErrorCode::NoError;
-    }
-
-    logger.info() << "Xray writeServerConfigForSetup: start container=" << static_cast<int>(container)
-                  << "transport=" << srv.transport << "security=" << srv.security << "port=" << srv.port;
-
-    ErrorCode errorCode = ErrorCode::NoError;
-
-    QString clientId;
-    errorCode = readContainerKeyFile(container, credentials, QString::fromLatin1(px::uuidPath), clientId);
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-
-    const QString securityEff = effectiveSecurity(srv);
-
-    QString realityPrivateKey;
-    QString realityPublicKey;
-    QString realityShortId;
-    if (securityEff == QLatin1String("reality")) {
-        errorCode = readContainerKeyFile(container, credentials, QString::fromLatin1(px::PrivateKeyPath), realityPrivateKey);
-        if (errorCode != ErrorCode::NoError)
-            return errorCode;
-        errorCode = readContainerKeyFile(container, credentials, QString::fromLatin1(px::PublicKeyPath), realityPublicKey);
-        if (errorCode != ErrorCode::NoError)
-            return errorCode;
-        errorCode = readContainerKeyFile(container, credentials, QString::fromLatin1(px::shortidPath), realityShortId);
-        if (errorCode != ErrorCode::NoError)
-            return errorCode;
-    }
-
-    QJsonObject streamSettings = buildStreamSettings(srv, clientId);
-    if (securityEff == QLatin1String("reality")) {
-        const QString siteEff = srv.site.isEmpty() ? QString::fromLatin1(px::defaultSite) : srv.site;
-        const QString sniEff = srv.sni.isEmpty() ? siteEff : srv.sni;
-        const QString fpEff = srv.fingerprint.isEmpty() ? QString::fromLatin1(px::defaultFingerprint) : srv.fingerprint;
-        QJsonObject rs;
-        rs[QStringLiteral("dest")] = siteEff + QStringLiteral(":443");
-        rs[px::fingerprint] = fpEff;
-        rs[QStringLiteral("privateKey")] = realityPrivateKey;
-        rs[px::serverNames] = QJsonArray { sniEff };
-        rs[QStringLiteral("shortIds")] = QJsonArray { realityShortId };
-        streamSettings[px::realitySettings] = rs;
-    }
-
-    QJsonObject clientEntry;
-    clientEntry[px::id] = clientId;
-    const QString flowValue = effectiveClientFlow(srv);
-    if (!flowValue.isEmpty()) {
-        clientEntry[px::flow] = flowValue;
-    }
-
-    QJsonObject settings;
-    settings[px::clients] = QJsonArray { clientEntry };
-    settings[QStringLiteral("decryption")] = QStringLiteral("none");
-
-    QJsonObject inbound;
-    inbound[px::port] = srv.port.isEmpty() ? QString(px::defaultPort).toInt() : srv.port.toInt();
-    inbound[QStringLiteral("protocol")] = QStringLiteral("vless");
-    inbound[px::settings] = settings;
-    inbound[px::streamSettings] = streamSettings;
-
-    QJsonObject serverConfig;
-    serverConfig[QStringLiteral("log")] = QJsonObject { { QStringLiteral("loglevel"), QStringLiteral("error") } };
-    serverConfig[px::inbounds] = QJsonArray { inbound };
-    serverConfig[px::outbounds] =
-            QJsonArray { QJsonObject { { QStringLiteral("protocol"), QStringLiteral("freedom") } } };
-
-    const QString json = QString::fromUtf8(QJsonDocument(serverConfig).toJson());
-    errorCode = m_sshSession->uploadTextFileToContainer(container, credentials, json,
-                                                        QString::fromLatin1(px::serverConfigPath),
-                                                        libssh::ScpOverwriteMode::ScpOverwriteExisting);
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Xray writeServerConfigForSetup: upload failed, error=" << static_cast<int>(errorCode);
-        return errorCode;
-    }
-
-    XrayProtocolConfig updated =
-            buildClientProtocolConfig(credentials, container, srv, clientId, errorCode, realityPublicKey, realityShortId);
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Xray writeServerConfigForSetup: buildClientProtocolConfig failed, error="
-                       << static_cast<int>(errorCode);
-        return errorCode;
-    }
-    containerConfig.protocolConfig = updated;
-    logger.info() << "Xray writeServerConfigForSetup: done, clientId=" << clientId;
-    return ErrorCode::NoError;
-}
-
 QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentials, DockerContainer container,
                                               const ContainerConfig &containerConfig,
                                               const DnsSettings &dnsSettings,
                                               ErrorCode &errorCode)
 {
-    ContainerConfig mutableConfig = containerConfig;
-    QString clientId;
-    const ErrorCode applyError =
-            applyServerSettingsToRemote(credentials, container, mutableConfig, dnsSettings, true, &clientId);
-    errorCode = applyError;
-    if (applyError != ErrorCode::NoError || clientId.isEmpty()) {
-        return QString();
+    // Generate new UUID for client
+    QString clientId = QUuid::createUuid().toString(QUuid::WithoutBraces);
+    
+    // Get current server config
+    QString currentConfig = m_sshSession->getTextFileFromContainer(
+        container, credentials, amnezia::protocols::xray::serverConfigPath, errorCode);
+    
+    if (errorCode != ErrorCode::NoError) {
+        logger.error() << "Failed to get server config file";
+        return "";
    }
+
+    // Parse current config as JSON
+    QJsonDocument doc = QJsonDocument::fromJson(currentConfig.toUtf8());
+    if (doc.isNull() || !doc.isObject()) {
+        logger.error() << "Failed to parse server config JSON";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonObject serverConfig = doc.object();
+    
+    // Validate server config structure
+    if (!serverConfig.contains(amnezia::protocols::xray::inbounds)) {
+        logger.error() << "Server config missing 'inbounds' field";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonArray inbounds = serverConfig[amnezia::protocols::xray::inbounds].toArray();
+    if (inbounds.isEmpty()) {
+        logger.error() << "Server config has empty 'inbounds' array";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+    
+    QJsonObject inbound = inbounds[0].toObject();
+    if (!inbound.contains(amnezia::protocols::xray::settings)) {
+        logger.error() << "Inbound missing 'settings' field";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonObject settings = inbound[amnezia::protocols::xray::settings].toObject();
+    if (!settings.contains(amnezia::protocols::xray::clients)) {
+        logger.error() << "Settings missing 'clients' field";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonArray clients = settings[amnezia::protocols::xray::clients].toArray();
+    
+    // Create configuration for new client
+    QJsonObject clientConfig {
+        {amnezia::protocols::xray::id, clientId},
+        {amnezia::protocols::xray::flow, "xtls-rprx-vision"}
+    };
+    
+    clients.append(clientConfig);
+    
+    // Update config
+    settings[amnezia::protocols::xray::clients] = clients;
+    inbound[amnezia::protocols::xray::settings] = settings;
+    inbounds[0] = inbound;
+    serverConfig[amnezia::protocols::xray::inbounds] = inbounds;
+    
+    // Save updated config to server
+    QString updatedConfig = QJsonDocument(serverConfig).toJson();
+    errorCode = m_sshSession->uploadTextFileToContainer(
+        container, 
+        credentials, 
+        updatedConfig,
+        amnezia::protocols::xray::serverConfigPath,
+        libssh::ScpOverwriteMode::ScpOverwriteExisting
+    );
+    if (errorCode != ErrorCode::NoError) {
+        logger.error() << "Failed to upload updated config";
+        return "";
+    }
+
+    // Restart container
+    QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
+    errorCode = m_sshSession->runScript(
+        credentials, 
+        m_sshSession->replaceVars(restartScript, amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns))
+    );
+
+    if (errorCode != ErrorCode::NoError) {
+        logger.error() << "Failed to restart container";
+        return "";
+    }
+
    return clientId;
 }

-XrayProtocolConfig XrayConfigurator::buildClientProtocolConfig(const ServerCredentials &credentials,
-                                                               DockerContainer container,
-                                                               const XrayServerConfig &srv, const QString &clientId,
-                                                               ErrorCode &errorCode,
-                                                               const QString &prefetchedRealityPublicKey,
-                                                               const QString &prefetchedRealityShortId) const
-{
-    QString xrayPublicKey = prefetchedRealityPublicKey;
-    QString xrayShortId = prefetchedRealityShortId;
-
-    const QString securityEff = effectiveSecurity(srv);
-
-    if (securityEff == QLatin1String("reality")) {
-        if (xrayPublicKey.isEmpty() || xrayShortId.isEmpty()) {
-            errorCode = readRealityKeyFiles(container, credentials, xrayPublicKey, xrayShortId);
-            if (errorCode != ErrorCode::NoError) {
-                return {};
-            }
-        }
-    }
-
-    QJsonObject userObj;
-    userObj[amnezia::protocols::xray::id] = clientId;
-    userObj[amnezia::protocols::xray::encryption] = QStringLiteral("none");
-    const QString flowValue = effectiveClientFlow(srv);
-    if (!flowValue.isEmpty()) {
-        userObj[amnezia::protocols::xray::flow] = flowValue;
-    }
-
-    QJsonObject vnextEntry;
-    vnextEntry[amnezia::protocols::xray::address] = credentials.hostName;
-    vnextEntry[amnezia::protocols::xray::port] =
-            srv.port.isEmpty() ? QString(amnezia::protocols::xray::defaultPort).toInt() : srv.port.toInt();
-    vnextEntry[amnezia::protocols::xray::users] = QJsonArray { userObj };
-
-    QJsonObject outboundSettings;
-    outboundSettings[amnezia::protocols::xray::vnext] = QJsonArray { vnextEntry };
-
-    QJsonObject outbound;
-    outbound[QStringLiteral("protocol")] = QStringLiteral("vless");
-    outbound[amnezia::protocols::xray::settings] = outboundSettings;
-
-    QJsonObject streamObj = buildStreamSettings(srv, clientId);
-    if (securityEff == QLatin1String("reality")) {
-        QJsonObject rs = streamObj[amnezia::protocols::xray::realitySettings].toObject();
-        rs[amnezia::protocols::xray::publicKey] = xrayPublicKey;
-        rs[amnezia::protocols::xray::shortId] = xrayShortId;
-        rs[amnezia::protocols::xray::spiderX] = QString();
-        streamObj[amnezia::protocols::xray::realitySettings] = rs;
-    }
-
-    outbound[amnezia::protocols::xray::streamSettings] = streamObj;
-
-    QJsonObject inboundObj;
-    inboundObj[QStringLiteral("listen")] = amnezia::protocols::xray::defaultLocalListenAddr;
-    inboundObj[amnezia::protocols::xray::port] = amnezia::protocols::xray::defaultLocalProxyPort;
-    inboundObj[QStringLiteral("protocol")] = QStringLiteral("socks");
-    inboundObj[amnezia::protocols::xray::settings] = QJsonObject { { QStringLiteral("udp"), true } };
-
-    QJsonObject clientJson;
-    clientJson[QStringLiteral("log")] = QJsonObject { { QStringLiteral("loglevel"), QStringLiteral("error") } };
-    clientJson[amnezia::protocols::xray::inbounds] = QJsonArray { inboundObj };
-    clientJson[amnezia::protocols::xray::outbounds] = QJsonArray { outbound };
-
-    const QString config = QString::fromUtf8(QJsonDocument(clientJson).toJson(QJsonDocument::Compact));
-
-    XrayProtocolConfig protocolConfig;
-    protocolConfig.serverConfig = srv;
-
-    XrayClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    clientConfig.localPort = QString(amnezia::protocols::xray::defaultLocalProxyPort);
-    clientConfig.id = clientId;
-    protocolConfig.setClientConfig(clientConfig);
-
-    return protocolConfig;
-}
-
-QJsonObject XrayConfigurator::buildStreamSettings(const XrayServerConfig &srv, const QString &clientId) const
-{
-    QJsonObject streamSettings;
-    const auto &xhttp = srv.xhttp;
-    const auto &mkcp = srv.mkcp;
-    namespace px = amnezia::protocols::xray;
-
-    QString networkValue = QStringLiteral("tcp");
-    if (srv.transport == QLatin1String("xhttp"))
-        networkValue = QStringLiteral("xhttp");
-    else if (srv.transport == QLatin1String("mkcp"))
-        networkValue = QStringLiteral("kcp");
-    streamSettings[px::network] = networkValue;
-
-    const QString securityEff = effectiveSecurity(srv);
-    streamSettings[px::security] = securityEff;
-
-    if (securityEff == QLatin1String("tls")) {
-        QJsonObject tlsSettings;
-        const QString sniEff = srv.sni.isEmpty() ? QString::fromLatin1(px::defaultSni) : srv.sni;
-        tlsSettings[px::serverName] = sniEff;
-        const QString alpnEff = srv.alpn.isEmpty() ? QString::fromLatin1(px::defaultAlpn) : srv.alpn;
-        QJsonArray alpnArray;
-        for (const QString &a : alpnEff.split(QLatin1Char(','))) {
-            QString t = a.trimmed();
-            if (t.isEmpty())
-                continue;
-            if (t.compare(QLatin1String("HTTP/2"), Qt::CaseInsensitive) == 0)
-                t = QStringLiteral("h2");
-            else if (t.compare(QLatin1String("HTTP/1.1"), Qt::CaseInsensitive) == 0)
-                t = QStringLiteral("http/1.1");
-            alpnArray.append(t);
-        }
-        if (!alpnArray.isEmpty())
-            tlsSettings[QStringLiteral("alpn")] = alpnArray;
-        const QString fpEff = srv.fingerprint.isEmpty() ? QString::fromLatin1(px::defaultFingerprint) : srv.fingerprint;
-        tlsSettings[px::fingerprint] = fpEff;
-        streamSettings[QStringLiteral("tlsSettings")] = tlsSettings;
-    }
-
-    if (securityEff == QLatin1String("reality")) {
-        QJsonObject realSettings;
-        const QString fpEff = srv.fingerprint.isEmpty() ? QString::fromLatin1(px::defaultFingerprint) : srv.fingerprint;
-        realSettings[px::fingerprint] = fpEff;
-        const QString sniEff = srv.sni.isEmpty() ? QString::fromLatin1(px::defaultSni) : srv.sni;
-        realSettings[px::serverName] = sniEff;
-        streamSettings[px::realitySettings] = realSettings;
-    }
-
-    // XHTTP — JSON must match Xray-core SplitHTTPConfig (flat xPadding fields, see transport_internet.go)
-    if (srv.transport == QLatin1String("xhttp")) {
-        QJsonObject xo;
-        const QString hostEff = xhttp.host.isEmpty() ? QString::fromLatin1(px::defaultXhttpHost) : xhttp.host;
-        xo[QStringLiteral("host")] = hostEff;
-        if (!xhttp.path.isEmpty())
-            xo[QStringLiteral("path")] = xhttp.path;
-        QString modeEff = normalizeXhttpMode(xhttp.mode);
-        if (modeEff == QLatin1String("auto") || modeEff == QLatin1String("packet-up")) {
-            modeEff = QStringLiteral("stream-one");
-        }
-        xo[QStringLiteral("mode")] = modeEff;
-
-        // No "Host" in headers: xray rejects it when the top-level "host" field is set.
-
-        const QString methodEff =
-                xhttp.uplinkMethod.isEmpty() ? QString::fromLatin1(px::defaultXhttpUplinkMethod) : xhttp.uplinkMethod;
-        xo[QStringLiteral("uplinkHTTPMethod")] = methodEff.toUpper();
-
-        xo[QStringLiteral("noGRPCHeader")] = xhttp.disableGrpc;
-        xo[QStringLiteral("noSSEHeader")] = xhttp.disableSse;
-
-        const QString sessPl = normalizeSessionSeqPlacement(xhttp.sessionPlacement);
-        if (!sessPl.isEmpty())
-            xo[QStringLiteral("sessionIDPlacement")] = sessPl;
-        const QString seqPl = normalizeSessionSeqPlacement(xhttp.seqPlacement);
-        if (!seqPl.isEmpty())
-            xo[QStringLiteral("seqPlacement")] = seqPl;
-        if (!xhttp.sessionKey.isEmpty())
-            xo[QStringLiteral("sessionIDKey")] = xhttp.sessionKey;
-        if (!xhttp.seqKey.isEmpty())
-            xo[QStringLiteral("seqKey")] = xhttp.seqKey;
-
-        const QString uDataPl = normalizeUplinkDataPlacement(xhttp.uplinkDataPlacement);
-        const bool uDataNeedsPacketUp =
-                uDataPl == QLatin1String("header") || uDataPl == QLatin1String("cookie");
-        if (!(uDataNeedsPacketUp && modeEff != QLatin1String("packet-up")))
-            xo[QStringLiteral("uplinkDataPlacement")] = uDataPl;
-        if (!xhttp.uplinkDataKey.isEmpty())
-            xo[QStringLiteral("uplinkDataKey")] = xhttp.uplinkDataKey;
-
-        const QString ucs = xhttp.uplinkChunkSize.isEmpty() ? QString::fromLatin1(px::defaultXhttpUplinkChunkSize)
-                                                            : xhttp.uplinkChunkSize;
-        if (!ucs.isEmpty() && ucs != QLatin1String("0")) {
-            xo[QStringLiteral("uplinkChunkSize")] = ucs.toInt();
-        }
-
-        if (!xhttp.scMaxBufferedPosts.isEmpty())
-            xo[QStringLiteral("scMaxBufferedPosts")] = xhttp.scMaxBufferedPosts.toLongLong();
-
-        putIntRangeIfAny(xo, "scMaxEachPostBytes", xhttp.scMaxEachPostBytesMin, xhttp.scMaxEachPostBytesMax,
-                         px::defaultXhttpScMaxEachPostBytesMin, px::defaultXhttpScMaxEachPostBytesMax);
-        putIntRangeIfAny(xo, "scMinPostsIntervalMs", xhttp.scMinPostsIntervalMsMin, xhttp.scMinPostsIntervalMsMax,
-                         px::defaultXhttpScMinPostsIntervalMsMin, px::defaultXhttpScMinPostsIntervalMsMax);
-        putIntRangeIfAny(xo, "scStreamUpServerSecs", xhttp.scStreamUpServerSecsMin, xhttp.scStreamUpServerSecsMax,
-                         px::defaultXhttpScStreamUpServerSecsMin, px::defaultXhttpScStreamUpServerSecsMax);
-
-        const auto &pad = xhttp.xPadding;
-        xo[QStringLiteral("xPaddingObfsMode")] = pad.obfsMode;
-        if (pad.obfsMode) {
-            if (!pad.bytesMin.isEmpty() || !pad.bytesMax.isEmpty()) {
-                const int fromV = pad.bytesMin.isEmpty()
-                        ? QString::fromLatin1(px::defaultXPaddingBytesMin).toInt()
-                        : pad.bytesMin.toInt();
-                int toV = pad.bytesMax.isEmpty()
-                        ? QString::fromLatin1(px::defaultXPaddingBytesMax).toInt()
-                        : pad.bytesMax.toInt();
-                if (toV < fromV)
-                    toV = fromV;
-                xo[QStringLiteral("xPaddingBytes")] = makeRangeString(QString::number(fromV), QString::number(toV));
-            }
-            xo[QStringLiteral("xPaddingKey")] =
-                    pad.key.isEmpty() ? QString::fromLatin1(px::defaultXPaddingKey) : pad.key;
-            xo[QStringLiteral("xPaddingHeader")] =
-                    pad.header.isEmpty() ? QString::fromLatin1(px::defaultXPaddingHeader) : pad.header;
-            xo[QStringLiteral("xPaddingPlacement")] = normalizeXPaddingPlacement(
-                    pad.placement.isEmpty() ? QString::fromLatin1(px::defaultXPaddingPlacement) : pad.placement);
-            xo[QStringLiteral("xPaddingMethod")] = normalizeXPaddingMethod(
-                    pad.method.isEmpty() ? QString::fromLatin1(px::defaultXPaddingMethod) : pad.method);
-        }
-
-        // xmux: Xray has no "enabled" flag; omit object when UI disables multiplex tuning.
-        if (xhttp.xmux.enabled) {
-            QJsonObject mux;
-            auto addMuxRange = [&](const char *key, const QString &a, const QString &b) {
-                // omit empty / 0-0 ranges (xray may reject "0-0")
-                const bool aZero = a.isEmpty() || a == QLatin1String("0");
-                const bool bZero = b.isEmpty() || b == QLatin1String("0");
-                if (aZero && bZero)
-                    return;
-                const QString aV = a.isEmpty() ? QStringLiteral("0") : a;
-                const QString bV = b.isEmpty() ? QStringLiteral("0") : b;
-                mux[QString::fromUtf8(key)] = makeRangeString(aV, bV);
-            };
-            addMuxRange("maxConcurrency", xhttp.xmux.maxConcurrencyMin, xhttp.xmux.maxConcurrencyMax);
-            addMuxRange("maxConnections", xhttp.xmux.maxConnectionsMin, xhttp.xmux.maxConnectionsMax);
-            addMuxRange("cMaxReuseTimes", xhttp.xmux.cMaxReuseTimesMin, xhttp.xmux.cMaxReuseTimesMax);
-            addMuxRange("hMaxRequestTimes", xhttp.xmux.hMaxRequestTimesMin, xhttp.xmux.hMaxRequestTimesMax);
-            addMuxRange("hMaxReusableSecs", xhttp.xmux.hMaxReusableSecsMin, xhttp.xmux.hMaxReusableSecsMax);
-            if (!xhttp.xmux.hKeepAlivePeriod.isEmpty())
-                mux[QStringLiteral("hKeepAlivePeriod")] = xhttp.xmux.hKeepAlivePeriod.toLongLong();
-            if (!mux.isEmpty())
-                xo[QStringLiteral("xmux")] = mux;
-        }
-
-        streamSettings[QStringLiteral("xhttpSettings")] = xo;
-    }
-
-    if (srv.transport == QLatin1String("mkcp")) {
-        QJsonObject kcpObj;
-        const QString ttiEff = mkcp.tti.isEmpty() ? QString::fromLatin1(px::defaultMkcpTti) : mkcp.tti;
-        const QString upEff = mkcp.uplinkCapacity.isEmpty() ? QString::fromLatin1(px::defaultMkcpUplinkCapacity)
-                                                            : mkcp.uplinkCapacity;
-        const QString downEff = mkcp.downlinkCapacity.isEmpty() ? QString::fromLatin1(px::defaultMkcpDownlinkCapacity)
-                                                                : mkcp.downlinkCapacity;
-        const QString rbufEff = mkcp.readBufferSize.isEmpty() ? QString::fromLatin1(px::defaultMkcpReadBufferSize)
-                                                              : mkcp.readBufferSize;
-        const QString wbufEff = mkcp.writeBufferSize.isEmpty() ? QString::fromLatin1(px::defaultMkcpWriteBufferSize)
-                                                               : mkcp.writeBufferSize;
-        kcpObj[QStringLiteral("tti")] = ttiEff.toInt();
-        kcpObj[QStringLiteral("uplinkCapacity")] = upEff.toInt();
-        kcpObj[QStringLiteral("downlinkCapacity")] = downEff.toInt();
-        kcpObj[QStringLiteral("readBufferSize")] = rbufEff.toInt();
-        kcpObj[QStringLiteral("writeBufferSize")] = wbufEff.toInt();
-        kcpObj[QStringLiteral("congestion")] = mkcp.congestion;
-        streamSettings[QStringLiteral("kcpSettings")] = kcpObj;
-    }
-
-    return streamSettings;
-}
-
 ProtocolConfig XrayConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                              const ContainerConfig &containerConfig,
-                                              const DnsSettings &dnsSettings,
-                                              ErrorCode &errorCode)
+                                               const ContainerConfig &containerConfig,
+                                               const DnsSettings &dnsSettings,
+                                               ErrorCode &errorCode)
 {
-    if (const auto *xrayCfg = containerConfig.protocolConfig.as<XrayProtocolConfig>()) {
-        if (xrayCfg->serverConfig.isThirdPartyConfig && xrayCfg->hasClientConfig()) {
-            logger.info() << "Xray createConfig: returning existing third-party client config without server SSH";
-            return *xrayCfg;
-        }
+    const XrayServerConfig* serverConfig = nullptr;
+    if (auto* xrayConfig = containerConfig.protocolConfig.as<XrayProtocolConfig>()) {
+        serverConfig = &xrayConfig->serverConfig;
    }
-
-    const XrayServerConfig *serverConfig = nullptr;
-    if (const auto *xrayCfg = containerConfig.protocolConfig.as<XrayProtocolConfig>()) {
-        serverConfig = &xrayCfg->serverConfig;
-    }
-
-    if (!serverConfig) {
-        logger.error() << "No XrayProtocolConfig found";
+    
+    QString xrayClientId = prepareServerConfig(credentials, container, containerConfig, dnsSettings, errorCode);
+    if (errorCode != ErrorCode::NoError || xrayClientId.isEmpty()) {
+        logger.error() << "Failed to prepare server config";
        errorCode = ErrorCode::InternalError;
        return XrayProtocolConfig{};
    }

-    const XrayServerConfig &srv = *serverConfig;
-
-    QString xrayClientId = prepareServerConfig(credentials, container, containerConfig, dnsSettings, errorCode);
-    if (errorCode != ErrorCode::NoError || xrayClientId.isEmpty()) {
-        logger.error() << "Failed to prepare server config";
-        if (errorCode == ErrorCode::NoError) {
-            errorCode = ErrorCode::InternalError;
-        }
+    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
+    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
+    QString config = m_sshSession->replaceVars(amnezia::scriptData(ProtocolScriptType::xray_template, container), vars);
+    
+    if (config.isEmpty()) {
+        logger.error() << "Failed to get config template";
+        errorCode = ErrorCode::InternalError;
        return XrayProtocolConfig{};
    }

-    return buildClientProtocolConfig(credentials, container, srv, xrayClientId, errorCode);
-}
+    QString xrayPublicKey =
+            m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::PublicKeyPath, errorCode);
+    if (errorCode != ErrorCode::NoError || xrayPublicKey.isEmpty()) {
+        logger.error() << "Failed to get public key";
+        errorCode = ErrorCode::InternalError;
+        return XrayProtocolConfig{};
+    }
+    xrayPublicKey.replace("\n", "");
+    
+    QString xrayShortId =
+            m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::shortidPath, errorCode);
+    if (errorCode != ErrorCode::NoError || xrayShortId.isEmpty()) {
+        logger.error() << "Failed to get short ID";
+        errorCode = ErrorCode::InternalError;
+        return XrayProtocolConfig{};
+    }
+    xrayShortId.replace("\n", "");
+
+    if (!config.contains("$XRAY_CLIENT_ID") || !config.contains("$XRAY_PUBLIC_KEY") || !config.contains("$XRAY_SHORT_ID")) {
+        logger.error() << "Config template missing required variables:"
+                      << "XRAY_CLIENT_ID:" << !config.contains("$XRAY_CLIENT_ID")
+                      << "XRAY_PUBLIC_KEY:" << !config.contains("$XRAY_PUBLIC_KEY")
+                      << "XRAY_SHORT_ID:" << !config.contains("$XRAY_SHORT_ID");
+        errorCode = ErrorCode::InternalError;
+        return XrayProtocolConfig{};
+    }
+
+    config.replace("$XRAY_CLIENT_ID", xrayClientId);
+    config.replace("$XRAY_PUBLIC_KEY", xrayPublicKey);
+    config.replace("$XRAY_SHORT_ID", xrayShortId);
+
+    XrayProtocolConfig protocolConfig;
+    if (serverConfig) {
+        protocolConfig.serverConfig = *serverConfig;
+    }
+    
+    XrayClientConfig clientConfig;
+    clientConfig.nativeConfig = config;
+    clientConfig.localPort = "";
+    clientConfig.id = xrayClientId;
+    
+    protocolConfig.setClientConfig(clientConfig);
+    
+    return protocolConfig;
+}
--- a/client/core/configurators/xrayConfigurator.h
+++ b/client/core/configurators/xrayConfigurator.h
@@ -2,13 +2,11 @@
 #define XRAY_CONFIGURATOR_H

 #include <QObject>
-#include <QJsonObject>

 #include "configuratorBase.h"
 #include "core/utils/errorCodes.h"
 #include "core/utils/routeModes.h"
 #include "core/utils/commonStructs.h"
-#include "core/models/protocols/xrayProtocolConfig.h"

 class XrayConfigurator : public ConfiguratorBase
 {
@@ -20,51 +18,10 @@ public:
                                const amnezia::DnsSettings &dnsSettings,
                                amnezia::ErrorCode &errorCode) override;

-    amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                           amnezia::ProtocolConfig protocolConfig) override;
-
-    amnezia::ErrorCode applyServerSettingsToRemote(const amnezia::ServerCredentials &credentials,
-                                                   amnezia::DockerContainer container,
-                                                   amnezia::ContainerConfig &containerConfig,
-                                                   const amnezia::DnsSettings &dnsSettings,
-                                                   bool appendNewClient,
-                                                   QString *outClientId = nullptr);
-
-    amnezia::ErrorCode writeServerConfigForSetup(const amnezia::ServerCredentials &credentials,
-                                                 amnezia::DockerContainer container,
-                                                 amnezia::ContainerConfig &containerConfig,
-                                                 const amnezia::DnsSettings &dnsSettings);
-
 private:
-    amnezia::ErrorCode readContainerKeyFile(amnezia::DockerContainer container,
-                                            const amnezia::ServerCredentials &credentials,
-                                            const QString &path, QString &out) const;
-
    QString prepareServerConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container, const amnezia::ContainerConfig &containerConfig,
                                const amnezia::DnsSettings &dnsSettings,
                                amnezia::ErrorCode &errorCode);
-
-    amnezia::ErrorCode uploadServerConfigJson(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                              const amnezia::DnsSettings &dnsSettings, const QJsonObject &serverConfig) const;
-
-    amnezia::XrayProtocolConfig buildClientProtocolConfig(const amnezia::ServerCredentials &credentials,
-                                                          amnezia::DockerContainer container,
-                                                          const amnezia::XrayServerConfig &srv,
-                                                          const QString &clientId,
-                                                          amnezia::ErrorCode &errorCode,
-                                                          const QString &prefetchedRealityPublicKey = {},
-                                                          const QString &prefetchedRealityShortId = {}) const;
-
-    amnezia::ErrorCode readRealityKeyFiles(amnezia::DockerContainer container,
-                                           const amnezia::ServerCredentials &credentials,
-                                           QString &outPublicKey,
-                                           QString &outShortId) const;
-
-    QJsonObject mergeStreamSettingsForServerInbound(const amnezia::XrayServerConfig &srv,
-                                                    const QJsonObject &existingStreamSettings) const;
-
-    QJsonObject buildStreamSettings(const amnezia::XrayServerConfig &srv,
-                                    const QString &clientId) const;
 };

 #endif // XRAY_CONFIGURATOR_H
--- a/client/core/controllers/api/newsController.cpp
+++ b/client/core/controllers/api/newsController.cpp
@@ -1,94 +1,51 @@
 #include "newsController.h"

 #include "core/controllers/gatewayController.h"
-#include "core/repositories/secureServersRepository.h"
+#include "core/utils/api/apiEnums.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
+#include "core/utils/constants/configKeys.h"
 #include <QtConcurrent/QtConcurrent>
-#include <QJsonArray>
 #include <QJsonDocument>
 #include <QJsonObject>
-#include <QSet>
 #include <QSharedPointer>

 using namespace amnezia;

-NewsController::NewsController(SecureAppSettingsRepository *appSettingsRepository,
-                               SecureServersRepository *serversRepository)
-    : m_appSettingsRepository(appSettingsRepository),
-      m_serversRepository(serversRepository)
+NewsController::NewsController(SecureAppSettingsRepository* appSettingsRepository,
+                               ServersController* serversController)
+    : m_appSettingsRepository(appSettingsRepository), m_serversController(serversController)
 {
 }

-QJsonObject NewsController::getServicesList() const
-{
-    if (!m_serversRepository) {
-        return {};
-    }
-    QSet<QString> userCountryCodes;
-    QSet<QString> serviceTypes;
-    const QVector<QString> ids = m_serversRepository->orderedServerIds();
-    for (const QString &id : ids) {
-        const auto apiV2 = m_serversRepository->apiV2Config(id);
-        if (!apiV2.has_value()) {
-            continue;
-        }
-        if (!apiV2->apiConfig.userCountryCode.isEmpty()) {
-            userCountryCodes.insert(apiV2->apiConfig.userCountryCode);
-        }
-        const QString serviceType = apiV2->serviceType();
-        if (!serviceType.isEmpty()) {
-            serviceTypes.insert(serviceType);
-        }
-    }
-    if (userCountryCodes.isEmpty() && serviceTypes.isEmpty()) {
-        return {};
-    }
-    QJsonObject json;
-
-    QJsonArray userCountryCodesArray;
-    for (const QString &code : userCountryCodes) {
-        userCountryCodesArray.append(code);
-    }
-    json[apiDefs::key::userCountryCode] = userCountryCodesArray;
-
-    QJsonArray serviceTypesArray;
-    for (const QString &type : serviceTypes) {
-        serviceTypesArray.append(type);
-    }
-    json[apiDefs::key::serviceType] = serviceTypesArray;
-
-    return json;
-}
-
 QFuture<QPair<ErrorCode, QJsonArray>> NewsController::fetchNews()
 {
-    if (!m_serversRepository) {
-        qWarning() << "SecureServersRepository is null, skip fetchNews";
+    if (!m_serversController) {
+        qWarning() << "ServersController is null, skip fetchNews";
        return QtFuture::makeReadyFuture(qMakePair(ErrorCode::InternalError, QJsonArray()));
    }
-
-    const QJsonObject services = getServicesList();
-    if (services.isEmpty()) {
+    
+    const auto stacks = m_serversController->gatewayStacks();
+    if (stacks.isEmpty()) {
        qDebug() << "No Gateway stacks, skip fetchNews";
        return QtFuture::makeReadyFuture(qMakePair(ErrorCode::NoError, QJsonArray()));
    }

    auto gatewayController = QSharedPointer<GatewayController>::create(
-            m_appSettingsRepository->getGatewayEndpoint(),
-            m_appSettingsRepository->isDevGatewayEnv(),
-            apiDefs::requestTimeoutMsecs,
-            m_appSettingsRepository->isStrictKillSwitchEnabled(),
-            m_appSettingsRepository);
-
+        m_appSettingsRepository->getGatewayEndpoint(),
+        m_appSettingsRepository->isDevGatewayEnv(),
+        apiDefs::requestTimeoutMsecs,
+        m_appSettingsRepository->isStrictKillSwitchEnabled());
+    
    QJsonObject payload;
    payload.insert("locale", m_appSettingsRepository->getAppLanguage().name().split("_").first());

-    if (services.contains(apiDefs::key::userCountryCode)) {
-        payload.insert(apiDefs::key::userCountryCode, services.value(apiDefs::key::userCountryCode));
+    const QJsonObject stacksJson = stacks.toJson();
+    if (stacksJson.contains(apiDefs::key::userCountryCode)) {
+        payload.insert(apiDefs::key::userCountryCode, stacksJson.value(apiDefs::key::userCountryCode));
    }
-    if (services.contains(apiDefs::key::serviceType)) {
-        payload.insert(apiDefs::key::serviceType, services.value(apiDefs::key::serviceType));
+    if (stacksJson.contains(apiDefs::key::serviceType)) {
+        payload.insert(apiDefs::key::serviceType, stacksJson.value(apiDefs::key::serviceType));
    }

    auto future = gatewayController->postAsync(QString("%1v1/news"), payload);
@@ -112,3 +69,4 @@ QFuture<QPair<ErrorCode, QJsonArray>> NewsController::fetchNews()
        return qMakePair(ErrorCode::NoError, newsArray);
    });
 }
+
--- a/client/core/controllers/api/newsController.h
+++ b/client/core/controllers/api/newsController.h
@@ -3,28 +3,26 @@

 #include <QFuture>
 #include <QJsonArray>
-#include <QJsonObject>
 #include <QPair>

 #include "core/utils/errorCodes.h"
 #include "core/utils/routeModes.h"
 #include "core/utils/commonStructs.h"
 #include "core/repositories/secureAppSettingsRepository.h"
-#include "core/repositories/secureServersRepository.h"
+#include "core/controllers/serversController.h"

 class NewsController
 {
 public:
    explicit NewsController(SecureAppSettingsRepository* appSettingsRepository,
-                           SecureServersRepository* serversRepository);
+                           ServersController* serversController);

    QFuture<QPair<ErrorCode, QJsonArray>> fetchNews();

 private:
-    QJsonObject getServicesList() const;
-
    SecureAppSettingsRepository* m_appSettingsRepository;
-    SecureServersRepository* m_serversRepository;
+    ServersController* m_serversController;
 };

 #endif // NEWSCONTROLLER_H
+
--- a/client/core/controllers/api/servicesCatalogController.cpp
+++ b/client/core/controllers/api/servicesCatalogController.cpp
@@ -11,7 +11,7 @@
 #include <limits>

 #include "core/controllers/gatewayController.h"
-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/api/apiEnums.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
 #include "version.h"
@@ -242,7 +242,7 @@ ErrorCode ServicesCatalogController::fillAvailableServices(QJsonObject &services
 ErrorCode ServicesCatalogController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody)
 {
    GatewayController gatewayController(m_appSettingsRepository->getGatewayEndpoint(), m_appSettingsRepository->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
-                                        m_appSettingsRepository->isStrictKillSwitchEnabled(), m_appSettingsRepository);
+                                        m_appSettingsRepository->isStrictKillSwitchEnabled());
    return gatewayController.post(endpoint, apiPayload, responseBody);
 }

--- a/client/core/controllers/api/subscriptionController.cpp
+++ b/client/core/controllers/api/subscriptionController.cpp
--- a/client/core/controllers/api/subscriptionController.h
+++ b/client/core/controllers/api/subscriptionController.h
@@ -12,6 +12,7 @@
 #include "core/utils/commonStructs.h"
 #include "core/repositories/secureServersRepository.h"
 #include "core/repositories/secureAppSettingsRepository.h"
+#include "core/models/serverConfig.h"

 class ServersController;

@@ -42,61 +43,49 @@ public:
        QJsonObject toJsonObject() const;
    };

-    struct CaptchaInfo {
-        QString captchaId;
-        QString captchaImageBase64;
-        QString hint;
-        bool isRequired = false;
-    };
-
    explicit SubscriptionController(SecureServersRepository* serversRepository,
                                     SecureAppSettingsRepository* appSettingsRepository);

    ProtocolData generateProtocolData(const QString &protocol);
    void appendProtocolDataToApiPayload(const QString &protocol, const ProtocolData &protocolData, QJsonObject &apiPayload);
+    ErrorCode fillServerConfig(const QJsonObject &serverConfigJson, ServerConfig &serverConfig);

    ErrorCode importServiceFromGateway(const QString &userCountryCode, const QString &serviceType,
                                      const QString &serviceProtocol, const ProtocolData &protocolData,
-                                      CaptchaInfo &captchaInfo);
+                                      ServerConfig &serverConfig);
    ErrorCode importTrialFromGateway(const QString &userCountryCode, const QString &serviceType,
-                                     const QString &serviceProtocol, const QString &email);
+                                     const QString &serviceProtocol, const QString &email,
+                                     ServerConfig &serverConfig);

    ErrorCode importServiceFromAppStore(const QString &userCountryCode, const QString &serviceType,
                                        const QString &serviceProtocol, const ProtocolData &protocolData,
                                        const QString &transactionId, bool isTestPurchase,
+                                        ServerConfig &serverConfig,
                                        int *duplicateServerIndex = nullptr);

-    ErrorCode updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent,
-                                       CaptchaInfo *captchaInfoOut = nullptr, ProtocolData *usedProtocolDataOut = nullptr);
+    ErrorCode updateServiceFromGateway(int serverIndex, const QString &newCountryCode, bool isConnectEvent);

-    ErrorCode resolveUpdateServiceCaptcha(const QString &serverId, const QString &newCountryCode, bool isConnectEvent,
-                                          const ProtocolData &protocolData, const QString &captchaId,
-                                          const QString &captchaSolution, CaptchaInfo *retryCaptchaOut = nullptr);
+    ErrorCode deactivateDevice(int serverIndex, bool isRemoveEvent);

-    ErrorCode deactivateDevice(const QString &serverId);
+    ErrorCode deactivateExternalDevice(int serverIndex, const QString &uuid, const QString &serverCountryCode);

-    ErrorCode deactivateExternalDevice(const QString &serverId, const QString &uuid, const QString &serverCountryCode);
+    ErrorCode exportNativeConfig(int serverIndex, const QString &serverCountryCode, QString &nativeConfig);

-    ErrorCode exportNativeConfig(const QString &serverId, const QString &serverCountryCode, QString &nativeConfig);
+    ErrorCode revokeNativeConfig(int serverIndex, const QString &serverCountryCode);

-    ErrorCode revokeNativeConfig(const QString &serverId, const QString &serverCountryCode);
+    ErrorCode updateServiceFromTelegram(int serverIndex);

-    ErrorCode prepareVpnKeyExport(const QString &serverId, QString &vpnKey);
+    ErrorCode prepareVpnKeyExport(int serverIndex, QString &vpnKey);

-    ErrorCode validateAndUpdateConfig(const QString &serverId, bool hasInstalledContainers,
-                                      CaptchaInfo *captchaInfoOut = nullptr, ProtocolData *usedProtocolDataOut = nullptr);
+    ErrorCode validateAndUpdateConfig(int serverIndex, bool hasInstalledContainers);

-    void removeApiConfig(const QString &serverId);
+    void removeApiConfig(int serverIndex);

-    bool removeServer(const QString &serverId);
+    void setCurrentProtocol(int serverIndex, const QString &protocolName);
+    bool isVlessProtocol(int serverIndex) const;

-    void setCurrentProtocol(const QString &serverId, const QString &protocolName);
-    bool isVlessProtocol(const QString &serverId) const;
-    QString currentProtocol(const QString &serverId) const;
-    QStringList availableProtocols(const QString &serverId) const;
-
-    ErrorCode getAccountInfo(const QString &serverId, QJsonObject &accountInfo);
-    QFuture<QPair<ErrorCode, QString>> getRenewalLink(const QString &serverId);
+    ErrorCode getAccountInfo(int serverIndex, QJsonObject &accountInfo);
+    QFuture<QPair<ErrorCode, QString>> getRenewalLink(int serverIndex);

    struct AppStoreRestoreResult
    {
@@ -109,24 +98,18 @@ public:

    ErrorCode processAppStorePurchase(const QString &userCountryCode, const QString &serviceType,
                                     const QString &serviceProtocol, const QString &productId,
+                                     ServerConfig &serverConfig,
                                     int *duplicateServerIndex = nullptr);

    AppStoreRestoreResult processAppStoreRestore(const QString &userCountryCode, const QString &serviceType,
                                                  const QString &serviceProtocol);

-    ErrorCode resolveImportServiceCaptcha(const QString &userCountryCode, const QString &serviceType,
-                                          const QString &serviceProtocol, const ProtocolData &protocolData,
-                                          const QString &captchaId, const QString &captchaSolution,
-                                          CaptchaInfo *retryCaptchaOut = nullptr);
-
 private:
    ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody, bool isTestPurchase = false);
-    bool isApiKeyExpired(const QString &serverId) const;
+    bool isApiKeyExpired(int serverIndex) const;
    
-    ErrorCode extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol,
+    ErrorCode extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol, 
                                                   const ProtocolData &protocolData, QJsonObject &serverConfigJson);
-    ErrorCode applyUpdatedServiceConfig(const QString &serverId, const QString &serviceProtocol,
-                                        const ProtocolData &protocolData, const QByteArray &responseBody);
    void updateApiConfigInJson(QJsonObject &serverConfigJson, const QString &serviceType, 
                                const QString &serviceProtocol, const QString &userCountryCode,
                                const QByteArray &apiResponseBody);
--- a/client/core/controllers/connectionController.cpp
+++ b/client/core/controllers/connectionController.cpp
@@ -6,13 +6,14 @@
 #include "core/utils/protocolEnum.h"
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
-#include "core/utils/payloadSender.h"
+#include "core/utils/constants/protocolConstants.h"
 #include "core/utils/utilities.h"
-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/networkUtilities.h"
 #include "version.h"
 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
 #include "core/utils/protocolEnum.h"
+#include "core/models/serverConfig.h"
 #include "core/models/containerConfig.h"
 #include "core/models/protocolConfig.h"

@@ -31,6 +32,7 @@ ConnectionController::ConnectionController(SecureServersRepository* serversRepos
    connect(m_vpnConnection, &VpnConnection::connectionStateChanged, this, &ConnectionController::connectionStateChanged);
    connect(this, &ConnectionController::openConnectionRequested, m_vpnConnection, &VpnConnection::connectToVpn, Qt::QueuedConnection);
    connect(this, &ConnectionController::closeConnectionRequested, m_vpnConnection, &VpnConnection::disconnectFromVpn, Qt::QueuedConnection);
+    connect(this, &ConnectionController::setConnectionStateRequested, m_vpnConnection, &VpnConnection::setConnectionState, Qt::QueuedConnection);
    connect(this, &ConnectionController::killSwitchModeChangedRequested, m_vpnConnection, &VpnConnection::onKillSwitchModeChanged, Qt::QueuedConnection);
 #ifdef Q_OS_ANDROID
    connect(this, &ConnectionController::restoreConnectionRequested, m_vpnConnection, &VpnConnection::restoreConnection, Qt::QueuedConnection);
@@ -44,184 +46,48 @@ bool ConnectionController::isConnected() const

 void ConnectionController::setConnectionState(Vpn::ConnectionState state)
 {
-    emit connectionStateChanged(state);
-}
-
-ErrorCode ConnectionController::defaultContainerForServer(const QString &serverId, DockerContainer &container) const
-{
-    const auto kind = m_serversRepository->serverKind(serverId);
-    switch (kind) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        if (!cfg.has_value()) {
-            return ErrorCode::InternalError;
-        }
-        container = cfg->defaultContainer;
-        return ErrorCode::NoError;
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        const auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        if (!cfg.has_value()) {
-            return ErrorCode::InternalError;
-        }
-        container = cfg->defaultContainer;
-        return ErrorCode::NoError;
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        const auto cfg = m_serversRepository->nativeConfig(serverId);
-        if (!cfg.has_value()) {
-            return ErrorCode::InternalError;
-        }
-        container = cfg->defaultContainer;
-        return ErrorCode::NoError;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        const auto cfg = m_serversRepository->apiV2Config(serverId);
-        if (!cfg.has_value()) {
-            return ErrorCode::InternalError;
-        }
-        container = cfg->defaultContainer;
-        return ErrorCode::NoError;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2:
-        return ErrorCode::LegacyApiV1NotSupportedError;
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return ErrorCode::InternalError;
+    if (m_vpnConnection) {
+        emit setConnectionStateRequested(state);
    }
 }

-ErrorCode ConnectionController::isConnectionSupported(const QString &serverId) const
+ErrorCode ConnectionController::prepareConnection(int serverIndex,
+                                                 QJsonObject& vpnConfiguration,
+                                                 DockerContainer& container)
 {
-    if (serverId.isEmpty()) {
-        return ErrorCode::InternalError;
-    }
-
    if (!isServiceReady()) {
        return ErrorCode::AmneziaServiceNotRunning;
    }

-    const serverConfigUtils::ConfigType kind = m_serversRepository->serverKind(serverId);
-    if (serverConfigUtils::isLegacyApiSubscription(kind)) {
-        return ErrorCode::LegacyApiV1NotSupportedError;
-    }
-
-    DockerContainer container = DockerContainer::None;
-    const ErrorCode errorCode = defaultContainerForServer(serverId, container);
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-
-    if (container == DockerContainer::None) {
-        if (serverConfigUtils::isApiV2Subscription(kind)) {
-            return ErrorCode::NoError;
-        }
-        return ErrorCode::NoInstalledContainersError;
-    }
-
-    if (ContainerUtils::isUnsupportedContainer(container)) {
-        return ErrorCode::LegacyContainerNotSupportedError;
-    }
+    ServerConfig serverConfigModel = m_serversRepository->server(serverIndex);
+    container = serverConfigModel.defaultContainer();

    if (!isContainerSupported(container)) {
        return ErrorCode::NotSupportedOnThisPlatform;
    }

-    return ErrorCode::NoError;
-}
+    ContainerConfig containerConfigModel = m_serversRepository->containerConfig(serverIndex, container);

-ErrorCode ConnectionController::prepareConnection(const QString &serverId,
-                                                 QJsonObject& vpnConfiguration,
-                                                 DockerContainer& container)
-{
-    ContainerConfig containerConfigModel;
-    QPair<QString, QString> dns;
-    QString hostName;
-    QString description;
-    int configVersion = 0;
-    bool isApiConfig = false;
+    auto dns = serverConfigModel.getDnsPair(m_appSettingsRepository->useAmneziaDns(),
+                                            m_appSettingsRepository->primaryDns(),
+                                            m_appSettingsRepository->secondaryDns());

-    const auto kind = m_serversRepository->serverKind(serverId);
-    const QString primaryDns = m_appSettingsRepository->primaryDns();
-    const QString secondaryDns = m_appSettingsRepository->secondaryDns();
-    switch (kind) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = cfg->getDnsPair(m_appSettingsRepository->useAmneziaDns(), primaryDns, secondaryDns);
-        hostName = cfg->hostName;
-        description = cfg->description;
-        break;
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        const auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = cfg->getDnsPair(primaryDns, secondaryDns);
-        hostName = cfg->hostName;
-        description = cfg->description;
-        break;
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        const auto cfg = m_serversRepository->nativeConfig(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = cfg->getDnsPair(primaryDns, secondaryDns);
-        hostName = cfg->hostName;
-        description = cfg->description;
-        break;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        const auto cfg = m_serversRepository->apiV2Config(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = cfg->getDnsPair(primaryDns, secondaryDns);
-        hostName = cfg->hostName;
-        description = cfg->description;
-        configVersion = serverConfigUtils::ConfigSource::AmneziaGateway;
-        isApiConfig = true;
-        break;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2:
-        return ErrorCode::InternalError;
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return ErrorCode::InternalError;
-    }
-
-    vpnConfiguration = createConnectionConfiguration(dns, isApiConfig, hostName, description, configVersion,
-                                                     containerConfigModel, container);
+    vpnConfiguration = createConnectionConfiguration(dns, serverConfigModel, containerConfigModel, container);

    return ErrorCode::NoError;
 }

-ErrorCode ConnectionController::openConnection(const QString &serverId)
+ErrorCode ConnectionController::openConnection(int serverIndex)
 {
    QJsonObject vpnConfiguration;
    DockerContainer container;

-    ErrorCode errorCode = prepareConnection(serverId, vpnConfiguration, container);
+    ErrorCode errorCode = prepareConnection(serverIndex, vpnConfiguration, container);
    if (errorCode != ErrorCode::NoError) {
        return errorCode;
    }

-    const auto apiV2 = m_serversRepository->apiV2Config(serverId);
-    if (apiV2.has_value() && !apiV2->sendPayload.isEmpty()) {
-        PayloadSender::sendAll(apiV2->sendPayload);
-    }
-
-    emit openConnectionRequested(serverId, container, vpnConfiguration);
+    emit openConnectionRequested(serverIndex, container, vpnConfiguration);
    return ErrorCode::NoError;
 }

@@ -254,10 +120,7 @@ ErrorCode ConnectionController::lastConnectionError() const
 }

 QJsonObject ConnectionController::createConnectionConfiguration(const QPair<QString, QString> &dns,
-                                                              bool isApiConfig,
-                                                              const QString &hostName,
-                                                              const QString &description,
-                                                              int configVersion,
+                                                              const ServerConfig &serverConfig,
                                                              const ContainerConfig &containerConfig,
                                                              DockerContainer container)
 {
@@ -271,7 +134,7 @@ QJsonObject ConnectionController::createConnectionConfiguration(const QPair<QStr

    ConnectionSettings connectionSettings = {
        { dns.first, dns.second },
-        isApiConfig,
+        serverConfig.isApiConfig(),
        {
            m_appSettingsRepository->isSitesSplitTunnelingEnabled(),
            m_appSettingsRepository->routeMode()
@@ -297,9 +160,10 @@ QJsonObject ConnectionController::createConnectionConfiguration(const QPair<QStr
    vpnConfiguration[configKey::dns1] = dns.first;
    vpnConfiguration[configKey::dns2] = dns.second;

-    vpnConfiguration[configKey::hostName] = hostName;
-    vpnConfiguration[configKey::description] = description;
-    vpnConfiguration[configKey::configVersion] = configVersion;
+    vpnConfiguration[configKey::hostName] = serverConfig.hostName();
+    vpnConfiguration[configKey::description] = serverConfig.description();
+
+    vpnConfiguration[configKey::configVersion] = serverConfig.configVersion();

    return vpnConfiguration;
 }
--- a/client/core/controllers/connectionController.h
+++ b/client/core/controllers/connectionController.h
@@ -30,13 +30,11 @@ public:
                                 QObject* parent = nullptr);
    ~ConnectionController() = default;

-    ErrorCode prepareConnection(const QString &serverId,
+    ErrorCode prepareConnection(int serverIndex,
                               QJsonObject& vpnConfiguration,
                               DockerContainer& container);

-    ErrorCode isConnectionSupported(const QString &serverId) const;
-
-    ErrorCode openConnection(const QString &serverId);
+    ErrorCode openConnection(int serverIndex);

    void closeConnection();

@@ -52,10 +50,7 @@ public:
    void setConnectionState(Vpn::ConnectionState state);

    QJsonObject createConnectionConfiguration(const QPair<QString, QString> &dns,
-                                             bool isApiConfig,
-                                             const QString &hostName,
-                                             const QString &description,
-                                             int configVersion,
+                                             const ServerConfig &serverConfig,
                                             const ContainerConfig &containerConfig,
                                             DockerContainer container);

@@ -65,8 +60,9 @@ public:

 signals:
    void connectionStateChanged(Vpn::ConnectionState state);
-    void openConnectionRequested(const QString &serverId, DockerContainer container, const QJsonObject &vpnConfiguration);
+    void openConnectionRequested(int serverIndex, DockerContainer container, const QJsonObject &vpnConfiguration);
    void closeConnectionRequested();
+    void setConnectionStateRequested(Vpn::ConnectionState state);
    void killSwitchModeChangedRequested(bool enabled);

 #ifdef Q_OS_ANDROID
@@ -74,8 +70,6 @@ signals:
 #endif

 private:
-    ErrorCode defaultContainerForServer(const QString &serverId, DockerContainer &container) const;
-
    SecureServersRepository* m_serversRepository;
    SecureAppSettingsRepository* m_appSettingsRepository;
    VpnConnection* m_vpnConnection;
--- a/client/core/controllers/coreController.cpp
+++ b/client/core/controllers/coreController.cpp
@@ -8,6 +8,7 @@
 #include "core/controllers/selfhosted/installController.h"
 #include "core/controllers/selfhosted/importController.h"
 #include "core/controllers/coreSignalHandlers.h"
+#include "core/models/serverConfig.h"
 #include "logger.h"
 #include "secureQSettings.h"

@@ -22,8 +23,7 @@
 #endif

 CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
-                               QQmlApplicationEngine *engine, QObject *parent,
-                               bool skipPlatformControllerInit)
+                               QQmlApplicationEngine *engine, QObject *parent)
    : QObject(parent), m_vpnConnection(vpnConnection), m_settings(settings), m_engine(engine)
 {
    initRepositories();
@@ -32,10 +32,8 @@ CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnectio
    initControllers();
    initSignalHandlers();

-    if (!skipPlatformControllerInit) {
-        initAndroidController();
-        initAppleController();
-    }
+    initAndroidController();
+    initAppleController();
    initLogging();

    m_translator = new QTranslator(this);
@@ -89,9 +87,6 @@ void CoreController::initModels()
    m_xrayConfigModel = new XrayConfigModel(this);
    setQmlContextProperty("XrayConfigModel", m_xrayConfigModel);

-    m_xrayConfigSnapshotsModel = new XrayConfigSnapshotsModel(m_appSettingsRepository, m_xrayConfigModel, this);
-    setQmlContextProperty("XrayConfigSnapshotsModel", m_xrayConfigSnapshotsModel);
-
    m_torConfigModel = new TorConfigModel(this);
    setQmlContextProperty("TorConfigModel", m_torConfigModel);

@@ -106,12 +101,6 @@ void CoreController::initModels()
    m_socks5ConfigModel = new Socks5ProxyConfigModel(this);
    setQmlContextProperty("Socks5ProxyConfigModel", m_socks5ConfigModel);

-    m_mtProxyConfigModel = new MtProxyConfigModel(this);
-    setQmlContextProperty("MtProxyConfigModel", m_mtProxyConfigModel);
-
-    m_telemtConfigModel = new TelemtConfigModel(this);
-    setQmlContextProperty("TelemtConfigModel", m_telemtConfigModel);
-
    m_clientManagementModel = new ClientManagementModel(this);
    setQmlContextProperty("ClientManagementModel", m_clientManagementModel);

@@ -156,8 +145,7 @@ void CoreController::initCoreControllers()
    m_allowedDnsController = new AllowedDnsController(m_appSettingsRepository);
    m_servicesCatalogController = new ServicesCatalogController(m_appSettingsRepository);
    m_subscriptionController = new SubscriptionController(m_serversRepository, m_appSettingsRepository);
-    m_newsController = new NewsController(m_appSettingsRepository, m_serversRepository);
-    m_updateController = new UpdateController(m_appSettingsRepository, this);
+    m_newsController = new NewsController(m_appSettingsRepository, m_serversController);
    
    m_installController = new InstallController(m_serversRepository, m_appSettingsRepository, this);
    m_exportController = new ExportController(m_serversRepository, m_appSettingsRepository, this);
@@ -176,13 +164,12 @@ void CoreController::initControllers()
        setQmlContextProperty("FocusController", m_focusController);
    }

-    m_installUiController = new InstallUiController(m_installController, m_serversController, m_settingsController, m_protocolsModel, m_usersController,
+    m_installUiController = new InstallUiController(m_installController, m_serversController, m_settingsController, m_protocolsModel, m_usersController, 
                                                     m_awgConfigModel, m_wireGuardConfigModel, m_openVpnConfigModel, m_xrayConfigModel, m_torConfigModel,
 #ifdef Q_OS_WINDOWS
                                                     m_ikev2ConfigModel,
 #endif
-                                                     m_sftpConfigModel, m_socks5ConfigModel, m_mtProxyConfigModel, m_telemtConfigModel,
-                                                     m_connectionController, this);
+                                                     m_sftpConfigModel, m_socks5ConfigModel, this);
    setQmlContextProperty("InstallController", m_installUiController);

    m_importController = new ImportUiController(m_importCoreController, this);
@@ -194,7 +181,7 @@ void CoreController::initControllers()
    m_languageUiController = new LanguageUiController(m_settingsController, m_languageModel, this);
    setQmlContextProperty("LanguageUiController", m_languageUiController);

-    m_settingsUiController = new SettingsUiController(m_settingsController, m_serversController, this);
+    m_settingsUiController = new SettingsUiController(m_settingsController, m_serversController, m_languageUiController, this);
    setQmlContextProperty("SettingsController", m_settingsUiController);

    m_pageController = new PageController(m_serversController, m_settingsController, this);
@@ -215,24 +202,16 @@ void CoreController::initControllers()
    m_systemController = new SystemController(this);
    setQmlContextProperty("SystemController", m_systemController);

-    m_networkReachabilityController = new NetworkReachabilityController(this);
-    setQmlContextProperty("NetworkReachabilityController", m_networkReachabilityController);
-    setQmlContextProperty("NetworkReachability", m_networkReachabilityController);
-
    m_servicesCatalogUiController = new ServicesCatalogUiController(m_servicesCatalogController, m_apiServicesModel, this);
    setQmlContextProperty("ServicesCatalogUiController", m_servicesCatalogUiController);

    m_subscriptionUiController = new SubscriptionUiController(m_serversController, m_apiServicesModel, m_servicesCatalogController, m_subscriptionController,
                                                              m_apiSubscriptionPlansModel, m_apiBenefitsModel, m_apiAccountInfoModel,
-                                                              m_apiCountryModel, m_apiDevicesModel, m_settingsController,
-                                                              m_connectionController, this);
+                                                              m_apiCountryModel, m_apiDevicesModel, m_settingsController, this);
    setQmlContextProperty("SubscriptionUiController", m_subscriptionUiController);

    m_apiNewsUiController = new ApiNewsUiController(m_newsModel, m_newsController, this);
    setQmlContextProperty("ApiNewsController", m_apiNewsUiController);
-
-    m_updateUiController = new UpdateUiController(m_updateController, this);
-    setQmlContextProperty("UpdateController", m_updateUiController);
 }

 void CoreController::initAndroidController()
@@ -279,16 +258,9 @@ void CoreController::initSignalHandlers()
 {
    m_signalHandlers = new CoreSignalHandlers(this, this);
    m_signalHandlers->initAllHandlers();
-
+    
    // Trigger initial update after handlers are connected
    m_serversUiController->updateModel();
-    if (m_serversUiController->hasServersFromGatewayApi()) {
-        m_apiNewsUiController->fetchNews(false);
-    }
-
-    #if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-        m_updateController->checkForUpdates();
-    #endif    
 }

 void CoreController::updateTranslator(const QLocale &locale)
@@ -346,13 +318,11 @@ PageController* CoreController::pageController() const

 void CoreController::openConnectionByIndex(int serverIndex)
 {
-    const QString serverId =
-        m_serversUiController ? m_serversUiController->getServerId(serverIndex) : QString();
-    if (serverId.isEmpty()) {
-        return;
+    if (m_serversModel) {
+        m_serversModel->setProcessedServerIndex(serverIndex);
    }
    if (m_serversController) {
-        m_serversController->setDefaultServer(serverId);
+        m_serversController->setDefaultServerIndex(serverIndex);
    }
    m_connectionUiController->toggleConnection();
 }
--- a/client/core/controllers/coreController.h
+++ b/client/core/controllers/coreController.h
@@ -26,9 +26,7 @@
 #include "ui/controllers/ipSplitTunnelingUiController.h"
 #include "ui/controllers/systemController.h"
 #include "ui/controllers/languageUiController.h"
-#include "ui/controllers/updateUiController.h"
 #include "ui/controllers/api/servicesCatalogUiController.h"
-#include "ui/controllers/networkReachabilityController.h"

 #include "core/controllers/serversController.h"
 #include "core/controllers/selfhosted/usersController.h"
@@ -41,7 +39,6 @@
 #include "core/controllers/selfhosted/installController.h"
 #include "core/controllers/settingsController.h"
 #include "core/controllers/connectionController.h"
-#include "core/controllers/updateController.h"

 #include "core/repositories/secureServersRepository.h"
 #include "core/repositories/secureAppSettingsRepository.h"
@@ -65,15 +62,11 @@
 #include "ui/models/protocols/openvpnConfigModel.h"
 #include "ui/models/protocols/wireguardConfigModel.h"
 #include "ui/models/protocols/xrayConfigModel.h"
-#include "ui/models/protocols/xrayConfigSnapshotsModel.h"
 #include "ui/models/protocolsModel.h"
 #include "ui/models/services/torConfigModel.h"
 #include "ui/models/serversModel.h"
 #include "ui/models/services/sftpConfigModel.h"
 #include "ui/models/services/socks5ProxyConfigModel.h"
-#include "ui/models/services/mtProxyConfigModel.h"
-#include "ui/models/services/telemtConfigModel.h"
-
 #include "ui/models/ipSplitTunnelingModel.h"
 #include "ui/models/newsModel.h"

@@ -82,16 +75,39 @@
 #endif

 class CoreSignalHandlers;
+class TestMultipleImports;
+class TestAdminSelfHostedExport;
+class TestServerEdit;
+class TestDefaultServerChange;
+class TestServerEdgeCases;
+class TestSignalOrder;
+class TestServersModelSync;
+class TestGatewayStacks;
+class TestComplexOperations;
+class TestSettingsSignals;
+class TestUiServersModelAndController;
+class TestSelfHostedServerSetup;

 class CoreController : public QObject
 {
    Q_OBJECT
    friend class CoreSignalHandlers;
+    friend class TestMultipleImports;
+    friend class TestAdminSelfHostedExport;
+    friend class TestServerEdit;
+    friend class TestDefaultServerChange;
+    friend class TestServerEdgeCases;
+    friend class TestSignalOrder;
+    friend class TestServersModelSync;
+    friend class TestGatewayStacks;
+    friend class TestComplexOperations;
+    friend class TestSettingsSignals;
+    friend class TestUiServersModelAndController;
+    friend class TestSelfHostedServerSetup;

 public:
    explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
-                            QQmlApplicationEngine *engine, QObject *parent = nullptr,
-                            bool skipPlatformControllerInit = false);
+                            QQmlApplicationEngine *engine, QObject *parent = nullptr);

    PageController* pageController() const;
    void setQmlRoot();
@@ -104,36 +120,6 @@ signals:
    void translationsUpdated();
    void websiteUrlChanged(const QString &newUrl);

-protected:
-    SecureServersRepository* serversRepositoryProtected() const { return m_serversRepository; }
-    SecureAppSettingsRepository* appSettingsRepositoryProtected() const { return m_appSettingsRepository; }
-    ServersModel* serversModelProtected() const { return m_serversModel; }
-    ContainersModel* containersModelProtected() const { return m_containersModel; }
-    ApiServicesModel* apiServicesModelProtected() const { return m_apiServicesModel; }
-    NewsModel* newsModelProtected() const { return m_newsModel; }
-    AllowedDnsModel* allowedDnsModelProtected() const { return m_allowedDnsModel; }
-    AppSplitTunnelingModel* appSplitTunnelingModelProtected() const { return m_appSplitTunnelingModel; }
-    IpSplitTunnelingModel* ipSplitTunnelingModelProtected() const { return m_ipSplitTunnelingModel; }
-    LanguageModel* languageModelProtected() const { return m_languageModel; }
-    ConnectionUiController* connectionUiControllerProtected() const { return m_connectionUiController; }
-    InstallUiController* installUiControllerProtected() const { return m_installUiController; }
-    ImportController* importCoreControllerProtected() const { return m_importCoreController; }
-    ExportController* exportControllerProtected() const { return m_exportController; }
-    InstallController* installControllerProtected() const { return m_installController; }
-    ServersController* serversControllerProtected() const { return m_serversController; }
-    SettingsUiController* settingsUiControllerProtected() const { return m_settingsUiController; }
-    SettingsController* settingsControllerProtected() const { return m_settingsController; }
-    AllowedDnsUiController* allowedDnsUiControllerProtected() const { return m_allowedDnsUiController; }
-    AllowedDnsController* allowedDnsControllerProtected() const { return m_allowedDnsController; }
-    LanguageUiController* languageUiControllerProtected() const { return m_languageUiController; }
-    IpSplitTunnelingController* ipSplitTunnelingControllerProtected() const { return m_ipSplitTunnelingController; }
-    IpSplitTunnelingUiController* ipSplitTunnelingUiControllerProtected() const { return m_ipSplitTunnelingUiController; }
-    AppSplitTunnelingController* appSplitTunnelingControllerProtected() const { return m_appSplitTunnelingController; }
-    AppSplitTunnelingUiController* appSplitTunnelingUiControllerProtected() const { return m_appSplitTunnelingUiController; }
-    ServersUiController* serversUiControllerProtected() const { return m_serversUiController; }
-    ServicesCatalogUiController* servicesCatalogUiControllerProtected() const { return m_servicesCatalogUiController; }
-    ApiNewsUiController* apiNewsUiControllerProtected() const { return m_apiNewsUiController; }
-
 private:
    void initRepositories();
    void initCoreControllers();
@@ -170,11 +156,9 @@ private:
    ServersUiController* m_serversUiController;
    IpSplitTunnelingUiController* m_ipSplitTunnelingUiController;
    SystemController* m_systemController;
-    NetworkReachabilityController* m_networkReachabilityController;
    AppSplitTunnelingUiController* m_appSplitTunnelingUiController;
    AllowedDnsUiController* m_allowedDnsUiController;
    LanguageUiController* m_languageUiController;
-    UpdateUiController* m_updateUiController;

    SubscriptionUiController* m_subscriptionUiController;
    ApiNewsUiController* m_apiNewsUiController;
@@ -189,7 +173,6 @@ private:
    ServicesCatalogController* m_servicesCatalogController;
    SubscriptionController* m_subscriptionController;
    NewsController* m_newsController;
-    UpdateController* m_updateController;
    InstallController* m_installController;
    ExportController* m_exportController;
    ConnectionController* m_connectionController;
@@ -215,7 +198,6 @@ private:

    OpenVpnConfigModel* m_openVpnConfigModel;
    XrayConfigModel* m_xrayConfigModel;
-    XrayConfigSnapshotsModel* m_xrayConfigSnapshotsModel;
    TorConfigModel* m_torConfigModel;
    WireGuardConfigModel* m_wireGuardConfigModel;
    AwgConfigModel* m_awgConfigModel;
@@ -224,8 +206,6 @@ private:
 #endif
    SftpConfigModel* m_sftpConfigModel;
    Socks5ProxyConfigModel* m_socks5ConfigModel;
-    MtProxyConfigModel* m_mtProxyConfigModel;
-    TelemtConfigModel* m_telemtConfigModel;

    CoreSignalHandlers* m_signalHandlers;
 };
--- a/client/core/controllers/coreSignalHandlers.cpp
+++ b/client/core/controllers/coreSignalHandlers.cpp
@@ -1,14 +1,12 @@
 #include "coreSignalHandlers.h"

 #include <QTimer>
-#include <QtConcurrent>

 #include "core/utils/selfhosted/sshSession.h"
 #include "core/utils/errorCodes.h"
 #include "core/utils/routeModes.h"
 #include "core/controllers/coreController.h"
 #include "core/repositories/secureServersRepository.h"
-#include "core/utils/serverConfigUtils.h"
 #include "core/repositories/secureAppSettingsRepository.h"
 #include "vpnConnection.h"
 #include "ui/controllers/qml/pageController.h"
@@ -22,7 +20,6 @@
 #include "ui/controllers/selfhosted/installUiController.h"
 #include "ui/controllers/importUiController.h"
 #include "ui/controllers/api/subscriptionUiController.h"
-#include "ui/controllers/updateUiController.h"
 #include "ui/models/serversModel.h"
 #include "core/controllers/serversController.h"
 #include "core/controllers/ipSplitTunnelingController.h"
@@ -34,6 +31,7 @@
 #include "core/controllers/connectionController.h"
 #include "ui/models/clientManagementModel.h"
 #include "ui/controllers/api/apiNewsUiController.h"
+#include "ui/models/api/apiCountryModel.h"
 #include "ui/models/containersModel.h"
 #include "core/utils/containerEnum.h"

@@ -66,6 +64,7 @@ void CoreSignalHandlers::initAllHandlers()
    initImportControllerHandler();
    initApiCountryModelUpdateHandler();
    initSubscriptionRefreshHandler();
+    initContainerModelUpdateHandler();
    initAdminConfigRevokedHandler();
    initPassphraseRequestHandler();
    initTranslationsUpdatedHandler();
@@ -78,14 +77,12 @@ void CoreSignalHandlers::initAllHandlers()
    initAllowedDnsModelUpdateHandler();
    initAppSplitTunnelingModelUpdateHandler();
    initPrepareConfigHandler();
-    initUnsupportedConnectDrawerHandler();
    initStrictKillSwitchHandler();
    initAndroidSettingsHandler();
    initAndroidConnectionHandler();
    initIosImportHandler();
    initIosSettingsHandler();
    initNotificationHandler();
-    initUpdateFoundHandler();
 }

 void CoreSignalHandlers::initErrorMessagesHandler()
@@ -125,9 +122,11 @@ void CoreSignalHandlers::initInstallControllerHandler()
 {
    connect(m_coreController->m_installController, &InstallController::serverIsBusy, m_coreController->m_installUiController, &InstallUiController::serverIsBusy);
    connect(m_coreController->m_installUiController, &InstallUiController::cancelInstallation, m_coreController->m_installController, &InstallController::cancelInstallation);
-    connect(m_coreController->m_serversUiController, &ServersUiController::processedServerIdChanged,
-        m_coreController->m_installUiController, [this](const QString &serverId) {
-        if (!serverId.isEmpty()) {
+    connect(m_coreController->m_installUiController, &InstallUiController::currentContainerUpdated, m_coreController->m_connectionUiController,
+            &ConnectionUiController::onCurrentContainerUpdated);
+    connect(m_coreController->m_serversUiController, &ServersUiController::processedServerIndexChanged,
+        m_coreController->m_installUiController, [this](int index) {
+        if (index >= 0) {
            m_coreController->m_installUiController->clearProcessedServerCredentials();
        }
    });
@@ -136,39 +135,32 @@ void CoreSignalHandlers::initInstallControllerHandler()
 void CoreSignalHandlers::initExportControllerHandler()
 {
    connect(m_coreController->m_exportController, &ExportController::appendClientRequested, this,
-            [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->appendClient(serverId, clientId, clientName, container);
+            [this](int serverIndex, const QString &clientId, const QString &clientName, DockerContainer container) {
+                m_coreController->m_usersController->appendClient(serverIndex, clientId, clientName, container);
            });
    connect(m_coreController->m_exportController, &ExportController::updateClientsRequested, this,
-            [this](const QString &serverId, DockerContainer container) {
-                m_coreController->m_usersController->updateClients(serverId, container);
+            [this](int serverIndex, DockerContainer container) {
+                m_coreController->m_usersController->updateClients(serverIndex, container);
            });
    connect(m_coreController->m_exportController, &ExportController::revokeClientRequested, this,
-            [this](const QString &serverId, int row, DockerContainer container) {
-                QtConcurrent::run([this, serverId, row, container]() {
-                    m_coreController->m_usersController->revokeClient(serverId, row, container);
-                });
+            [this](int serverIndex, int row, DockerContainer container) {
+                m_coreController->m_usersController->revokeClient(serverIndex, row, container);
            });
    connect(m_coreController->m_exportController, &ExportController::renameClientRequested, this,
-            [this](const QString &serverId, int row, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->renameClient(serverId, row, clientName, container);
+            [this](int serverIndex, int row, const QString &clientName, DockerContainer container) {
+                m_coreController->m_usersController->renameClient(serverIndex, row, clientName, container);
            });
 }

 void CoreSignalHandlers::initImportControllerHandler()
 {
    connect(m_coreController->m_importCoreController, &ImportController::importFinished, this, [this]() {
-        if (m_coreController->m_connectionUiController->isConnected()) {
-            return;
-        }
-
-        const int newServerIndex = m_coreController->m_serversController->getServersCount() - 1;
-        const QString serverId = m_coreController->m_serversController->getServerId(newServerIndex);
-        if (!serverId.isEmpty()) {
-            m_coreController->m_serversController->setDefaultServer(serverId);
-        }
-        if (m_coreController->m_serversUiController) {
-            m_coreController->m_serversUiController->setProcessedServerId(serverId);
+        if (!m_coreController->m_connectionController->isConnected()) {
+            int newServerIndex = m_coreController->m_serversController->getServersCount() - 1;
+            m_coreController->m_serversController->setDefaultServerIndex(newServerIndex);
+            if (m_coreController->m_serversUiController) {
+                m_coreController->m_serversUiController->setProcessedServerIndex(newServerIndex);
+            }
        }
    });
 }
@@ -176,27 +168,42 @@ void CoreSignalHandlers::initImportControllerHandler()
 void CoreSignalHandlers::initApiCountryModelUpdateHandler()
 {
    connect(m_coreController->m_serversUiController, &ServersUiController::updateApiCountryModel, this, [this]() {
-        const QString processedServerId = m_coreController->m_serversUiController->getProcessedServerId();
-        if (processedServerId.isEmpty()) {
+        int processedIndex = m_coreController->m_serversUiController->getProcessedServerIndex();
+        if (processedIndex < 0 || processedIndex >= m_coreController->m_serversRepository->serversCount()) {
            return;
        }
-
-        const auto apiV2 = m_coreController->m_serversRepository->apiV2Config(processedServerId);
-        if (!apiV2.has_value()) {
-            return;
+        
+        ServerConfig server = m_coreController->m_serversRepository->server(processedIndex);
+        QJsonArray availableCountries;
+        QString serverCountryCode;
+        
+        if (server.isApiV2()) {
+            const ApiV2ServerConfig* apiV2 = server.as<ApiV2ServerConfig>();
+            if (apiV2) {
+                availableCountries = apiV2->apiConfig.availableCountries;
+                serverCountryCode = apiV2->apiConfig.serverCountryCode;
+            }
        }
-
-        m_coreController->m_apiCountryModel->updateModel(apiV2->apiConfig.availableCountries,
-                                                           apiV2->apiConfig.serverCountryCode);
+        
+        m_coreController->m_apiCountryModel->updateModel(availableCountries, serverCountryCode);
    });
 }

 void CoreSignalHandlers::initSubscriptionRefreshHandler()
 {
    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::subscriptionRefreshNeeded, this, [this]() {
-        const QString defaultServerId = m_coreController->m_serversController->getDefaultServerId();
-        if (!defaultServerId.isEmpty()) {
-            m_coreController->m_subscriptionUiController->getAccountInfo(defaultServerId, false);
+        const int defaultServerIndex = m_coreController->m_serversController->getDefaultServerIndex();
+        if (defaultServerIndex >= 0) {
+            m_coreController->m_subscriptionUiController->getAccountInfo(defaultServerIndex, false);
+        }
+    });
+}
+
+void CoreSignalHandlers::initContainerModelUpdateHandler()
+{
+    connect(m_coreController->m_serversController, &ServersController::gatewayStacksExpanded, this, [this]() {
+        if (m_coreController->m_serversUiController->hasServersFromGatewayApi()) {
+            m_coreController->m_apiNewsUiController->fetchNews(false);
        }
    });
 }
@@ -204,17 +211,17 @@ void CoreSignalHandlers::initSubscriptionRefreshHandler()
 void CoreSignalHandlers::initAdminConfigRevokedHandler()
 {
    connect(m_coreController->m_installController, &InstallController::clientRevocationRequested, this,
-            [this](const QString &serverId, const ContainerConfig &containerConfig, DockerContainer container) {
-                m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
-            }, Qt::DirectConnection);
+            [this](int serverIndex, const ContainerConfig &containerConfig, DockerContainer container) {
+                m_coreController->m_usersController->revokeClient(serverIndex, containerConfig, container);
+            });

    connect(m_coreController->m_installController, &InstallController::clientAppendRequested, this,
-            [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->appendClient(serverId, clientId, clientName, container);
-            }, Qt::DirectConnection);
+            [this](int serverIndex, const QString &clientId, const QString &clientName, DockerContainer container) {
+                m_coreController->m_usersController->appendClient(serverIndex, clientId, clientName, container);
+            });

-    connect(m_coreController->m_usersController, &UsersController::adminConfigRevoked, m_coreController->m_installController,
-            &InstallController::clearCachedProfile);
+    connect(m_coreController->m_usersController, &UsersController::adminConfigRevoked, m_coreController->m_serversController,
+            &ServersController::clearCachedProfile);
 }

 void CoreSignalHandlers::initPassphraseRequestHandler()
@@ -238,16 +245,12 @@ void CoreSignalHandlers::initLanguageHandler()
    connect(m_coreController->m_settingsUiController, &SettingsUiController::resetLanguageToSystem, m_coreController->m_languageUiController, [this]() {
        m_coreController->m_languageUiController->changeLanguage(m_coreController->m_languageUiController->getSystemLanguageEnum());
    });
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::appLanguageChanged, m_coreController->m_languageUiController, [this]() {
-        m_coreController->m_languageUiController->onAppLanguageChanged(m_coreController->m_settingsController->getAppLanguage());
-    });
 }

 void CoreSignalHandlers::initAutoConnectHandler()
 {
-    if (m_coreController->m_settingsUiController->isAutoConnectEnabled()
-        && !m_coreController->m_serversController->getDefaultServerId().isEmpty()) {
-        QTimer::singleShot(1000, this, [this]() { m_coreController->m_connectionUiController->toggleConnection(); });
+    if (m_coreController->m_settingsUiController->isAutoConnectEnabled() && m_coreController->m_serversController->getDefaultServerIndex() >= 0) {
+        QTimer::singleShot(1000, this, [this]() { m_coreController->m_connectionUiController->openConnection(); });
    }
 }

@@ -266,20 +269,16 @@ void CoreSignalHandlers::initServersModelUpdateHandler()
            m_coreController->m_serversUiController, &ServersUiController::updateModel);
    connect(m_coreController->m_serversRepository, &SecureServersRepository::defaultServerChanged,
            m_coreController->m_serversUiController, &ServersUiController::onDefaultServerChanged);
-
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverAdded, this,
-            [this](const QString &serverId) {
-                if (m_coreController->m_serversRepository->apiV2Config(serverId).has_value()) {
-                    m_coreController->m_apiNewsUiController->fetchNews(false);
-                }
-            });
-
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::restoreBackupFinished, this, [this]() {
-        m_coreController->m_serversUiController->updateModel();
-        if (m_coreController->m_serversUiController->hasServersFromGatewayApi()) {
-            m_coreController->m_apiNewsUiController->fetchNews(false);
-        }
-    });
+    
+    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverAdded,
+            m_coreController->m_serversController, &ServersController::recomputeGatewayStacks);
+    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverEdited,
+            m_coreController->m_serversController, &ServersController::recomputeGatewayStacks);
+    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved,
+            m_coreController->m_serversController, &ServersController::recomputeGatewayStacks);
+    
+    connect(m_coreController->m_settingsUiController, &SettingsUiController::restoreBackupFinished,
+            m_coreController->m_serversUiController, &ServersUiController::updateModel);
 }

 void CoreSignalHandlers::initClientManagementModelUpdateHandler()
@@ -288,8 +287,6 @@ void CoreSignalHandlers::initClientManagementModelUpdateHandler()
            m_coreController->m_clientManagementModel, &ClientManagementModel::updateModel);
    connect(m_coreController->m_usersController, &UsersController::clientRenamed,
            m_coreController->m_clientManagementModel, &ClientManagementModel::updateClientName);
-    connect(m_coreController->m_usersController, &UsersController::revokeFinished,
-            m_coreController->m_exportController, &ExportController::revokeFinished);
 }

 void CoreSignalHandlers::initSitesModelUpdateHandler()
@@ -316,19 +313,7 @@ void CoreSignalHandlers::initPrepareConfigHandler()
    connect(m_coreController->m_connectionUiController, &ConnectionUiController::prepareConfig, this, [this]() {
        m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Preparing);

-        const QString serverId = m_coreController->m_serversController->getDefaultServerId();
-        if (serverId.isEmpty()) {
-            m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-            return;
-        }
-
-        const serverConfigUtils::ConfigType kind = m_coreController->m_serversRepository->serverKind(serverId);
-
-        if (serverConfigUtils::isApiV2Subscription(kind) || serverConfigUtils::isLegacyApiSubscription(kind)) {
-            m_coreController->m_subscriptionUiController->validateConfig();
-        } else {
-            m_coreController->m_installUiController->validateConfig();
-        }
+        m_coreController->m_subscriptionUiController->validateConfig();
    });

    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::configValidated, this, [this](bool isValid) {
@@ -337,7 +322,7 @@ void CoreSignalHandlers::initPrepareConfigHandler()
            return;
        }

-        m_coreController->m_connectionUiController->openConnection();
+        m_coreController->m_installUiController->validateConfig();
    });

    connect(m_coreController->m_installUiController, &InstallUiController::configValidated, this, [this](bool isValid) {
@@ -350,15 +335,6 @@ void CoreSignalHandlers::initPrepareConfigHandler()
    });
 }

-void CoreSignalHandlers::initUnsupportedConnectDrawerHandler()
-{
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::unsupportedConnectDrawerRequested,
-            m_coreController->m_pageController, &PageController::unsupportedConnectDrawerRequested);
-
-    connect(m_coreController->m_connectionUiController, &ConnectionUiController::unsupportedConnectDrawerRequested,
-            m_coreController->m_pageController, &PageController::unsupportedConnectDrawerRequested);
-}
-
 void CoreSignalHandlers::initStrictKillSwitchHandler()
 {
    connect(m_coreController->m_settingsUiController, &SettingsUiController::strictKillSwitchEnabledChanged, m_coreController->m_connectionController,
@@ -370,10 +346,7 @@ void CoreSignalHandlers::initAndroidSettingsHandler()
 #ifdef Q_OS_ANDROID
    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::saveLogsChanged, AndroidController::instance(), &AndroidController::setSaveLogs);
    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::screenshotsEnabledChanged, AndroidController::instance(), &AndroidController::setScreenshotsEnabled);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved, this,
-            [](const QString &/*serverId*/, int removedIndex) {
-                AndroidController::instance()->resetLastServer(removedIndex);
-            });
+    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved, AndroidController::instance(), &AndroidController::resetLastServer);
    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::settingsCleared, []() { AndroidController::instance()->resetLastServer(-1); });
 #endif
 }
@@ -437,16 +410,3 @@ void CoreSignalHandlers::initNotificationHandler()
 #endif    
 }

-void CoreSignalHandlers::initUpdateFoundHandler()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    connect(m_coreController->m_updateUiController, &UpdateUiController::updateFound, this, [this]() {
-        const QString version = m_coreController->m_updateUiController->getVersion();
-        const QString updateId = version.isEmpty() ? QStringLiteral("update") : QStringLiteral("update-%1").arg(version);
-        m_coreController->m_newsModel->setUpdateNotification(
-                updateId, m_coreController->m_updateUiController->getHeaderText(), m_coreController->m_updateUiController->getChangelogText());
-        emit m_coreController->m_pageController->showChangelogDrawer();
-    });
-#endif
-}
-
--- a/client/core/controllers/coreSignalHandlers.h
+++ b/client/core/controllers/coreSignalHandlers.h
@@ -21,6 +21,7 @@ private:
    void initImportControllerHandler();
    void initApiCountryModelUpdateHandler();
    void initSubscriptionRefreshHandler();
+    void initContainerModelUpdateHandler();
    void initAdminConfigRevokedHandler();
    void initPassphraseRequestHandler();
    void initTranslationsUpdatedHandler();
@@ -33,14 +34,12 @@ private:
    void initAllowedDnsModelUpdateHandler();
    void initAppSplitTunnelingModelUpdateHandler();
    void initPrepareConfigHandler();
-    void initUnsupportedConnectDrawerHandler();
    void initStrictKillSwitchHandler();
    void initAndroidSettingsHandler();
    void initAndroidConnectionHandler();
    void initIosImportHandler();
    void initIosSettingsHandler();
    void initNotificationHandler();
-    void initUpdateFoundHandler();

    CoreController* m_coreController;
 };
--- a/client/core/controllers/gatewayController.cpp
+++ b/client/core/controllers/gatewayController.cpp
@@ -12,14 +12,14 @@
 #include <QPromise>
 #include <QUrl>

-#include <openssl/rsa.h>
+#include "QBlockCipher.h"
+#include "QRsa.h"

 #include "amneziaApplication.h"
-#include "core/repositories/secureAppSettingsRepository.h"
 #include "core/utils/api/apiUtils.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/networkUtilities.h"
-#include "cryptoUtils.h"
+#include "core/utils/utilities.h"

 #ifdef AMNEZIA_DESKTOP
    #include "core/utils/ipcClient.h"
@@ -30,8 +30,6 @@ namespace
    constexpr QLatin1String errorResponsePattern1("No active configuration found for");
    constexpr QLatin1String errorResponsePattern2("No non-revoked public key found for");
    constexpr QLatin1String errorResponsePattern3("Account not found.");
-    constexpr QLatin1String errorResponsePatternQrSessionNotFound("QR session not found");
-    constexpr QLatin1String errorResponsePatternSessionNotFound("Session not found");

    constexpr QLatin1String updateRequestResponsePattern("client version update is required");

@@ -39,81 +37,20 @@ namespace
    constexpr int httpStatusCodeConflict = 409;
    constexpr int httpStatusCodeNotImplemented = 501;
    constexpr int httpStatusCodePaymentRequired = 402;
-    constexpr int httpStatusCodeRequestTimeout = 408;
    constexpr int httpStatusCodeUnprocessableEntity = 422;

    constexpr QLatin1String unprocessableSubscriptionMessage("Failed to retrieve subscription information. Is it activated?");

    constexpr int proxyStorageRequestTimeoutMsecs = 3000;
-
-    QStringList shuffledProxyUrls(const QStringList &proxyUrls)
-    {
-        QStringList shuffled = proxyUrls;
-        std::random_device randomDevice;
-        std::mt19937 generator(randomDevice());
-        std::shuffle(shuffled.begin(), shuffled.end(), generator);
-        return shuffled;
-    }
-
-    QString getProxyUrlsCacheKey(const QString &serviceType, const QString &userCountryCode)
-    {
-        return QStringLiteral("service_%1_country_%2").arg(serviceType, userCountryCode);
-    }
-
-    bool decryptProxyUrlsPayload(const QByteArray &encryptedPayload, bool isDevEnvironment, QByteArray &decryptedPayload)
-    {
-        QByteArray key = isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-        if (!isDevEnvironment) {
-            QCryptographicHash hash(QCryptographicHash::Sha512);
-            hash.addData(key);
-            QByteArray h = hash.result().toHex();
-
-            QByteArray decKey = QByteArray::fromHex(h.left(64));
-            QByteArray iv = QByteArray::fromHex(h.mid(64, 32));
-            QByteArray ba = QByteArray::fromBase64(encryptedPayload);
-
-            decryptedPayload = CryptoUtils::decryptAes256Cbc(ba, decKey, iv);
-            if (decryptedPayload.isEmpty()) {
-                return false;
-            }
-        } else {
-            decryptedPayload = encryptedPayload;
-        }
-        return true;
-    }
-
-    QStringList readCachedProxyUrls(const QByteArray &cachedProxyUrlsEncrypted, bool isDevEnvironment)
-    {
-        if (cachedProxyUrlsEncrypted.isEmpty()) {
-            return {};
-        }
-
-        QByteArray cachedProxyUrlsDecrypted;
-        if (!decryptProxyUrlsPayload(cachedProxyUrlsEncrypted, isDevEnvironment, cachedProxyUrlsDecrypted)) {
-            qCritical() << "error decrypting cached proxy urls payload";
-            return {};
-        }
-
-        QJsonArray endpointsArray = QJsonDocument::fromJson(cachedProxyUrlsDecrypted).array();
-        QStringList endpoints;
-        endpoints.reserve(endpointsArray.size());
-        for (const QJsonValue &endpoint : endpointsArray) {
-            endpoints.push_back(endpoint.toString());
-        }
-
-        return endpoints;
-    }
 }

 GatewayController::GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
-                                     const bool isStrictKillSwitchEnabled, SecureAppSettingsRepository *appSettingsRepository,
-                                     QObject *parent)
+                                     const bool isStrictKillSwitchEnabled, QObject *parent)
    : QObject(parent),
      m_gatewayEndpoint(gatewayEndpoint),
      m_isDevEnvironment(isDevEnvironment),
      m_requestTimeoutMsecs(requestTimeoutMsecs),
-      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled),
-      m_appSettingsRepository(appSettingsRepository)
+      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
 {
 }

@@ -147,29 +84,40 @@ GatewayController::EncryptedRequestData GatewayController::prepareRequest(const
    }
 #endif

-    encRequestData.key = CryptoUtils::generateRandomBytes(32);
-    encRequestData.iv = CryptoUtils::generateRandomBytes(32);
-    encRequestData.salt = CryptoUtils::generateRandomBytes(8);
+    QSimpleCrypto::QBlockCipher blockCipher;
+    encRequestData.key = blockCipher.generatePrivateSalt(32);
+    encRequestData.iv = blockCipher.generatePrivateSalt(32);
+    encRequestData.salt = blockCipher.generatePrivateSalt(8);

    QJsonObject keyPayload;
    keyPayload[apiDefs::key::aesKey] = QString(encRequestData.key.toBase64());
    keyPayload[apiDefs::key::aesIv] = QString(encRequestData.iv.toBase64());
    keyPayload[apiDefs::key::aesSalt] = QString(encRequestData.salt.toBase64());

-    QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-    EVP_PKEY *publicKey = CryptoUtils::loadPublicKeyFromPem(rsaKey);
-    if (publicKey == nullptr) {
-        qCritical() << "error loading public key from environment variables";
-        encRequestData.errorCode = ErrorCode::ApiMissingAgwPublicKey;
-        return encRequestData;
-    }
+    QByteArray encryptedKeyPayload;
+    QByteArray encryptedApiPayload;
+    try {
+        QSimpleCrypto::QRsa rsa;

-    QByteArray encryptedKeyPayload = CryptoUtils::rsaEncrypt(QJsonDocument(keyPayload).toJson(), publicKey, RSA_PKCS1_PADDING);
-    EVP_PKEY_free(publicKey);
+        EVP_PKEY *publicKey = nullptr;
+        try {
+            QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+            QSimpleCrypto::QRsa rsa;
+            publicKey = rsa.getPublicKeyFromByteArray(rsaKey);
+        } catch (...) {
+            Utils::logException();
+            qCritical() << "error loading public key from environment variables";
+            encRequestData.errorCode = ErrorCode::ApiMissingAgwPublicKey;
+            return encRequestData;
+        }

-    QByteArray encryptedApiPayload = CryptoUtils::encryptAes256Cbc(QJsonDocument(apiPayload).toJson(), encRequestData.key, encRequestData.iv);
+        encryptedKeyPayload = rsa.encrypt(QJsonDocument(keyPayload).toJson(), publicKey, RSA_PKCS1_PADDING);
+        EVP_PKEY_free(publicKey);

-    if (encryptedKeyPayload.isEmpty() || encryptedApiPayload.isEmpty()) {
+        encryptedApiPayload = blockCipher.encryptAesBlockCipher(QJsonDocument(apiPayload).toJson(), encRequestData.key, encRequestData.iv,
+                                                                "", encRequestData.salt);
+    } catch (...) {
+        Utils::logException();
        qCritical() << "error when encrypting the request body";
        encRequestData.errorCode = ErrorCode::ApiConfigDecryptionError;
        return encRequestData;
@@ -191,11 +139,11 @@ GatewayController::DecryptionResult GatewayController::tryDecryptResponseBody(co
    result.decryptedBody = encryptedResponseBody;
    result.isDecryptionSuccessful = false;

-    QByteArray decrypted = CryptoUtils::decryptAes256Cbc(encryptedResponseBody, key, iv);
-    if (!decrypted.isEmpty()) {
-        result.decryptedBody = decrypted;
+    try {
+        QSimpleCrypto::QBlockCipher blockCipher;
+        result.decryptedBody = blockCipher.decryptAesBlockCipher(encryptedResponseBody, key, iv, "", salt);
        result.isDecryptionSuccessful = true;
-    } else {
+    } catch (...) {
        result.decryptedBody = encryptedResponseBody;
        result.isDecryptionSuccessful = false;
    }
@@ -258,9 +206,8 @@ ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject api
        bypassProxy(endpoint, serviceType, userCountryCode, requestFunction, replyProcessingFunction);
    }

-    responseBody = decryptionResult.decryptedBody;
-    const auto errorCode =
-            apiUtils::checkNetworkReplyErrors(sslErrors, replyErrorString, replyError, httpStatusCode, responseBody);
+    auto errorCode =
+            apiUtils::checkNetworkReplyErrors(sslErrors, replyErrorString, replyError, httpStatusCode, decryptionResult.decryptedBody);
    if (errorCode) {
        return errorCode;
    }
@@ -270,6 +217,7 @@ ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject api
        return ErrorCode::ApiConfigDecryptionError;
    }

+    responseBody = decryptionResult.decryptedBody;
    return ErrorCode::NoError;
 }

@@ -291,7 +239,7 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString

    connect(reply, &QNetworkReply::sslErrors, [sslErrors](const QList<QSslError> &errors) { *sslErrors = errors; });

-    connect(reply, &QNetworkReply::finished, this, [promise, sslErrors, encRequestData, endpoint, apiPayload, reply, this]() mutable {
+    connect(reply, &QNetworkReply::finished, reply, [promise, sslErrors, encRequestData, endpoint, apiPayload, reply, this]() mutable {
        QByteArray encryptedResponseBody = reply->readAll();
        QString replyErrorString = reply->errorString();
        auto replyError = reply->error();
@@ -308,12 +256,13 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
            auto errorCode = apiUtils::checkNetworkReplyErrors(sslErrors, replyErrorString, replyError, httpStatusCode,
                                                               decryptionResult.decryptedBody);
            if (errorCode) {
-                promise->addResult(qMakePair(errorCode, decryptionResult.decryptedBody));
+                promise->addResult(qMakePair(errorCode, QByteArray()));
                promise->finish();
                return;
            }

            if (!decryptionResult.isDecryptionSuccessful) {
+                Utils::logException();
                qCritical() << "error when decrypting the request body";
                promise->addResult(qMakePair(ErrorCode::ApiConfigDecryptionError, QByteArray()));
                promise->finish();
@@ -356,9 +305,8 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
            QStringList proxyStorageUrls;
            appendStorageUrls(primaryBaseUrls, proxyStorageUrls);
            appendStorageUrls(fallbackBaseUrls, proxyStorageUrls);
-            const QString proxyUrlsCacheKey = getProxyUrlsCacheKey(serviceType, userCountryCode);

-            getProxyUrlsAsync(proxyStorageUrls, 0, proxyUrlsCacheKey, [this, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
+            getProxyUrlsAsync(proxyStorageUrls, 0, [this, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
                getProxyUrlAsync(proxyUrls, 0, [this, encRequestData, endpoint, processResponse](const QString &proxyUrl) {
                    bypassProxyAsync(endpoint, proxyUrl, encRequestData,
                                     [processResponse, this](const QByteArray &decryptedBody, bool isDecryptionSuccessful,
@@ -404,6 +352,8 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
    std::shuffle(primaryBaseUrls.begin(), primaryBaseUrls.end(), generator);
    std::shuffle(fallbackBaseUrls.begin(), fallbackBaseUrls.end(), generator);

+    QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+
    auto appendStorageUrls = [&serviceType, &userCountryCode](const QStringList &baseUrls, QStringList &target) {
        if (!serviceType.isEmpty()) {
            for (const auto &baseUrl : baseUrls) {
@@ -419,12 +369,10 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
    QStringList proxyStorageUrls;
    appendStorageUrls(primaryBaseUrls, proxyStorageUrls);
    appendStorageUrls(fallbackBaseUrls, proxyStorageUrls);
-    const QString proxyUrlsCacheKey = getProxyUrlsCacheKey(serviceType, userCountryCode);
-    const QByteArray cachedProxyUrlsEncrypted = m_appSettingsRepository->readGatewayProxyUrls(proxyUrlsCacheKey);

    if (proxyStorageUrls.empty()) {
        qDebug() << "empty storage endpoint list";
-        return readCachedProxyUrls(cachedProxyUrlsEncrypted, m_isDevEnvironment);
+        return {};
    }

    for (const auto &proxyStorageUrl : proxyStorageUrls) {
@@ -439,8 +387,26 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
            auto encryptedResponseBody = reply->readAll();
            reply->deleteLater();

+            EVP_PKEY *privateKey = nullptr;
            QByteArray responseBody;
-            if (!decryptProxyUrlsPayload(encryptedResponseBody, m_isDevEnvironment, responseBody)) {
+            try {
+                if (!m_isDevEnvironment) {
+                    QCryptographicHash hash(QCryptographicHash::Sha512);
+                    hash.addData(key);
+                    QByteArray hashResult = hash.result().toHex();
+
+                    QByteArray key = QByteArray::fromHex(hashResult.left(64));
+                    QByteArray iv = QByteArray::fromHex(hashResult.mid(64, 32));
+
+                    QByteArray ba = QByteArray::fromBase64(encryptedResponseBody);
+
+                    QSimpleCrypto::QBlockCipher blockCipher;
+                    responseBody = blockCipher.decryptAesBlockCipher(ba, key, iv);
+                } else {
+                    responseBody = encryptedResponseBody;
+                }
+            } catch (...) {
+                Utils::logException();
                qCritical() << "error loading private key from environment variables or decrypting payload" << encryptedResponseBody;
                continue;
            }
@@ -451,8 +417,6 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
            for (const auto &endpoint : endpointsArray) {
                endpoints.push_back(endpoint.toString());
            }
-            m_appSettingsRepository->writeGatewayProxyUrls(proxyUrlsCacheKey, encryptedResponseBody);
-
            return endpoints;
        } else {
            auto replyError = reply->error();
@@ -464,7 +428,7 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
            reply->deleteLater();
        }
    }
-    return readCachedProxyUrls(cachedProxyUrlsEncrypted, m_isDevEnvironment);
+    return {};
 }

 bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &replyError, const QByteArray &decryptedResponseBody,
@@ -495,19 +459,15 @@ bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &rep
        qDebug() << "the response contains an html tag";
        return true;
    } 
-    if (apiHttpStatus == httpStatusCodeRequestTimeout) {
-        return false;
-    }
    if (apiHttpStatus == httpStatusCodeNotFound) {
        if (responseBody.contains(errorResponsePattern1) || responseBody.contains(errorResponsePattern2)
-            || responseBody.contains(errorResponsePattern3) || responseBody.contains(errorResponsePatternQrSessionNotFound)
-            || responseBody.contains(errorResponsePatternSessionNotFound)) {
+            || responseBody.contains(errorResponsePattern3)) {
            return false;
        } else {
            qDebug() << replyError;
            return true;
        }
-    }
+    } 
    if (apiHttpStatus == httpStatusCodeNotImplemented) {
        if (responseBody.contains(updateRequestResponsePattern)) {
            return false;
@@ -606,12 +566,10 @@ void GatewayController::bypassProxy(const QString &endpoint, const QString &serv
 }

 void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
-                                          const QString &proxyUrlsCacheKey, std::function<void(const QStringList &)> onComplete)
+                                          std::function<void(const QStringList &)> onComplete)
 {
-    const QByteArray cachedProxyUrlsEncrypted = m_appSettingsRepository->readGatewayProxyUrls(proxyUrlsCacheKey);
-
    if (currentProxyStorageIndex >= proxyStorageUrls.size()) {
-        onComplete(shuffledProxyUrls(readCachedProxyUrls(cachedProxyUrlsEncrypted, m_isDevEnvironment)));
+        onComplete({});
        return;
    }

@@ -624,17 +582,33 @@ void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, co

    // connect(reply, &QNetworkReply::sslErrors, this, [state](const QList<QSslError> &e) { *(state->sslErrors) = e; });

-    connect(reply, &QNetworkReply::finished, this,
-            [this, proxyStorageUrls, currentProxyStorageIndex, proxyUrlsCacheKey, onComplete, reply]() {
+    connect(reply, &QNetworkReply::finished, this, [this, proxyStorageUrls, currentProxyStorageIndex, onComplete, reply]() {
        if (reply->error() == QNetworkReply::NoError) {
            QByteArray encrypted = reply->readAll();
            reply->deleteLater();

            QByteArray responseBody;
-            if (!decryptProxyUrlsPayload(encrypted, m_isDevEnvironment, responseBody)) {
+            try {
+                QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+                if (!m_isDevEnvironment) {
+                    QCryptographicHash hash(QCryptographicHash::Sha512);
+                    hash.addData(key);
+                    QByteArray h = hash.result().toHex();
+
+                    QByteArray decKey = QByteArray::fromHex(h.left(64));
+                    QByteArray iv = QByteArray::fromHex(h.mid(64, 32));
+                    QByteArray ba = QByteArray::fromBase64(encrypted);
+
+                    QSimpleCrypto::QBlockCipher cipher;
+                    responseBody = cipher.decryptAesBlockCipher(ba, decKey, iv);
+                } else {
+                    responseBody = encrypted;
+                }
+            } catch (...) {
+                Utils::logException();
                qCritical() << "error decrypting payload";
                QMetaObject::invokeMethod(
-                        this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, proxyUrlsCacheKey, onComplete); }, Qt::QueuedConnection);
+                        this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
                return;
            }

@@ -642,9 +616,13 @@ void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, co
            QStringList endpoints;
            for (const QJsonValue &endpoint : endpointsArray)
                endpoints.push_back(endpoint.toString());
-            m_appSettingsRepository->writeGatewayProxyUrls(proxyUrlsCacheKey, encrypted);

-            onComplete(shuffledProxyUrls(endpoints));
+            QStringList shuffled = endpoints;
+            std::random_device randomDevice;
+            std::mt19937 generator(randomDevice());
+            std::shuffle(shuffled.begin(), shuffled.end(), generator);
+
+            onComplete(shuffled);
            return;
        }

@@ -653,7 +631,7 @@ void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, co
        qDebug() << "go to the next storage endpoint";
        reply->deleteLater();
        QMetaObject::invokeMethod(
-                this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, proxyUrlsCacheKey, onComplete); }, Qt::QueuedConnection);
+                this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
    });
 }

--- a/client/core/controllers/gatewayController.h
+++ b/client/core/controllers/gatewayController.h
@@ -16,16 +16,13 @@
    #include "platforms/ios/ios_controller.h"
 #endif

-class SecureAppSettingsRepository;
-
 class GatewayController : public QObject
 {
    Q_OBJECT

 public:
    explicit GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
-                               const bool isStrictKillSwitchEnabled, SecureAppSettingsRepository *appSettingsRepository,
-                               QObject *parent = nullptr);
+                               const bool isStrictKillSwitchEnabled, QObject *parent = nullptr);

    amnezia::ErrorCode post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody);
    QFuture<QPair<amnezia::ErrorCode, QByteArray>> postAsync(const QString &endpoint, const QJsonObject apiPayload);
@@ -58,7 +55,7 @@ private:
                     std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction);

    void getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
-                           const QString &proxyUrlsCacheKey, std::function<void(const QStringList &)> onComplete);
+                           std::function<void(const QStringList &)> onComplete);
    void getProxyUrlAsync(const QStringList proxyUrls, const int currentProxyIndex, std::function<void(const QString &)> onComplete);
    void bypassProxyAsync(
            const QString &endpoint, const QString &proxyUrl, EncryptedRequestData encRequestData,
@@ -68,7 +65,6 @@ private:
    QString m_gatewayEndpoint;
    bool m_isDevEnvironment = false;
    bool m_isStrictKillSwitchEnabled = false;
-    SecureAppSettingsRepository *m_appSettingsRepository = nullptr;

    inline static QString m_proxyUrl;
 };
--- a/client/core/controllers/ipSplitTunnelingController.cpp
+++ b/client/core/controllers/ipSplitTunnelingController.cpp
@@ -1,7 +1,6 @@
 #include "ipSplitTunnelingController.h"
 #include "core/utils/networkUtilities.h"
 #include <QJsonObject>
-#include <QDebug>

 IpSplitTunnelingController::IpSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository, QObject* parent)
    : QObject(parent),
@@ -15,56 +14,47 @@ IpSplitTunnelingController::IpSplitTunnelingController(SecureAppSettingsReposito
    fillSites();
 }

-bool IpSplitTunnelingController::addSiteInternal(const QString &hostname, const QStringList &ips)
+bool IpSplitTunnelingController::addSiteInternal(const QString &hostname, const QString &ip)
 {
    QVariantMap existing = m_appSettingsRepository->vpnSites(m_currentRouteMode);
-    if (existing.contains(hostname) && ips.isEmpty()) {
+    if (existing.contains(hostname) && ip.isEmpty()) {
        return false;
    }

    for (int i = 0; i < m_sites.size(); i++) {
-        if (m_sites[i].first == hostname) {
-            bool changed = false;
-            for (const QString &ip : ips) {
-                if (!ip.isEmpty() && !m_sites[i].second.contains(ip)) {
-                    m_sites[i].second.append(ip);
-                    changed = true;
-                }
-            }
-            if (!changed) {
-                return false;
-            }
-            m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ips);
+        if (m_sites[i].first == hostname && (m_sites[i].second.isEmpty() && !ip.isEmpty())) {
+            m_sites[i].second = ip;
+            m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ip);
            return true;
+        } else if (m_sites[i].first == hostname && (m_sites[i].second == ip)) {
+            return false;
        }
    }
-    m_sites.append(qMakePair(hostname, ips));
-    m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ips);
+    m_sites.append(qMakePair(hostname, ip));
+    m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ip);
    return true;
 }

-void IpSplitTunnelingController::addSites(const QMap<QString, QStringList> &sites, bool replaceExisting)
+void IpSplitTunnelingController::addSites(const QMap<QString, QString> &sites, bool replaceExisting)
 {
    if (replaceExisting) {
        m_sites.clear();
    }
    for (auto it = sites.constBegin(); it != sites.constEnd(); ++it) {
        const QString &hostname = it.key();
-        const QStringList &ips = it.value();
+        const QString &ip = it.value();
        bool found = false;
        for (int i = 0; i < m_sites.size(); i++) {
            if (m_sites[i].first == hostname) {
-                for (const QString &ip : ips) {
-                    if (!ip.isEmpty() && !m_sites[i].second.contains(ip)) {
-                        m_sites[i].second.append(ip);
-                    }
+                if (!ip.isEmpty()) {
+                    m_sites[i].second = ip;
                }
                found = true;
                break;
            }
        }
        if (!found) {
-            m_sites.append(qMakePair(hostname, ips));
+            m_sites.append(qMakePair(hostname, ip));
        }
    }
    if (replaceExisting) {
@@ -82,11 +72,11 @@ bool IpSplitTunnelingController::addSite(const QString &hostname)
    }
    
    if (NetworkUtilities::ipAddressWithSubnetRegExp().exactMatch(normalizedHostname)) {
-        processSite(normalizedHostname, {});
+        processSite(normalizedHostname, "");
        return true;
    }
    
-    if (addSiteInternal(normalizedHostname, {})) {
+    if (addSiteInternal(normalizedHostname, "")) {
        QHostInfo::lookupHost(normalizedHostname, this, SLOT(onHostResolved(QHostInfo)));
        return true;
    }
@@ -134,7 +124,7 @@ bool IpSplitTunnelingController::isSplitTunnelingEnabled() const
    return m_appSettingsRepository->isSitesSplitTunnelingEnabled();
 }

-QVector<QPair<QString, QStringList>> IpSplitTunnelingController::getCurrentSites() const
+QVector<QPair<QString, QString>> IpSplitTunnelingController::getCurrentSites() const
 {
    return m_sites;
 }
@@ -144,7 +134,7 @@ void IpSplitTunnelingController::fillSites()
    QVariantMap sitesMap = m_appSettingsRepository->vpnSites(m_currentRouteMode);
    m_sites.clear();
    for (auto it = sitesMap.begin(); it != sitesMap.end(); ++it) {
-        m_sites.append(qMakePair(it.key(), SecureAppSettingsRepository::siteIpList(it.value())));
+        m_sites.append(qMakePair(it.key(), it.value().toString()));
    }
 }

@@ -174,40 +164,29 @@ void IpSplitTunnelingController::onHostResolved(const QHostInfo &hostInfo)
 {
    const QList<QHostAddress> &addresses = hostInfo.addresses();
    QString hostname = hostInfo.hostName();
-
-    QStringList allIpv4;
+    
    for (const QHostAddress &addr : addresses) {
        if (addr.protocol() == QAbstractSocket::NetworkLayerProtocol::IPv4Protocol) {
-            allIpv4.append(addr.toString());
-        }
-    }
-    allIpv4.removeDuplicates();
-    qDebug() << "[SplitTunneling] Host resolved:" << hostname
-             << "-> adding all IPv4 addresses to list:" << allIpv4;
-
-    if (!allIpv4.isEmpty()) {
-        processSiteAfterResolve(hostname, allIpv4);
-    }
-}
-
-void IpSplitTunnelingController::processSiteAfterResolve(const QString &hostname, const QStringList &ips)
-{
-    for (int i = 0; i < m_sites.size(); i++) {
-        if (m_sites[i].first == hostname) {
-            for (const QString &ip : ips) {
-                if (!ip.isEmpty() && !m_sites[i].second.contains(ip)) {
-                    m_sites[i].second.append(ip);
-                }
-            }
+            processSiteAfterResolve(hostname, addr.toString());
            break;
        }
    }
-    m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ips);
 }

-void IpSplitTunnelingController::processSite(const QString &hostname, const QStringList &ips)
+void IpSplitTunnelingController::processSiteAfterResolve(const QString &hostname, const QString &ip)
 {
-    addSiteInternal(hostname, ips);
+    for (int i = 0; i < m_sites.size(); i++) {
+        if (m_sites[i].first == hostname && m_sites[i].second.isEmpty()) {
+            m_sites[i].second = ip;
+            m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ip);
+            break;
+        }
+    }
+}
+
+void IpSplitTunnelingController::processSite(const QString &hostname, const QString &ip)
+{
+    addSiteInternal(hostname, ip);
 }

 bool IpSplitTunnelingController::importSitesFromJson(const QByteArray& jsonData, bool replaceExisting, QString &errorMessage)
@@ -226,25 +205,12 @@ bool IpSplitTunnelingController::importSitesFromJson(const QByteArray& jsonData,
    }
    
    QJsonArray jsonArray = jsonDocument.array();
-    QMap<QString, QStringList> sites;
+    QMap<QString, QString> sites;
    
    for (auto jsonValue : jsonArray) {
        QJsonObject jsonObject = jsonValue.toObject();
        QString hostname = jsonObject.value("hostname").toString("");
-
-        QStringList ips;
-        if (jsonObject.value("ips").isArray()) {
-            const QJsonArray ipsArray = jsonObject.value("ips").toArray();
-            for (const auto &ipValue : ipsArray) {
-                ips.append(ipValue.toString());
-            }
-        }
-        const QString singleIp = jsonObject.value("ip").toString("");
-        if (!singleIp.isEmpty()) {
-            ips.append(singleIp);
-        }
-        ips.removeAll(QString());
-        ips.removeDuplicates();
+        QString ip = jsonObject.value("ip").toString("");
        
        QString normalizedHostname = normalizeHostname(hostname);
        
@@ -253,7 +219,7 @@ bool IpSplitTunnelingController::importSitesFromJson(const QByteArray& jsonData,
            continue;
        }
        
-        sites.insert(normalizedHostname, ips);
+        sites.insert(normalizedHostname, ip);
    }
    
    addSites(sites, replaceExisting);
@@ -263,21 +229,13 @@ bool IpSplitTunnelingController::importSitesFromJson(const QByteArray& jsonData,

 QByteArray IpSplitTunnelingController::exportSitesToJson() const
 {
-    QVector<QPair<QString, QStringList>> sites = getCurrentSites();
+    QVector<QPair<QString, QString>> sites = getCurrentSites();
    QJsonArray jsonArray;
    
    for (const auto &site : sites) {
        QJsonObject jsonObject;
        jsonObject["hostname"] = site.first;
-
-        QJsonArray ipsArray;
-        for (const QString &ip : site.second) {
-            ipsArray.append(ip);
-        }
-        jsonObject["ips"] = ipsArray;
-        // Keep the legacy "ip" field (first address) for backward compatibility.
-        jsonObject["ip"] = site.second.isEmpty() ? QString() : site.second.first();
-
+        jsonObject["ip"] = site.second;
        jsonArray.append(jsonObject);
    }
    
--- a/client/core/controllers/ipSplitTunnelingController.h
+++ b/client/core/controllers/ipSplitTunnelingController.h
@@ -25,7 +25,7 @@ public:
    explicit IpSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository, QObject* parent = nullptr);

    bool addSite(const QString &hostname);
-    void addSites(const QMap<QString, QStringList> &sites, bool replaceExisting);
+    void addSites(const QMap<QString, QString> &sites, bool replaceExisting);
    bool removeSite(const QString &hostname);
    void removeSites();
    void setRouteMode(RouteMode routeMode);
@@ -33,7 +33,7 @@ public:

    RouteMode getRouteMode() const;
    bool isSplitTunnelingEnabled() const;
-    QVector<QPair<QString, QStringList>> getCurrentSites() const;
+    QVector<QPair<QString, QString>> getCurrentSites() const;

    bool importSitesFromJson(const QByteArray& jsonData, bool replaceExisting, QString &errorMessage);
    QByteArray exportSitesToJson() const;
@@ -43,15 +43,15 @@ private slots:

 private:
    void fillSites();
-    bool addSiteInternal(const QString &hostname, const QStringList &ips);
+    bool addSiteInternal(const QString &hostname, const QString &ip);
    QString normalizeHostname(const QString &hostname) const;
    bool validateHostname(const QString &hostname) const;
-    void processSiteAfterResolve(const QString &hostname, const QStringList &ips);
-    void processSite(const QString &hostname, const QStringList &ips);
+    void processSiteAfterResolve(const QString &hostname, const QString &ip);
+    void processSite(const QString &hostname, const QString &ip);

    SecureAppSettingsRepository* m_appSettingsRepository;
    RouteMode m_currentRouteMode;
-    QVector<QPair<QString, QStringList>> m_sites;
+    QVector<QPair<QString, QString>> m_sites;
 };

 #endif // IPSPLITTUNNELINGCONTROLLER_H
--- a/client/core/controllers/selfhosted/exportController.cpp
+++ b/client/core/controllers/selfhosted/exportController.cpp
@@ -5,13 +5,14 @@

 #include "core/configurators/configuratorBase.h"
 #include "core/utils/selfhosted/sshSession.h"
+#include "core/utils/networkUtilities.h"
 #include "core/utils/qrCodeUtils.h"
 #include "core/utils/serialization/serialization.h"
 #include "core/utils/protocolEnum.h"
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
-#include "core/models/selfhosted/selfHostedAdminServerConfig.h"
+#include "core/models/serverConfig.h"
 #include "core/models/containerConfig.h"
 #include "core/models/protocolConfig.h"

@@ -26,20 +27,18 @@ ExportController::ExportController(SecureServersRepository* serversRepository,
 {
 }

-ExportController::ExportResult ExportController::generateFullAccessConfig(const QString &serverId)
+ExportController::ExportResult ExportController::generateFullAccessConfig(int serverIndex)
 {
    ExportResult result;

-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    for (auto it = adminConfig->containers.begin(); it != adminConfig->containers.end(); ++it) {
-        it.value().protocolConfig.clearClientConfig();
-    }
+    ServerConfig serverConfig = m_serversRepository->server(serverIndex);
+    serverConfig.visit([](auto& arg) {
+        for (auto it = arg.containers.begin(); it != arg.containers.end(); ++it) {
+            it.value().protocolConfig.clearClientConfig();
+        }
+    });

-    QJsonObject serverJson = adminConfig->toJson();
+    QJsonObject serverJson = serverConfig.toJson();
    QByteArray compressedConfig = QJsonDocument(serverJson).toJson();
    compressedConfig = qCompress(compressedConfig, 8);
    result.config = generateVpnUrl(compressedConfig);
@@ -48,22 +47,13 @@ ExportController::ExportResult ExportController::generateFullAccessConfig(const
    return result;
 }

-ExportController::ExportResult ExportController::generateConnectionConfig(const QString &serverId, int containerIndex, const QString &clientName)
+ExportController::ExportResult ExportController::generateConnectionConfig(int serverIndex, int containerIndex, const QString &clientName)
 {
    ExportResult result;

    DockerContainer container = static_cast<DockerContainer>(containerIndex);
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    const ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    ContainerConfig containerConfig = adminConfig->containerConfig(container);
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);
+    ContainerConfig containerConfig = m_serversRepository->containerConfig(serverIndex, container);

    if (ContainerUtils::containerService(container) != ServiceType::Other) {
        SshSession sshSession;
@@ -84,25 +74,35 @@ ExportController::ExportResult ExportController::generateConnectionConfig(const
        
        QString clientId = newProtocolConfig.clientId();
        if (!clientId.isEmpty()) {
-            emit appendClientRequested(serverId, clientId, clientName, container);
+            emit appendClientRequested(serverIndex, clientId, clientName, container);
        }
    }

-    const QPair<QString, QString> dns = adminConfig->getDnsPair(m_appSettingsRepository->useAmneziaDns(),
-                                                               m_appSettingsRepository->primaryDns(),
-                                                               m_appSettingsRepository->secondaryDns());
+    ServerConfig serverConfig = m_serversRepository->server(serverIndex);
+    serverConfig.visit([container, containerConfig](auto& arg) {
+        arg.containers.clear();
+        arg.containers[container] = containerConfig;
+        arg.defaultContainer = container;
+    });

-    adminConfig->containers.clear();
-    adminConfig->containers[container] = containerConfig;
-    adminConfig->defaultContainer = container;
-    adminConfig->userName.clear();
-    adminConfig->password.clear();
-    adminConfig->port = 0;
+    if (serverConfig.isSelfHosted()) {
+        SelfHostedServerConfig* selfHosted = serverConfig.as<SelfHostedServerConfig>();
+        if (selfHosted) {
+            selfHosted->userName.reset();
+            selfHosted->password.reset();
+            selfHosted->port.reset();
+        }
+    }

-    adminConfig->dns1 = dns.first;
-    adminConfig->dns2 = dns.second;
+    auto dns = serverConfig.getDnsPair(m_appSettingsRepository->useAmneziaDns(),
+                                       m_appSettingsRepository->primaryDns(),
+                                       m_appSettingsRepository->secondaryDns());
+    serverConfig.visit([&dns](auto& arg) {
+        arg.dns1 = dns.first;
+        arg.dns2 = dns.second;
+    });

-    QJsonObject serverJson = adminConfig->toJson();
+    QJsonObject serverJson = serverConfig.toJson();
    QByteArray compressedConfig = QJsonDocument(serverJson).toJson();
    compressedConfig = qCompress(compressedConfig, 8);
    result.config = generateVpnUrl(compressedConfig);
@@ -111,7 +111,7 @@ ExportController::ExportResult ExportController::generateConnectionConfig(const
    return result;
 }

-ExportController::NativeConfigResult ExportController::generateNativeConfig(const QString &serverId, DockerContainer container,
+ExportController::NativeConfigResult ExportController::generateNativeConfig(int serverIndex, DockerContainer container,
                                                                             const ContainerConfig &containerConfig,
                                                                             const QString &clientName)
 {
@@ -123,19 +123,11 @@ ExportController::NativeConfigResult ExportController::generateNativeConfig(cons

    Proto protocol = ContainerUtils::defaultProtocol(container);

-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    const ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    const QPair<QString, QString> dns = adminConfig->getDnsPair(m_appSettingsRepository->useAmneziaDns(),
-                                                                m_appSettingsRepository->primaryDns(),
-                                                                m_appSettingsRepository->secondaryDns());
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);
+    ServerConfig serverConfig = m_serversRepository->server(serverIndex);
+    auto dns = serverConfig.getDnsPair(m_appSettingsRepository->useAmneziaDns(),
+                                       m_appSettingsRepository->primaryDns(),
+                                       m_appSettingsRepository->secondaryDns());

    ContainerConfig modifiedContainerConfig = containerConfig;
    modifiedContainerConfig.container = container;
@@ -165,25 +157,20 @@ ExportController::NativeConfigResult ExportController::generateNativeConfig(cons
    if (protocol == Proto::OpenVpn || protocol == Proto::WireGuard || protocol == Proto::Awg || protocol == Proto::Xray) {
        QString clientId = newProtocolConfig.clientId();
        if (!clientId.isEmpty()) {
-            emit appendClientRequested(serverId, clientId, clientName, container);
+            emit appendClientRequested(serverIndex, clientId, clientName, container);
        }
    }
    return result;
 }

-ExportController::ExportResult ExportController::generateOpenVpnConfig(const QString &serverId, const QString &clientName)
+ExportController::ExportResult ExportController::generateOpenVpnConfig(int serverIndex, const QString &clientName)
 {
    ExportResult result;

    DockerContainer container = DockerContainer::OpenVpn;
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    ContainerConfig containerConfig = adminConfig->containerConfig(container);
+    ContainerConfig containerConfig = m_serversRepository->containerConfig(serverIndex, container);

-    auto nativeResult = generateNativeConfig(serverId, container, containerConfig, clientName);
+    auto nativeResult = generateNativeConfig(serverIndex, container, containerConfig, clientName);
    if (nativeResult.errorCode != ErrorCode::NoError) {
        result.errorCode = nativeResult.errorCode;
        return result;
@@ -198,18 +185,13 @@ ExportController::ExportResult ExportController::generateOpenVpnConfig(const QSt
    return result;
 }

-ExportController::ExportResult ExportController::generateWireGuardConfig(const QString &serverId, const QString &clientName)
+ExportController::ExportResult ExportController::generateWireGuardConfig(int serverIndex, const QString &clientName)
 {
    ExportResult result;

-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    ContainerConfig containerConfig = adminConfig->containerConfig(DockerContainer::WireGuard);
+    ContainerConfig containerConfig = m_serversRepository->containerConfig(serverIndex, DockerContainer::WireGuard);

-    auto nativeResult = generateNativeConfig(serverId, DockerContainer::WireGuard, containerConfig, clientName);
+    auto nativeResult = generateNativeConfig(serverIndex, DockerContainer::WireGuard, containerConfig, clientName);
    if (nativeResult.errorCode != ErrorCode::NoError) {
        result.errorCode = nativeResult.errorCode;
        return result;
@@ -224,7 +206,7 @@ ExportController::ExportResult ExportController::generateWireGuardConfig(const Q
    return result;
 }

-ExportController::ExportResult ExportController::generateAwgConfig(const QString &serverId, int containerIndex, const QString &clientName)
+ExportController::ExportResult ExportController::generateAwgConfig(int serverIndex, int containerIndex, const QString &clientName)
 {
    ExportResult result;

@@ -233,14 +215,9 @@ ExportController::ExportResult ExportController::generateAwgConfig(const QString
        result.errorCode = ErrorCode::InternalError;
        return result;
    }
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    ContainerConfig containerConfig = adminConfig->containerConfig(container);
+    ContainerConfig containerConfig = m_serversRepository->containerConfig(serverIndex, container);

-    auto nativeResult = generateNativeConfig(serverId, container, containerConfig, clientName);
+    auto nativeResult = generateNativeConfig(serverIndex, container, containerConfig, clientName);
    if (nativeResult.errorCode != ErrorCode::NoError) {
        result.errorCode = nativeResult.errorCode;
        return result;
@@ -256,18 +233,13 @@ ExportController::ExportResult ExportController::generateAwgConfig(const QString
 }


-ExportController::ExportResult ExportController::generateXrayConfig(const QString &serverId, const QString &clientName)
+ExportController::ExportResult ExportController::generateXrayConfig(int serverIndex, const QString &clientName)
 {
    ExportResult result;

-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        result.errorCode = ErrorCode::InternalError;
-        return result;
-    }
-    ContainerConfig containerConfig = adminConfig->containerConfig(DockerContainer::Xray);
+    ContainerConfig containerConfig = m_serversRepository->containerConfig(serverIndex, DockerContainer::Xray);

-    auto nativeResult = generateNativeConfig(serverId, DockerContainer::Xray, containerConfig, clientName);
+    auto nativeResult = generateNativeConfig(serverIndex, DockerContainer::Xray, containerConfig, clientName);
    if (nativeResult.errorCode != ErrorCode::NoError) {
        result.errorCode = nativeResult.errorCode;
        return result;
@@ -323,18 +295,6 @@ ExportController::ExportResult ExportController::generateXrayConfig(const QStrin
        vlessServer.shortId = realitySettings.value(amnezia::protocols::xray::shortId).toString();
        vlessServer.fingerprint = realitySettings.value(amnezia::protocols::xray::fingerprint).toString("chrome");
        vlessServer.spiderX = realitySettings.value(amnezia::protocols::xray::spiderX).toString("");
-    } else if (vlessServer.security == "tls") {
-        QJsonObject tlsSettings = streamSettings.value("tlsSettings").toObject();
-        vlessServer.serverName = tlsSettings.value(amnezia::protocols::xray::serverName).toString();
-        vlessServer.fingerprint = tlsSettings.value(amnezia::protocols::xray::fingerprint).toString();
-        // alpn: serialize array back to comma-separated for VLESS URI
-        QJsonArray alpnArr = tlsSettings.value("alpn").toArray();
-        QStringList alpnList;
-        for (const QJsonValue &v : alpnArr) {
-            alpnList << v.toString();
-        }
-        // alpn goes into vless URI query param — handled by Serialize via serverName/alpn fields
-        // VlessServerObject doesn't have alpn field, so we embed in serverName if needed
    }

    result.nativeConfigString = amnezia::serialization::vless::Serialize(vlessServer, "AmneziaVPN");
@@ -342,22 +302,22 @@ ExportController::ExportResult ExportController::generateXrayConfig(const QStrin
    return result;
 }

-void ExportController::updateClientManagementModel(const QString &serverId, int containerIndex)
+void ExportController::updateClientManagementModel(int serverIndex, int containerIndex)
 {
    DockerContainer container = static_cast<DockerContainer>(containerIndex);
-    emit updateClientsRequested(serverId, container);
+    emit updateClientsRequested(serverIndex, container);
 }

-void ExportController::revokeConfig(int row, const QString &serverId, int containerIndex)
+void ExportController::revokeConfig(int row, int serverIndex, int containerIndex)
 {
    DockerContainer container = static_cast<DockerContainer>(containerIndex);
-    emit revokeClientRequested(serverId, row, container);
+    emit revokeClientRequested(serverIndex, row, container);
 }

-void ExportController::renameClient(int row, const QString &clientName, const QString &serverId, int containerIndex)
+void ExportController::renameClient(int row, const QString &clientName, int serverIndex, int containerIndex)
 {
    DockerContainer container = static_cast<DockerContainer>(containerIndex);
-    emit renameClientRequested(serverId, row, clientName, container);
+    emit renameClientRequested(serverIndex, row, clientName, container);
 }

 QString ExportController::generateVpnUrl(const QByteArray &compressedConfig)
--- a/client/core/controllers/selfhosted/exportController.h
+++ b/client/core/controllers/selfhosted/exportController.h
@@ -37,24 +37,23 @@ public:
                              SecureAppSettingsRepository* appSettingsRepository,
                              QObject *parent = nullptr);

-    ExportResult generateFullAccessConfig(const QString &serverId);
-    ExportResult generateConnectionConfig(const QString &serverId, int containerIndex, const QString &clientName);
-    ExportResult generateOpenVpnConfig(const QString &serverId, const QString &clientName);
-    ExportResult generateWireGuardConfig(const QString &serverId, const QString &clientName);
-    ExportResult generateAwgConfig(const QString &serverId, int containerIndex, const QString &clientName);
-    ExportResult generateXrayConfig(const QString &serverId, const QString &clientName);
+    ExportResult generateFullAccessConfig(int serverIndex);
+    ExportResult generateConnectionConfig(int serverIndex, int containerIndex, const QString &clientName);
+    ExportResult generateOpenVpnConfig(int serverIndex, const QString &clientName);
+    ExportResult generateWireGuardConfig(int serverIndex, const QString &clientName);
+    ExportResult generateAwgConfig(int serverIndex, int containerIndex, const QString &clientName);
+    ExportResult generateXrayConfig(int serverIndex, const QString &clientName);

 signals:
-    void appendClientRequested(const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container);
-    void updateClientsRequested(const QString &serverId, DockerContainer container);
-    void revokeClientRequested(const QString &serverId, int row, DockerContainer container);
-    void revokeFinished(ErrorCode errorCode);
-    void renameClientRequested(const QString &serverId, int row, const QString &clientName, DockerContainer container);
+    void appendClientRequested(int serverIndex, const QString &clientId, const QString &clientName, DockerContainer container);
+    void updateClientsRequested(int serverIndex, DockerContainer container);
+    void revokeClientRequested(int serverIndex, int row, DockerContainer container);
+    void renameClientRequested(int serverIndex, int row, const QString &clientName, DockerContainer container);

 public slots:
-    void updateClientManagementModel(const QString &serverId, int containerIndex);
-    void revokeConfig(int row, const QString &serverId, int containerIndex);
-    void renameClient(int row, const QString &clientName, const QString &serverId, int containerIndex);
+    void updateClientManagementModel(int serverIndex, int containerIndex);
+    void revokeConfig(int row, int serverIndex, int containerIndex);
+    void renameClient(int row, const QString &clientName, int serverIndex, int containerIndex);

 private:
    struct NativeConfigResult
@@ -63,7 +62,7 @@ private:
        QJsonObject jsonNativeConfig;
    };

-    NativeConfigResult generateNativeConfig(const QString &serverId, DockerContainer container,
+    NativeConfigResult generateNativeConfig(int serverIndex, DockerContainer container,
                                            const ContainerConfig &containerConfig,
                                            const QString &clientName);

--- a/client/core/controllers/selfhosted/importController.cpp
+++ b/client/core/controllers/selfhosted/importController.cpp
@@ -16,7 +16,7 @@
 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
 #include "core/utils/protocolEnum.h"
-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/api/apiEnums.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"
 #include "core/utils/api/apiUtils.h"
@@ -27,6 +27,7 @@
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
 #include "core/utils/qrCodeUtils.h"
+#include "core/models/serverConfig.h"

 using namespace amnezia;
 using namespace ProtocolUtils;
@@ -207,18 +208,12 @@ ImportController::ImportResult ImportController::extractConfigFromData(const QSt
    case ConfigTypes::Amnezia: {
        result.config = QJsonDocument::fromJson(config.toUtf8()).object();

-        if (serverConfigUtils::isServerFromApi(result.config)) {
+        if (apiUtils::isServerFromApi(result.config)) {
            auto apiConfig = result.config.value(apiDefs::key::apiConfig).toObject();
            apiConfig[apiDefs::key::vpnKey] = data;
            result.config[apiDefs::key::apiConfig] = apiConfig;
        }

-        if (serverConfigUtils::isLegacyApiSubscription(serverConfigUtils::configTypeFromJson(result.config))) {
-            result.errorCode = ErrorCode::LegacyApiV1NotSupportedError;
-            result.config = {};
-            return result;
-        }
-
        processAmneziaConfig(result.config);
        if (!result.config.empty()) {
            checkForMaliciousStrings(result.config, result.maliciousWarningText);
@@ -386,29 +381,18 @@ void ImportController::importConfig(const QJsonObject &config)
    credentials.secretData = config.value(configKey::password).toString();

    if (credentials.isValid() || config.contains(configKey::containers)) {
-        m_serversRepository->addServer(QString(), config, serverConfigUtils::configTypeFromJson(config));
+        ServerConfig serverConfig = ServerConfig::fromJson(config);
+        m_serversRepository->addServer(serverConfig);
        emit importFinished();
    } else if (config.contains(configKey::configVersion)) {
        quint16 crc = qChecksum(QJsonDocument(config).toJson());
-        bool hasServerWithCrc = false;
-        const QVector<QString> ids = m_serversRepository->orderedServerIds();
-        for (const QString &id : ids) {
-            const auto apiV2 = m_serversRepository->apiV2Config(id);
-            if (!apiV2.has_value()) {
-                continue;
-            }
-            if (static_cast<quint16>(apiV2->crc) == crc) {
-                hasServerWithCrc = true;
-                break;
-            }
-        }
-
-        if (hasServerWithCrc) {
+        if (m_serversRepository->hasServerWithCrc(crc)) {
            emit importErrorOccurred(ErrorCode::ApiConfigAlreadyAdded, true);
        } else {
            QJsonObject configWithCrc = config;
            configWithCrc.insert(configKey::crc, crc);
-            m_serversRepository->addServer(QString(), configWithCrc, serverConfigUtils::configTypeFromJson(configWithCrc));
+            ServerConfig serverConfig = ServerConfig::fromJson(configWithCrc);
+            m_serversRepository->addServer(serverConfig);
            emit importFinished();
        }
    } else {
@@ -486,7 +470,7 @@ QJsonObject ImportController::extractOpenVpnConfig(const QString &data) const
    QJsonObject config;
    config[configKey::containers] = arr;
    config[configKey::defaultContainer] = configKey::amneziaOpenvpn;
-    config[configKey::description] = m_serversRepository->nextAvailableServerName();
+    config[configKey::description] = m_appSettingsRepository->nextAvailableServerName();

    const static QRegularExpression dnsRegExp("dhcp-option DNS (\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\b)");
    QRegularExpressionMatchIterator dnsMatch = dnsRegExp.globalMatch(data);
@@ -572,19 +556,47 @@ QJsonObject ImportController::extractWireGuardConfig(const QString &data, Config
    lastConfig[configKey::allowedIps] = allowedIpsJsonArray;

    QString protocolName = configKey::wireguard;
+    QString protocolVersion;
    ConfigTypes detectedType = ConfigTypes::WireGuard;

-    const QStringList awgProtocolKeys = configKey::awgProtocolKeys();
+    const QStringList requiredJunkFields = { configKey::junkPacketCount,           configKey::junkPacketMinSize,
+                                             configKey::junkPacketMaxSize,         configKey::initPacketJunkSize,
+                                             configKey::responsePacketJunkSize,    configKey::initPacketMagicHeader,
+                                             configKey::responsePacketMagicHeader, configKey::underloadPacketMagicHeader,
+                                             configKey::transportPacketMagicHeader };

-    bool hasAwgKeys = std::any_of(awgProtocolKeys.begin(), awgProtocolKeys.end(),
-                                    [&configMap](const QString &field) { return !configMap.value(field).isEmpty(); });
-    if (hasAwgKeys) {
-        for (const QString &key : awgProtocolKeys) {
-            if (!configMap.value(key).isEmpty()) {
-                lastConfig[key] = configMap.value(key);
+    const QStringList optionalJunkFields = { configKey::cookieReplyPacketJunkSize,
+                                             configKey::transportPacketJunkSize,
+                                             configKey::specialJunk1,    configKey::specialJunk2,    configKey::specialJunk3,
+                                             configKey::specialJunk4,    configKey::specialJunk5
+    };
+
+    bool hasAllRequiredFields = std::all_of(requiredJunkFields.begin(), requiredJunkFields.end(),
+                                            [&configMap](const QString &field) { return !configMap.value(field).isEmpty(); });
+    if (hasAllRequiredFields) {
+        for (const QString &field : requiredJunkFields) {
+            lastConfig[field] = configMap.value(field);
+        }
+
+        for (const QString &field : optionalJunkFields) {
+            if (!configMap.value(field).isEmpty()) {
+                lastConfig[field] = configMap.value(field);
            }
        }

+        bool hasCookieReplyPacketJunkSize = !configMap.value(configKey::cookieReplyPacketJunkSize).isEmpty();
+        bool hasTransportPacketJunkSize = !configMap.value(configKey::transportPacketJunkSize).isEmpty();
+        bool hasSpecialJunk = !configMap.value(configKey::specialJunk1).isEmpty() ||
+                              !configMap.value(configKey::specialJunk2).isEmpty() ||
+                              !configMap.value(configKey::specialJunk3).isEmpty() ||
+                              !configMap.value(configKey::specialJunk4).isEmpty() ||
+                              !configMap.value(configKey::specialJunk5).isEmpty();
+
+        if (hasCookieReplyPacketJunkSize && hasTransportPacketJunkSize) {
+            protocolVersion = "2";
+        } else if (hasSpecialJunk && !hasCookieReplyPacketJunkSize && !hasTransportPacketJunkSize) {
+            protocolVersion = "1.5";
+        }
        protocolName = configKey::awg;
        detectedType = ConfigTypes::Awg;
    }
@@ -602,6 +614,9 @@ QJsonObject ImportController::extractWireGuardConfig(const QString &data, Config
    wireguardConfig[configKey::isThirdPartyConfig] = true;
    wireguardConfig[configKey::port] = port;
    wireguardConfig[configKey::transportProto] = protocols::openvpn::defaultTransportProto;
+    if (protocolName == configKey::awg && !protocolVersion.isEmpty()) {
+        wireguardConfig[configKey::protocolVersion] = protocolVersion;
+    }

    QJsonObject containers;
    QString containerName = (protocolName == configKey::awg) ? configKey::amneziaAwg : configKey::amneziaWireguard;
@@ -614,7 +629,7 @@ QJsonObject ImportController::extractWireGuardConfig(const QString &data, Config
    QJsonObject config;
    config[configKey::containers] = arr;
    config[configKey::defaultContainer] = containerName;
-    config[configKey::description] = m_serversRepository->nextAvailableServerName();
+    config[configKey::description] = m_appSettingsRepository->nextAvailableServerName();

    const static QRegularExpression dnsRegExp(
            "DNS = "
@@ -668,7 +683,7 @@ QJsonObject ImportController::extractXrayConfig(const QString &data, ConfigTypes
            ? configKey::amneziaSsxray
            : configKey::amneziaXray;
    if (description.isEmpty()) {
-        config[configKey::description] = m_serversRepository->nextAvailableServerName();
+        config[configKey::description] = m_appSettingsRepository->nextAvailableServerName();
    } else {
        config[configKey::description] = description;
    }
--- a/client/core/controllers/selfhosted/installController.cpp
+++ b/client/core/controllers/selfhosted/installController.cpp
--- a/client/core/controllers/selfhosted/installController.h
+++ b/client/core/controllers/selfhosted/installController.h
@@ -16,7 +16,6 @@
 #include "core/models/containerConfig.h"
 #include "core/repositories/secureServersRepository.h"
 #include "core/repositories/secureAppSettingsRepository.h"
-#include "core/installers/mtProxyInstaller.h"

 class SshSession;
 class InstallerBase;
@@ -34,43 +33,27 @@ public:
    ~InstallController();

    ErrorCode setupContainer(const ServerCredentials &credentials, DockerContainer container, ContainerConfig &config, bool isUpdate = false);
+    ErrorCode updateContainer(int serverIndex, DockerContainer container, const ContainerConfig &oldConfig, ContainerConfig &newConfig);

-    // Updates server-side container settings (admin self-hosted only): reconfigures the container over SSH.
-    ErrorCode updateServerConfig(const QString &serverId, DockerContainer container, const ContainerConfig &oldConfig, ContainerConfig &newConfig);
-
-    // Updates client-local settings only: rewrites the stored container config for any self-hosted/native server. No SSH.
-    ErrorCode updateClientConfig(const QString &serverId, DockerContainer container, ContainerConfig &newConfig);
-
-    ErrorCode rebootServer(const QString &serverId);
-    ErrorCode removeAllContainers(const QString &serverId);
-    ErrorCode removeContainer(const QString &serverId, DockerContainer container);
-
-    ErrorCode setDockerContainerEnabledState(const QString &serverId, DockerContainer container, bool enabled);
-
-    /// statusOut: 0 = not deployed, 1 = running, 2 = stopped, 3 = error
-    ErrorCode queryDockerContainerStatus(const QString &serverId, DockerContainer container, int &statusOut);
-
-    ErrorCode queryMtProxyDiagnostics(const QString &serverId, DockerContainer container, int listenPort,
-                                      MtProxyContainerDiagnostics &out);
-
-    QString fetchDockerContainerSecret(const QString &serverId, DockerContainer container);
+    ErrorCode rebootServer(int serverIndex);
+    ErrorCode removeAllContainers(int serverIndex);
+    ErrorCode removeContainer(int serverIndex, DockerContainer container);

    ContainerConfig generateConfig(DockerContainer container, int port, TransportProto transportProto);
    ErrorCode getAlreadyInstalledContainers(const ServerCredentials &credentials, QMap<DockerContainer, ContainerConfig> &installedContainers, SshSession &sshSession);
    
-    ErrorCode scanServerForInstalledContainers(const QString &serverId);
+    ErrorCode scanServerForInstalledContainers(int serverIndex);
    
    ErrorCode installContainer(const ServerCredentials &credentials, DockerContainer container, int port, TransportProto transportProto, ContainerConfig &config);

    ErrorCode installServer(const ServerCredentials &credentials, DockerContainer container, int port, TransportProto transportProto,
                                         bool &wasContainerInstalled);
-    ErrorCode installContainer(const QString &serverId, DockerContainer container, int port, TransportProto transportProto,
+    ErrorCode installContainer(int serverIndex, DockerContainer container, int port, TransportProto transportProto,
                                               bool &wasContainerInstalled);
    
    bool isUpdateDockerContainerRequired(DockerContainer container, const ContainerConfig &oldConfig, const ContainerConfig &newConfig);
    
-    ErrorCode checkSshConnection(ServerCredentials &credentials, QString &output,
-                                 std::function<QString()> passphraseCallback = nullptr);
+    ErrorCode checkSshConnection(const ServerCredentials &credentials, QString &output, std::function<QString()> passphraseCallback = nullptr);
    
    bool isServerAlreadyExists(const ServerCredentials &credentials, int &existingServerIndex);
    
@@ -79,13 +62,11 @@ public:

    void cancelInstallation();

-    void clearCachedProfile(const QString &serverId, DockerContainer container);
+    void clearCachedProfile(int serverIndex, DockerContainer container);

-    ErrorCode validateAndPrepareConfig(const QString &serverId);
+    ErrorCode validateAndPrepareConfig(int serverIndex);

-    void validateConfig(const QString &serverId);
-
-    void addEmptyServer(const ServerCredentials &credentials);
+    void validateConfig(int serverIndex);

 signals:
    void configValidated(bool isValid);
@@ -93,8 +74,8 @@ signals:

    void serverIsBusy(const bool isBusy);
    void cancelInstallationRequested();
-    void clientRevocationRequested(const QString &serverId, const ContainerConfig &containerConfig, DockerContainer container);
-    void clientAppendRequested(const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container);
+    void clientRevocationRequested(int serverIndex, const ContainerConfig &containerConfig, DockerContainer container);
+    void clientAppendRequested(int serverIndex, const QString &clientId, const QString &clientName, DockerContainer container);

 private:
    ErrorCode installDockerWorker(const ServerCredentials &credentials, DockerContainer container, SshSession &sshSession);
@@ -114,9 +95,9 @@ private:

    ErrorCode processContainerForAdmin(DockerContainer container, ContainerConfig &containerConfig,
                                       const ServerCredentials &credentials, SshSession &sshSession,
-                                       const QString &serverId, const QString &clientName);
+                                       int serverIndex, const QString &clientName);

-    void adminAppendRequested(const QString &serverId, DockerContainer container,
+    void adminAppendRequested(int serverIndex, DockerContainer container,
                              const ContainerConfig &containerConfig, const QString &clientName);

    static void updateContainerConfigAfterInstallation(DockerContainer container, ContainerConfig &containerConfig, const QString &stdOut);
@@ -133,3 +114,4 @@ private:
 };

 #endif // INSTALLCONTROLLER_H
+
--- a/client/core/controllers/selfhosted/usersController.cpp
+++ b/client/core/controllers/selfhosted/usersController.cpp
@@ -14,6 +14,7 @@
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
+#include "core/models/serverConfig.h"
 #include "core/models/containerConfig.h"

 using namespace amnezia;
@@ -291,18 +292,11 @@ ErrorCode UsersController::getXrayClients(const DockerContainer container, const
    return error;
 }

-ErrorCode UsersController::updateClients(const QString &serverId, const DockerContainer container)
+ErrorCode UsersController::updateClients(int serverIndex, const DockerContainer container)
 {
    ErrorCode error = ErrorCode::NoError;
    SshSession sshSession;
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        return ErrorCode::InternalError;
-    }
-    ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        return ErrorCode::InternalError;
-    }
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);

    QString clientsTableFile = QString("/opt/amnezia/%1/clientsTable");
    if (container == DockerContainer::OpenVpn) {
@@ -387,27 +381,20 @@ ErrorCode UsersController::updateClients(const QString &serverId, const DockerCo
 }


-ErrorCode UsersController::appendClient(const QString &serverId, const QString &clientId, const QString &clientName, const DockerContainer container)
+ErrorCode UsersController::appendClient(int serverIndex, const QString &clientId, const QString &clientName, const DockerContainer container)
 {
    ErrorCode error = ErrorCode::NoError;
    SshSession sshSession;
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        return ErrorCode::InternalError;
-    }
-    ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        return ErrorCode::InternalError;
-    }
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);

-    error = updateClients(serverId, container);
+    error = updateClients(serverIndex, container);
    if (error != ErrorCode::NoError) {
        return error;
    }

    int existingIndex = clientIndexById(clientId, m_clientsTable);
    if (existingIndex >= 0) {
-        return renameClient(serverId, existingIndex, clientName, container, true);
+        return renameClient(serverIndex, existingIndex, clientName, container, true);
    }

    QJsonObject client;
@@ -439,7 +426,7 @@ ErrorCode UsersController::appendClient(const QString &serverId, const QString &
    return error;
 }

-ErrorCode UsersController::renameClient(const QString &serverId, const int row, const QString &clientName,
+ErrorCode UsersController::renameClient(int serverIndex, const int row, const QString &clientName,
                                                   const DockerContainer container, bool addTimeStamp)
 {
    if (row < 0 || row >= m_clientsTable.size()) {
@@ -447,14 +434,7 @@ ErrorCode UsersController::renameClient(const QString &serverId, const int row,
    }

    SshSession sshSession;
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        return ErrorCode::InternalError;
-    }
-    ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        return ErrorCode::InternalError;
-    }
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);

    auto client = m_clientsTable.at(row).toObject();
    auto userData = client[configKey::userData].toObject();
@@ -490,7 +470,7 @@ ErrorCode UsersController::renameClient(const QString &serverId, const int row,
 }

 ErrorCode UsersController::revokeOpenVpn(const int row, const DockerContainer container, const ServerCredentials &credentials,
-                                                    SshSession* sshSession, QJsonArray &clientsTable)
+                                                    const int serverIndex, SshSession* sshSession, QJsonArray &clientsTable)
 {
    if (row < 0 || row >= clientsTable.size()) {
        return ErrorCode::InternalError;
@@ -698,7 +678,7 @@ ErrorCode UsersController::revokeXray(const int row,

    QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
    error = sshSession->runScript(
-        credentials,
+        credentials, 
        sshSession->replaceVars(restartScript, amnezia::genBaseVars(credentials, container, QString(), QString()))
    );
    if (error != ErrorCode::NoError) {
@@ -709,21 +689,14 @@ ErrorCode UsersController::revokeXray(const int row,
    return error;
 }

-ErrorCode UsersController::revokeClient(const QString &serverId, const int index, const DockerContainer container)
+ErrorCode UsersController::revokeClient(int serverIndex, const int index, const DockerContainer container)
 {
    if (index < 0 || index >= m_clientsTable.size()) {
        return ErrorCode::InternalError;
    }

    SshSession sshSession;
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        return ErrorCode::InternalError;
-    }
-    ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        return ErrorCode::InternalError;
-    }
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);

    QString clientId = m_clientsTable.at(index).toObject().value(configKey::clientId).toString();
    ErrorCode errorCode = ErrorCode::NoError;
@@ -731,7 +704,7 @@ ErrorCode UsersController::revokeClient(const QString &serverId, const int index
    switch(container)
    {
        case DockerContainer::OpenVpn: {
-            errorCode = revokeOpenVpn(index, container, credentials, &sshSession, m_clientsTable);
+            errorCode = revokeOpenVpn(index, container, credentials, serverIndex, &sshSession, m_clientsTable);
            break;
        }
        case DockerContainer::WireGuard:
@@ -751,41 +724,28 @@ ErrorCode UsersController::revokeClient(const QString &serverId, const int index
    }

    if (errorCode == ErrorCode::NoError) {
-        auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-        if (!adminConfig.has_value()) {
-            return ErrorCode::InternalError;
-        }
-        ContainerConfig containerCfg = adminConfig->containerConfig(container);
+        ServerConfig serverConfig = m_serversRepository->server(serverIndex);
+        ContainerConfig containerCfg = m_serversRepository->containerConfig(serverIndex, container);
        QString containerClientId = containerCfg.protocolConfig.clientId();

-        const bool isAdminMatch = !clientId.isEmpty() && !containerClientId.isEmpty() && containerClientId.contains(clientId);
-        if (isAdminMatch) {
-            emit adminConfigRevoked(serverId, container);
+        if (!clientId.isEmpty() && !containerClientId.isEmpty() && containerClientId.contains(clientId)) {
+            emit adminConfigRevoked(serverIndex, container);
        }

        emit clientRevoked(index);
+        emit clientsUpdated(m_clientsTable);
    }

-    emit clientsUpdated(m_clientsTable);
-    emit revokeFinished(errorCode);
-
    return errorCode;
 }

-ErrorCode UsersController::revokeClient(const QString &serverId, const ContainerConfig &containerConfig, const DockerContainer container)
+ErrorCode UsersController::revokeClient(int serverIndex, const ContainerConfig &containerConfig, const DockerContainer container)
 {
    SshSession sshSession;
-    auto adminConfig = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (!adminConfig.has_value()) {
-        return ErrorCode::InternalError;
-    }
-    ServerCredentials credentials = adminConfig->credentials();
-    if (!credentials.isValid()) {
-        return ErrorCode::InternalError;
-    }
+    ServerCredentials credentials = m_serversRepository->serverCredentials(serverIndex);

    ErrorCode errorCode = ErrorCode::NoError;
-    errorCode = updateClients(serverId, container);
+    errorCode = updateClients(serverIndex, container);
    if (errorCode != ErrorCode::NoError) {
        return errorCode;
    }
@@ -818,7 +778,7 @@ ErrorCode UsersController::revokeClient(const QString &serverId, const Container
    switch (container)
    {
    case DockerContainer::OpenVpn: {
-        errorCode = revokeOpenVpn(row, container, credentials, &sshSession, m_clientsTable);
+        errorCode = revokeOpenVpn(row, container, credentials, serverIndex, &sshSession, m_clientsTable);
        break;
    }
    case DockerContainer::WireGuard:
@@ -837,7 +797,7 @@ ErrorCode UsersController::revokeClient(const QString &serverId, const Container
    }

    if (errorCode == ErrorCode::NoError) {
-        emit adminConfigRevoked(serverId, container);
+        emit adminConfigRevoked(serverIndex, container);
        emit clientRevoked(row);
        emit clientsUpdated(m_clientsTable);
    }
--- a/client/core/controllers/selfhosted/usersController.h
+++ b/client/core/controllers/selfhosted/usersController.h
@@ -37,22 +37,21 @@ signals:
    void clientAdded(const QJsonObject &client);
    void clientRenamed(int row, const QString &newName);
    void clientRevoked(int row);
-    void revokeFinished(ErrorCode errorCode);
-    void adminConfigRevoked(const QString &serverId, DockerContainer container);
+    void adminConfigRevoked(int serverIndex, DockerContainer container);

 public slots:
-    ErrorCode updateClients(const QString &serverId, const DockerContainer container);
-    ErrorCode appendClient(const QString &serverId, const QString &clientId, const QString &clientName, const DockerContainer container);
-    ErrorCode renameClient(const QString &serverId, const int row, const QString &userName, const DockerContainer container, bool addTimeStamp = false);
-    ErrorCode revokeClient(const QString &serverId, const int index, const DockerContainer container);
-    ErrorCode revokeClient(const QString &serverId, const ContainerConfig &containerConfig, const DockerContainer container);
+    ErrorCode updateClients(int serverIndex, const DockerContainer container);
+    ErrorCode appendClient(int serverIndex, const QString &clientId, const QString &clientName, const DockerContainer container);
+    ErrorCode renameClient(int serverIndex, const int row, const QString &userName, const DockerContainer container, bool addTimeStamp = false);
+    ErrorCode revokeClient(int serverIndex, const int index, const DockerContainer container);
+    ErrorCode revokeClient(int serverIndex, const ContainerConfig &containerConfig, const DockerContainer container);

 private:
    bool isClientExists(const QString &clientId, const QJsonArray &clientsTable);
    int clientIndexById(const QString &clientId, const QJsonArray &clientsTable);
    void migration(const QByteArray &clientsTableString, QJsonArray &clientsTable);

-    ErrorCode revokeOpenVpn(const int row, const DockerContainer container, const ServerCredentials &credentials,
+    ErrorCode revokeOpenVpn(const int row, const DockerContainer container, const ServerCredentials &credentials, const int serverIndex,
                            SshSession* sshSession, QJsonArray &clientsTable);
    ErrorCode revokeWireGuard(const int row, const DockerContainer container, const ServerCredentials &credentials,
                              SshSession* sshSession, QJsonArray &clientsTable);
@@ -74,3 +73,4 @@ private:
 };

 #endif // USERSCONTROLLER_H
+
--- a/client/core/controllers/serversController.cpp
+++ b/client/core/controllers/serversController.cpp
@@ -1,272 +1,81 @@
 #include "serversController.h"
-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/networkUtilities.h"
+#include "core/utils/api/apiEnums.h"
+#include "core/utils/constants/apiKeys.h"
+#include "core/utils/constants/apiConstants.h"
 #include "core/utils/protocolEnum.h"
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
+#include "core/utils/constants/protocolConstants.h"
+#include "core/models/serverConfig.h"
 #include "core/models/containerConfig.h"

-#include "core/models/serverDescription.h"
-
 #if defined(Q_OS_IOS) || defined(MACOS_NE)
    #include <AmneziaVPN-Swift.h>
 #endif


-ServersController::ServersController(SecureServersRepository *serversRepository,
-                                      SecureAppSettingsRepository *appSettingsRepository, QObject *parent)
+ServersController::ServersController(SecureServersRepository* serversRepository, 
+                                      SecureAppSettingsRepository* appSettingsRepository,
+                                      QObject *parent)
    : QObject(parent), m_serversRepository(serversRepository), m_appSettingsRepository(appSettingsRepository)
 {
-    ensureDefaultServerValid();
+    recomputeGatewayStacks();
 }

-void ServersController::ensureDefaultServerValid()
+void ServersController::addServer(const ServerConfig &server)
 {
-    if (!getServersCount()) {
-        return;
-    }
-
-    const QString defaultId = getDefaultServerId();
-    if (!defaultId.isEmpty() && indexOfServerId(defaultId) >= 0) {
-        return;
-    }
-
-    const QString firstId = getServerId(0);
-    if (!firstId.isEmpty()) {
-        setDefaultServer(firstId);
-    }
+    m_serversRepository->addServer(server);
 }

-bool ServersController::renameServer(const QString &serverId, const QString &name)
+void ServersController::editServer(int index, const ServerConfig &server)
 {
-    const serverConfigUtils::ConfigType kind = m_serversRepository->serverKind(serverId);
-    switch (kind) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        if (!cfg.has_value()) return false;
-        cfg->description = name;
-        cfg->displayName = name;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return true;
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        if (!cfg.has_value()) return false;
-        cfg->description = name;
-        cfg->displayName = name;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return true;
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        auto cfg = m_serversRepository->nativeConfig(serverId);
-        if (!cfg.has_value()) return false;
-        cfg->description = name;
-        cfg->displayName = name;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return true;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        auto cfg = m_serversRepository->apiV2Config(serverId);
-        if (!cfg.has_value()) return false;
-        cfg->name = name;
-        cfg->displayName = name;
-        cfg->nameOverriddenByUser = true;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return true;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2:
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return false;
-    }
+    m_serversRepository->editServer(index, server);
 }

-void ServersController::removeServer(const QString &serverId)
+void ServersController::removeServer(int index)
 {
-    m_serversRepository->removeServer(serverId);
+    m_serversRepository->removeServer(index);
 }

-void ServersController::setDefaultServer(const QString &serverId)
+void ServersController::setDefaultServerIndex(int index)
 {
-    m_serversRepository->setDefaultServer(serverId);
+    m_serversRepository->setDefaultServer(index);
 }

-void ServersController::setDefaultContainer(const QString &serverId, DockerContainer container)
+void ServersController::setDefaultContainer(int serverIndex, DockerContainer container)
 {
-    const serverConfigUtils::ConfigType kind = m_serversRepository->serverKind(serverId);
-    switch (kind) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        if (!cfg.has_value()) return;
-        cfg->defaultContainer = container;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return;
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        if (!cfg.has_value()) return;
-        cfg->defaultContainer = container;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return;
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        auto cfg = m_serversRepository->nativeConfig(serverId);
-        if (!cfg.has_value()) return;
-        cfg->defaultContainer = container;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        auto cfg = m_serversRepository->apiV2Config(serverId);
-        if (!cfg.has_value()) return;
-        cfg->defaultContainer = container;
-        m_serversRepository->editServer(serverId, cfg->toJson(), kind);
-        return;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2:
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return;
-    }
+    m_serversRepository->setDefaultContainer(serverIndex, container);
 }

-QVector<ServerDescription> ServersController::buildServerDescriptions(bool isAmneziaDnsEnabled) const
+void ServersController::updateContainerConfig(int serverIndex, DockerContainer container, const ContainerConfig &config)
 {
-    QVector<ServerDescription> out;
-    const QVector<QString> ids = m_serversRepository->orderedServerIds();
-    out.reserve(ids.size());
-
-    for (const QString &id : ids) {
-        ServerDescription d;
-        using Kind = serverConfigUtils::ConfigType;
-        const Kind kind = m_serversRepository->serverKind(id);
-        switch (kind) {
-        case Kind::SelfHostedAdmin: {
-            const auto cfg = m_serversRepository->selfHostedAdminConfig(id);
-            if (!cfg) {
-                continue;
-            }
-            d = buildServerDescription(*cfg, isAmneziaDnsEnabled);
-            break;
-        }
-        case Kind::SelfHostedUser: {
-            const auto cfg = m_serversRepository->selfHostedUserConfig(id);
-            if (!cfg) {
-                continue;
-            }
-            d = buildServerDescription(*cfg, isAmneziaDnsEnabled);
-            break;
-        }
-        case Kind::Native: {
-            const auto cfg = m_serversRepository->nativeConfig(id);
-            if (!cfg) {
-                continue;
-            }
-            d = buildServerDescription(*cfg, isAmneziaDnsEnabled);
-            break;
-        }
-        case Kind::AmneziaPremiumV2:
-        case Kind::AmneziaFreeV3:
-        case Kind::ExternalPremium: {
-            const auto cfg = m_serversRepository->apiV2Config(id);
-            if (!cfg) {
-                continue;
-            }
-            d = buildServerDescription(*cfg, isAmneziaDnsEnabled);
-            break;
-        }
-        case Kind::AmneziaPremiumV1:
-        case Kind::AmneziaFreeV2: {
-            const auto cfg = m_serversRepository->legacyApiConfig(id);
-            if (!cfg) {
-                continue;
-            }
-            d = buildServerDescription(*cfg, isAmneziaDnsEnabled);
-            break;
-        }
-        case Kind::Invalid:
-        default:
-            continue;
-        }
-
-        d.serverId = id;
-        out.append(d);
-    }
-    return out;
+    m_serversRepository->setContainerConfig(serverIndex, container, config);
 }

-QMap<DockerContainer, ContainerConfig> ServersController::getServerContainersMap(const QString &serverId) const
+void ServersController::clearCachedProfile(int serverIndex, DockerContainer container)
 {
-    switch (m_serversRepository->serverKind(serverId)) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        return cfg.has_value() ? cfg->containers : QMap<DockerContainer, ContainerConfig>{};
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        const auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        return cfg.has_value() ? cfg->containers : QMap<DockerContainer, ContainerConfig>{};
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        const auto cfg = m_serversRepository->nativeConfig(serverId);
-        return cfg.has_value() ? cfg->containers : QMap<DockerContainer, ContainerConfig>{};
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        const auto cfg = m_serversRepository->apiV2Config(serverId);
-        return cfg.has_value() ? cfg->containers : QMap<DockerContainer, ContainerConfig>{};
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2: {
-        const auto cfg = m_serversRepository->legacyApiConfig(serverId);
-        return cfg.has_value() ? cfg->containers : QMap<DockerContainer, ContainerConfig>{};
-    }
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return {};
-    }
+    m_serversRepository->clearLastConnectionConfig(serverIndex, container);
 }

-DockerContainer ServersController::getDefaultContainer(const QString &serverId) const
+QJsonArray ServersController::getServersArray() const
 {
-    switch (m_serversRepository->serverKind(serverId)) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        return cfg.has_value() ? cfg->defaultContainer : DockerContainer::None;
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        const auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        return cfg.has_value() ? cfg->defaultContainer : DockerContainer::None;
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        const auto cfg = m_serversRepository->nativeConfig(serverId);
-        return cfg.has_value() ? cfg->defaultContainer : DockerContainer::None;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        const auto cfg = m_serversRepository->apiV2Config(serverId);
-        return cfg.has_value() ? cfg->defaultContainer : DockerContainer::None;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2: {
-        const auto cfg = m_serversRepository->legacyApiConfig(serverId);
-        return cfg.has_value() ? cfg->defaultContainer : DockerContainer::None;
-    }
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return DockerContainer::None;
+    QJsonArray result;
+    QVector<ServerConfig> servers = m_serversRepository->servers();
+    for (const ServerConfig& server : servers) {
+        result.append(server.toJson());
    }
+    return result;
 }

-ContainerConfig ServersController::getContainerConfig(const QString &serverId, DockerContainer container) const
+QVector<ServerConfig> ServersController::getServers() const
 {
-    return getServerContainersMap(serverId).value(container);
+    return m_serversRepository->servers();
+}
+
+ContainerConfig ServersController::getContainerConfig(int serverIndex, DockerContainer container) const
+{
+    return m_serversRepository->containerConfig(serverIndex, container);
 }

 int ServersController::getDefaultServerIndex() const
@@ -274,131 +83,114 @@ int ServersController::getDefaultServerIndex() const
    return m_serversRepository->defaultServerIndex();
 }

-QString ServersController::getDefaultServerId() const
-{
-    return m_serversRepository->defaultServerId();
-}
-
 int ServersController::getServersCount() const
 {
    return m_serversRepository->serversCount();
 }

-QString ServersController::getServerId(int serverIndex) const
+ServerConfig ServersController::getServerConfig(int serverIndex) const
 {
-    return m_serversRepository->serverIdAt(serverIndex);
+    return m_serversRepository->server(serverIndex);
 }

-int ServersController::indexOfServerId(const QString &serverId) const
+ServerCredentials ServersController::getServerCredentials(int serverIndex) const
 {
-    return m_serversRepository->indexOfServerId(serverId);
+    return m_serversRepository->serverCredentials(serverIndex);
 }

-QString ServersController::notificationDisplayName(const QString &serverId) const
+QPair<QString, QString> ServersController::getDnsPair(int serverIndex, bool isAmneziaDnsEnabled) const
 {
-    if (serverId.isEmpty()) {
-        return {};
-    }
+    ServerConfig serverConfig = m_serversRepository->server(serverIndex);
+    return serverConfig.getDnsPair(isAmneziaDnsEnabled,
+                                   m_appSettingsRepository->primaryDns(),
+                                   m_appSettingsRepository->secondaryDns());
+}

-    using Kind = serverConfigUtils::ConfigType;
-    switch (m_serversRepository->serverKind(serverId)) {
-    case Kind::SelfHostedAdmin: {
-        if (const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId)) {
-            if (!cfg->displayName.isEmpty()) {
-                return cfg->displayName;
+ServersController::GatewayStacksData ServersController::gatewayStacks() const
+{
+    return m_gatewayStacks;
+}
+
+void ServersController::recomputeGatewayStacks()
+{
+    GatewayStacksData computed;
+    bool hasNewTags = false;
+    QVector<ServerConfig> servers = m_serversRepository->servers();
+
+    for (const ServerConfig& serverConfig : servers) {
+        if (serverConfig.isApiV2()) {
+            const ApiV2ServerConfig* apiV2 = serverConfig.as<ApiV2ServerConfig>();
+            if (!apiV2) continue;
+            const QString userCountryCode = apiV2->apiConfig.userCountryCode;
+            const QString serviceType = apiV2->serviceType();
+
+            if (!userCountryCode.isEmpty()) {
+                if (!m_gatewayStacks.userCountryCodes.contains(userCountryCode)) {
+                    hasNewTags = true;
+                }
+                computed.userCountryCodes.insert(userCountryCode);
+            }
+
+            if (!serviceType.isEmpty()) {
+                if (!m_gatewayStacks.serviceTypes.contains(serviceType)) {
+                    hasNewTags = true;
+                }
+                computed.serviceTypes.insert(serviceType);
            }
        }
-        break;
-    }
-    case Kind::SelfHostedUser: {
-        if (const auto cfg = m_serversRepository->selfHostedUserConfig(serverId)) {
-            if (!cfg->displayName.isEmpty()) {
-                return cfg->displayName;
-            }
-        }
-        break;
-    }
-    case Kind::Native: {
-        if (const auto cfg = m_serversRepository->nativeConfig(serverId)) {
-            if (!cfg->displayName.isEmpty()) {
-                return cfg->displayName;
-            }
-        }
-        break;
-    }
-    case Kind::AmneziaPremiumV2:
-    case Kind::AmneziaFreeV3:
-    case Kind::ExternalPremium: {
-        if (const auto cfg = m_serversRepository->apiV2Config(serverId)) {
-            if (!cfg->displayName.isEmpty()) {
-                return cfg->displayName;
-            }
-        }
-        break;
-    }
-    case Kind::AmneziaPremiumV1:
-    case Kind::AmneziaFreeV2: {
-        if (const auto cfg = m_serversRepository->legacyApiConfig(serverId)) {
-            if (!cfg->displayName.isEmpty()) {
-                return cfg->displayName;
-            }
-        }
-        break;
-    }
-    default:
-        break;
    }

-    const int idx = indexOfServerId(serverId);
-    if (idx >= 0) {
-        return QString::number(idx + 1);
+    m_gatewayStacks = std::move(computed);
+    if (hasNewTags) {
+        emit gatewayStacksExpanded();
    }
-    return serverId;
 }

-std::optional<ApiV2ServerConfig> ServersController::apiV2Config(const QString &serverId) const
+bool ServersController::GatewayStacksData::operator==(const GatewayStacksData &other) const
 {
-    return m_serversRepository->apiV2Config(serverId);
+    return userCountryCodes == other.userCountryCodes && serviceTypes == other.serviceTypes;
 }

-std::optional<SelfHostedAdminServerConfig> ServersController::selfHostedAdminConfig(const QString &serverId) const
+QJsonObject ServersController::GatewayStacksData::toJson() const
 {
-    return m_serversRepository->selfHostedAdminConfig(serverId);
-}
-
-ServerCredentials ServersController::getServerCredentials(const QString &serverId) const
-{
-    const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-    if (cfg.has_value()) {
-        const ServerCredentials creds = cfg->credentials();
-        if (creds.isValid()) {
-            return creds;
-        }
+    QJsonObject json;
+    
+    QJsonArray userCountryCodesArray;
+    for (const QString &code : userCountryCodes) {
+        userCountryCodesArray.append(code);
    }
-    return ServerCredentials {};
+    json[apiDefs::key::userCountryCode] = userCountryCodesArray;
+    
+    QJsonArray serviceTypesArray;
+    for (const QString &type : serviceTypes) {
+        serviceTypesArray.append(type);
+    }
+    json[apiDefs::key::serviceType] = serviceTypesArray;
+    
+    return json;
 }

-bool ServersController::isServerFromApiAlreadyExists(const QString &userCountryCode, const QString &serviceType,
-                                                      const QString &serviceProtocol) const
+bool ServersController::isServerFromApiAlreadyExists(const QString &userCountryCode, const QString &serviceType, const QString &serviceProtocol) const
 {
-    const QVector<QString> ids = m_serversRepository->orderedServerIds();
-    for (const QString &id : ids) {
-        const auto apiV2 = m_serversRepository->apiV2Config(id);
-        if (!apiV2.has_value()) {
-            continue;
-        }
-        if (apiV2->apiConfig.userCountryCode == userCountryCode && apiV2->serviceType() == serviceType
-            && apiV2->serviceProtocol() == serviceProtocol) {
-            return true;
+    QVector<ServerConfig> servers = m_serversRepository->servers();
+    for (const ServerConfig& serverConfig : servers) {
+        if (serverConfig.isApiV2()) {
+            const ApiV2ServerConfig* apiV2 = serverConfig.as<ApiV2ServerConfig>();
+            if (!apiV2) return false;
+            if (apiV2->apiConfig.userCountryCode == userCountryCode
+                && apiV2->serviceType() == serviceType
+                && apiV2->serviceProtocol() == serviceProtocol) {
+                return true;
+            }
        }
    }
    return false;
 }

-bool ServersController::hasInstalledContainers(const QString &serverId) const
+bool ServersController::hasInstalledContainers(int serverIndex) const
 {
-    const QMap<DockerContainer, ContainerConfig> containers = getServerContainersMap(serverId);
-
+    ServerConfig serverConfig = m_serversRepository->server(serverIndex);
+    QMap<DockerContainer, ContainerConfig> containers = serverConfig.containers();
    for (auto it = containers.begin(); it != containers.end(); ++it) {
        DockerContainer container = it.key();
        if (ContainerUtils::containerService(container) == ServiceType::Vpn) {
@@ -411,8 +203,3 @@ bool ServersController::hasInstalledContainers(const QString &serverId) const
    return false;
 }

-bool ServersController::isLegacyApiV1Server(const QString &serverId) const
-{
-    return !serverId.isEmpty()
-            && serverConfigUtils::isLegacyApiSubscription(m_serversRepository->serverKind(serverId));
-}
--- a/client/core/controllers/serversController.h
+++ b/client/core/controllers/serversController.h
@@ -1,11 +1,11 @@
 #ifndef SERVERSCONTROLLER_H
 #define SERVERSCONTROLLER_H

-#include <optional>
-
 #include <QObject>
+#include <QJsonObject>
+#include <QJsonArray>
+#include <QSet>
 #include <QVector>
-#include <QMap>

 #include <QPair>

@@ -17,18 +17,34 @@
 #include "core/utils/commonStructs.h"
 #include "core/repositories/secureServersRepository.h"
 #include "core/repositories/secureAppSettingsRepository.h"
+#include "core/models/serverConfig.h"
 #include "core/models/containerConfig.h"
-#include "core/models/serverDescription.h"

 class SshSession;
 class InstallController;

 using namespace amnezia;

+/**
+ * @brief Core business logic controller for server operations
+ * 
+ * This controller contains pure business logic for managing servers.
+ */
 class ServersController : public QObject
 {
    Q_OBJECT
+    
+public:
+    struct GatewayStacksData
+    {
+        QSet<QString> userCountryCodes;
+        QSet<QString> serviceTypes;

+        bool isEmpty() const { return userCountryCodes.isEmpty() && serviceTypes.isEmpty(); }
+        bool operator==(const GatewayStacksData &other) const;
+        QJsonObject toJson() const;
+    };
+    
 public:
    explicit ServersController(SecureServersRepository* serversRepository, 
                              SecureAppSettingsRepository* appSettingsRepository = nullptr,
@@ -36,38 +52,44 @@ public:
    ~ServersController() = default;

    // Server management
-    bool renameServer(const QString &serverId, const QString &name);
-    void removeServer(const QString &serverId);
-    void setDefaultServer(const QString &serverId);
+    void addServer(const ServerConfig &server);
+    void editServer(int index, const ServerConfig &server);
+    void removeServer(int index);
+    void setDefaultServerIndex(int index);

    // Container management
-    void setDefaultContainer(const QString &serverId, DockerContainer container);
+    void setDefaultContainer(int serverIndex, DockerContainer container);
+    void updateContainerConfig(int serverIndex, DockerContainer container, const ContainerConfig &config);
+
+    // Cache management
+    void clearCachedProfile(int serverIndex, DockerContainer container);

    // Getters
-    QVector<ServerDescription> buildServerDescriptions(bool isAmneziaDnsEnabled) const;
+    QJsonArray getServersArray() const;
+    QVector<ServerConfig> getServers() const;
    int getDefaultServerIndex() const;
-    QString getDefaultServerId() const;
    int getServersCount() const;
-    QString getServerId(int serverIndex) const;
-    int indexOfServerId(const QString &serverId) const;
-    QString notificationDisplayName(const QString &serverId) const;
-    std::optional<ApiV2ServerConfig> apiV2Config(const QString &serverId) const;
-    std::optional<SelfHostedAdminServerConfig> selfHostedAdminConfig(const QString &serverId) const;
-    ServerCredentials getServerCredentials(const QString &serverId) const;
-    QMap<DockerContainer, ContainerConfig> getServerContainersMap(const QString &serverId) const;
-    DockerContainer getDefaultContainer(const QString &serverId) const;
-    ContainerConfig getContainerConfig(const QString &serverId, DockerContainer container) const;
+    ServerConfig getServerConfig(int serverIndex) const;
+    ServerCredentials getServerCredentials(int serverIndex) const;
+    ContainerConfig getContainerConfig(int serverIndex, DockerContainer container) const;
+    QPair<QString, QString> getDnsPair(int serverIndex, bool isAmneziaDnsEnabled) const;
+    
+    GatewayStacksData gatewayStacks() const;

    // Validation
    bool isServerFromApiAlreadyExists(const QString &userCountryCode, const QString &serviceType, const QString &serviceProtocol) const;
-    bool hasInstalledContainers(const QString &serverId) const;
-    bool isLegacyApiV1Server(const QString &serverId) const;
+    bool hasInstalledContainers(int serverIndex) const;
+
+signals:
+    void gatewayStacksExpanded();
+
+public slots:
+    void recomputeGatewayStacks();

 private:
-    void ensureDefaultServerValid();
-
    SecureServersRepository* m_serversRepository;
    SecureAppSettingsRepository* m_appSettingsRepository;
+    GatewayStacksData m_gatewayStacks;
 };

 #endif // SERVERSCONTROLLER_H
--- a/client/core/controllers/settingsController.cpp
+++ b/client/core/controllers/settingsController.cpp
@@ -179,9 +179,12 @@ QString SettingsController::getAppVersion() const

 void SettingsController::clearSettings()
 {
+    int serverCount = m_serversRepository->serversCount();
+    
    m_appSettingsRepository->clearSettings();
-
-    m_serversRepository->clearServers();
+    
+    m_serversRepository->setServersArray(QJsonArray());
+    m_serversRepository->setDefaultServer(0);

    emit siteSplitTunnelingRouteModeChanged(RouteMode::VpnOnlyForwardSites);
    emit siteSplitTunnelingToggled(false);
@@ -217,11 +220,6 @@ void SettingsController::toggleAutoStart(bool enable)

 bool SettingsController::isStartMinimizedEnabled() const
 {
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    if (!isAutoStartEnabled()) {
-        return false;
-    }
-#endif
    return m_appSettingsRepository->isStartMinimized();
 }

@@ -363,6 +361,6 @@ void SettingsController::disablePremV1MigrationReminder()

 QString SettingsController::nextAvailableServerName() const
 {
-    return m_serversRepository->nextAvailableServerName();
+    return m_appSettingsRepository->nextAvailableServerName();
 }

--- a/client/core/controllers/updateController.cpp
+++ b/client/core/controllers/updateController.cpp
@@ -1,347 +0,0 @@
-#include "updateController.h"
-
-#include <QNetworkReply>
-#include <QVersionNumber>
-#include <QUrl>
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QSysInfo>
-#include <QTimer>
-
-#include "amneziaApplication.h"
-#include "logger.h"
-#include "version.h"
-#include "core/controllers/gatewayController.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-
-namespace
-{
-    Logger logger("UpdateController");
-
-#if defined(Q_OS_WINDOWS)
-    const QLatin1String kInstallerRemoteFileNamePattern("AmneziaVPN_%1_windows_x64.exe");
-    const QString kInstallerLocalPath = QStandardPaths::writableLocation(QStandardPaths::TempLocation) + "/AmneziaVPN_installer.exe";
-#elif defined(Q_OS_MACOS) && !defined(MACOS_NE)
-    const QLatin1String kInstallerRemoteFileNamePattern("AmneziaVPN_%1_macos_x64.pkg");
-    const QString kInstallerLocalPath = QStandardPaths::writableLocation(QStandardPaths::TempLocation) + "/AmneziaVPN.pkg";
-#elif defined(Q_OS_LINUX) && !defined(Q_OS_ANDROID)
-    const QLatin1String kInstallerRemoteFileNamePattern("AmneziaVPN_%1_linux_x64.run");
-    const QString kInstallerLocalPath = QStandardPaths::writableLocation(QStandardPaths::TempLocation) + "/AmneziaVPN.run";
-#endif
-}
-
-UpdateController::UpdateController(SecureAppSettingsRepository* appSettingsRepository, QObject *parent)
-    : QObject(parent), m_appSettingsRepository(appSettingsRepository)
-{
-}
-
-QString UpdateController::getRawChangelogText() const
-{
-    return m_changelogText;
-}
-
-QString UpdateController::getReleaseDate() const
-{
-    return m_releaseDate;
-}
-
-QString UpdateController::getVersion() const
-{
-    return m_version;
-}
-
-void UpdateController::checkForUpdates()
-{
-    if (m_updateCheckRunning || !m_appSettingsRepository) {
-        return;
-    }
-    m_updateCheckRunning = true;
-
-    fetchGatewayUrl();
-}
-
-void UpdateController::finishUpdateCheck()
-{
-    m_updateCheckRunning = false;
-}
-
-void UpdateController::doGetAsync(const QString &endpoint, std::function<void(bool, QByteArray)> onDone)
-{
-    QString fullUrl = m_baseUrl + endpoint;
-    
-    QNetworkRequest req;
-    req.setTransferTimeout(7000);
-    req.setUrl(QUrl(fullUrl));
-
-    QNetworkReply *reply = amnApp->networkManager()->get(req);
-    setupNetworkErrorHandling(reply, endpoint);
-
-    QObject::connect(reply, &QNetworkReply::finished, this, [this, reply, endpoint, onDone]() {
-        const bool ok = (reply->error() == QNetworkReply::NoError);
-        QByteArray data;
-        if (ok) {
-            data = reply->readAll();
-        } else {
-            handleNetworkError(reply, endpoint);
-        }
-        reply->deleteLater();
-        onDone(ok, data);
-    });
-}
-
-void UpdateController::fetchGatewayUrl()
-{
-    auto gatewayController = QSharedPointer<GatewayController>::create(m_appSettingsRepository->getGatewayEndpoint(),
-                                                                       m_appSettingsRepository->isDevGatewayEnv(),
-                                                                       7000,
-                                                                       m_appSettingsRepository->isStrictKillSwitchEnabled(),
-                                                                       m_appSettingsRepository);
-
-    QJsonObject apiPayload;
-    apiPayload[apiDefs::key::cliVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::osVersion] = QSysInfo::productType();
-    apiPayload[apiDefs::key::installationUuid] = m_appSettingsRepository->getInstallationUuid(true);
-
-    // Workaround: wait before contacting gateway to avoid rate limit triggered by other requests (news etc.)
-    QTimer::singleShot(1000, this, [this, gatewayController, apiPayload]() {
-        gatewayController->postAsync(QStringLiteral("%1v1/updater_endpoint"), apiPayload)
-            .then(this, [this, gatewayController](QPair<ErrorCode, QByteArray> result) {
-                auto [err, gatewayResponse] = result;
-                if (err != ErrorCode::NoError) {
-                    logger.error() << "Gateway request failed, error code:" << static_cast<int>(err);
-                    finishUpdateCheck();
-                    return;
-                }
-
-                QJsonObject gatewayData = QJsonDocument::fromJson(gatewayResponse).object();
-
-                QString baseUrl = gatewayData.value("url").toString();
-                if (baseUrl.endsWith('/')) {
-                    baseUrl.chop(1);
-                }
-                m_baseUrl = baseUrl;
-
-                fetchVersionInfo();
-            });
-    });
-}
-
-void UpdateController::fetchVersionInfo()
-{
-    doGetAsync("/VERSION", [this](bool ok, QByteArray data) {
-        if (!ok) {
-            finishUpdateCheck();
-            return;
-        }
-        m_version = QString::fromUtf8(data).trimmed();
-        
-        if (!isNewVersionAvailable()) {
-            finishUpdateCheck();
-            return;
-        }
-        fetchChangelog();
-    });
-}
-
-void UpdateController::fetchChangelog()
-{
-    doGetAsync("/CHANGELOG", [this](bool ok, QByteArray data) {
-        if (!ok) {
-            m_changelogText.clear();
-        } else {
-            m_changelogText = QString::fromUtf8(data);
-        }
-        fetchReleaseDate();
-    });
-}
-
-void UpdateController::fetchReleaseDate()
-{
-    doGetAsync("/RELEASE_DATE", [this](bool ok, QByteArray data) {
-        if (ok) {
-            m_releaseDate = QString::fromUtf8(data).trimmed();
-        } else {
-            m_releaseDate = QString();
-        }
-
-        m_downloadUrl = composeDownloadUrl();
-        emit updateFound();
-        finishUpdateCheck();
-    });
-}
-
-bool UpdateController::isNewVersionAvailable() const
-{
-    auto currentVersion = QVersionNumber::fromString(QString(APP_VERSION));
-    auto newVersion = QVersionNumber::fromString(m_version);
-    return newVersion > currentVersion;
-}
-
-void UpdateController::setupNetworkErrorHandling(QNetworkReply* reply, const QString& operation)
-{
-    QObject::connect(reply, &QNetworkReply::errorOccurred, [reply, operation](QNetworkReply::NetworkError error) {
-        logger.error() << QString("Network error occurred while fetching %1: %2 %3")
-                          .arg(operation, reply->errorString(), QString::number(error));
-    });
-
-    QObject::connect(reply, &QNetworkReply::sslErrors, [operation](const QList<QSslError> &errors) {
-        QStringList errorStrings;
-        for (const QSslError &err : errors) {
-            errorStrings << err.errorString();
-        }
-        logger.error() << QString("SSL errors while fetching %1: %2").arg(operation, errorStrings.join("; "));
-    });
-}
-
-void UpdateController::handleNetworkError(QNetworkReply* reply, const QString& operation)
-{
-    logger.error() << "Network error code:" << QString::number(static_cast<int>(reply->error()));
-    logger.error() << "HTTP status:" << reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-}
-
-QString UpdateController::composeDownloadUrl() const
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
-    const QString fileName = QString(kInstallerRemoteFileNamePattern).arg(m_version);
-    return m_baseUrl + "/" + fileName;
-#else
-    return QString();
-#endif
-}
-
-void UpdateController::runInstaller()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
-    if (m_downloadUrl.isEmpty()) {
-        logger.error() << "Download URL is empty";
-        return;
-    }
-
-    QNetworkRequest request;
-    request.setTransferTimeout(30000);
-    request.setUrl(m_downloadUrl);
-
-    QNetworkReply *reply = amnApp->networkManager()->get(request);
-
-    QObject::connect(reply, &QNetworkReply::finished, [this, reply]() {
-        if (reply->error() == QNetworkReply::NoError) {
-            QFile file(kInstallerLocalPath);
-            if (!file.open(QIODevice::WriteOnly)) {
-                logger.error() << "Failed to open installer file for writing:" << kInstallerLocalPath << "Error:" << file.errorString();
-                reply->deleteLater();
-                return;
-            }
-
-            if (file.write(reply->readAll()) == -1) {
-                logger.error() << "Failed to write installer data to file:" << kInstallerLocalPath << "Error:" << file.errorString();
-                file.close();
-                reply->deleteLater();
-                return;
-            }
-
-            file.close();
-
-    #if defined(Q_OS_WINDOWS)
-            runWindowsInstaller(kInstallerLocalPath);
-    #elif defined(Q_OS_MACOS) && !defined(MACOS_NE)
-            runMacInstaller(kInstallerLocalPath);
-    #elif defined(Q_OS_LINUX) && !defined(Q_OS_ANDROID)
-            runLinuxInstaller(kInstallerLocalPath);
-    #endif
-        } else {
-            logger.error() << "Installer download failed, network error:" << static_cast<int>(reply->error())
-                           << reply->errorString();
-            logger.error() << "HTTP status:" << reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-        }
-        reply->deleteLater();
-    });
-#endif
-}
-
-#if defined(Q_OS_WINDOWS)
-int UpdateController::runWindowsInstaller(const QString &installerPath)
-{
-    qint64 pid;
-    bool success = QProcess::startDetached(installerPath, QStringList(), QString(), &pid);
-
-    if (success) {
-        logger.info() << "Installation process started with PID:" << pid;
-    } else {
-        logger.error() << "Failed to start installation process";
-        return -1;
-    }
-
-    return 0;
-}
-#endif
-
-#if defined(Q_OS_MACOS) && !defined(MACOS_NE)
-int UpdateController::runMacInstaller(const QString &installerPath)
-{
-    // Create temporary directory for extraction
-    QTemporaryDir extractDir;
-    extractDir.setAutoRemove(false);
-    if (!extractDir.isValid()) {
-        logger.error() << "Failed to create temporary directory";
-        return -1;
-    }
-    logger.info() << "Temporary directory created:" << extractDir.path();
-
-    // Create script file in the temporary directory
-    QString scriptPath = extractDir.path() + "/mac_installer.sh";
-    QFile scriptFile(scriptPath);
-    if (!scriptFile.open(QIODevice::WriteOnly)) {
-        logger.error() << "Failed to create script file";
-        return -1;
-    }
-
-    // Get script content from registry
-    QString scriptContent = amnezia::scriptData(amnezia::ClientScriptType::mac_installer);
-    if (scriptContent.isEmpty()) {
-        logger.error() << "macOS installer script content is empty";
-        scriptFile.close();
-        return -1;
-    }
-
-    scriptFile.write(scriptContent.toUtf8());
-    scriptFile.close();
-    logger.info() << "Script file created:" << scriptPath;
-
-    // Make script executable
-    QFile::setPermissions(scriptPath, QFile::permissions(scriptPath) | QFile::ExeUser);
-
-    // Start detached process
-    qint64 pid;
-    bool success =
-            QProcess::startDetached("/bin/bash", QStringList() << scriptPath << extractDir.path() << installerPath, extractDir.path(), &pid);
-
-    if (success) {
-        logger.info() << "Installation process started with PID:" << pid;
-    } else {
-        logger.error() << "Failed to start installation process";
-        return -1;
-    }
-
-    return 0;
-}
-#endif
-
-#if defined(Q_OS_LINUX) && !defined(Q_OS_ANDROID)
-int UpdateController::runLinuxInstaller(const QString &installerPath)
-{
-    QFile::setPermissions(installerPath, QFile::permissions(installerPath) | QFile::ExeUser);
-
-    qint64 pid;
-    bool success = QProcess::startDetached(installerPath, QStringList(), QString(), &pid);
-
-    if (success) {
-        logger.info() << "Installation process started with PID:" << pid;
-    } else {
-        logger.error() << "Failed to start installation process";
-        return -1;
-    }
-
-    return 0;
-}
-#endif
--- a/client/core/controllers/updateController.h
+++ b/client/core/controllers/updateController.h
@@ -1,57 +0,0 @@
-#ifndef UPDATECONTROLLER_H
-#define UPDATECONTROLLER_H
-
-#include <functional>
-#include <QObject>
-#include <QNetworkReply>
-
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class UpdateController : public QObject
-{
-    Q_OBJECT
-public:
-    explicit UpdateController(SecureAppSettingsRepository* appSettingsRepository, QObject *parent = nullptr);
-
-    QString getRawChangelogText() const;
-    QString getReleaseDate() const;
-    QString getVersion() const;
-
-public slots:
-    void checkForUpdates();
-    void runInstaller();
-
-signals:
-    void updateFound();
-
-private:
-    void finishUpdateCheck();
-    void fetchGatewayUrl();
-    void fetchVersionInfo();
-    void fetchChangelog();
-    void fetchReleaseDate();
-    void doGetAsync(const QString &endpoint, std::function<void(bool, QByteArray)> onDone);
-    bool isNewVersionAvailable() const;
-    void setupNetworkErrorHandling(QNetworkReply* reply, const QString& operation);
-    void handleNetworkError(QNetworkReply* reply, const QString& operation);
-    QString composeDownloadUrl() const;
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-
-    QString m_baseUrl;
-    QString m_changelogText;
-    QString m_version;
-    QString m_releaseDate;
-    QString m_downloadUrl;
-    bool m_updateCheckRunning = false;
-
-#if defined(Q_OS_WINDOWS)
-    int runWindowsInstaller(const QString &installerPath);
-#elif defined(Q_OS_MACOS)
-    int runMacInstaller(const QString &installerPath);
-#elif defined(Q_OS_LINUX) && !defined(Q_OS_ANDROID)
-    int runLinuxInstaller(const QString &installerPath);
-#endif
-};
-
-#endif // UPDATECONTROLLER_H
--- a/client/core/diagnostics/containerDiagnostics.h
+++ b/client/core/diagnostics/containerDiagnostics.h
@@ -1,16 +0,0 @@
-#ifndef CONTAINERDIAGNOSTICS_H
-#define CONTAINERDIAGNOSTICS_H
-
-namespace amnezia
-{
-    struct ContainerDiagnostics
-    {
-        bool available = false;
-        bool portReachable = false;
-
-        virtual ~ContainerDiagnostics() = default;
-    };
-
-} // namespace amnezia
-
-#endif // CONTAINERDIAGNOSTICS_H
--- a/client/core/diagnostics/mtProxyDiagnostics.h
+++ b/client/core/diagnostics/mtProxyDiagnostics.h
@@ -1,18 +0,0 @@
-#ifndef MTPROXYDIAGNOSTICS_H
-#define MTPROXYDIAGNOSTICS_H
-
-#include "containerDiagnostics.h"
-
-#include <QString>
-
-namespace amnezia {
-    struct MtProxyDiagnostics : ContainerDiagnostics {
-        bool upstreamReachable = false;
-        int clientsConnected = -1;
-        QString lastConfigRefresh;
-        QString statsEndpoint;
-    };
-
-} // namespace amnezia
-
-#endif // MTPROXYDIAGNOSTICS_H
--- a/client/core/diagnostics/telemtDiagnostics.h
+++ b/client/core/diagnostics/telemtDiagnostics.h
@@ -1,20 +0,0 @@
-#ifndef TELEMTDIAGNOSTICS_H
-#define TELEMTDIAGNOSTICS_H
-
-#include "containerDiagnostics.h"
-
-#include <QString>
-
-namespace amnezia
-{
-    struct TelemtDiagnostics : ContainerDiagnostics
-    {
-        bool upstreamReachable = false;
-        int clientsConnected = -1;
-        QString lastConfigRefresh;
-        QString statsEndpoint;
-    };
-
-} // namespace amnezia
-
-#endif // TELEMTDIAGNOSTICS_H
--- a/client/core/installers/awgInstaller.cpp
+++ b/client/core/installers/awgInstaller.cpp
@@ -1,10 +1,11 @@
 #include "awgInstaller.h"

+#include <QPair>
 #include <QRandomGenerator>
 #include <QSet>
 #include <QStringList>
+#include <QVector>

-#include "core/configurators/wireguardConfigurator.h"
 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
 #include "core/utils/protocolEnum.h"
@@ -27,57 +28,109 @@ AwgInstaller::AwgInstaller(QObject *parent)
 ContainerConfig AwgInstaller::generateConfig(DockerContainer container, int port, TransportProto transportProto)
 {
    ContainerConfig config = createBaseConfig(container, port, transportProto);
+    
+    bool isAwg2 = (container == DockerContainer::Awg2);
+    
    if (auto* awgConfig = config.getAwgProtocolConfig()) {
-        generateAwgParameters(awgConfig->serverConfig);
-        awgConfig->serverConfig.protocolVersion = protocols::awg::awgV3;
+        generateAwgParameters(awgConfig->serverConfig, isAwg2);
+        
+        if (isAwg2) {
+            awgConfig->serverConfig.protocolVersion = "2";
+        }
    }
+    
    return config;
 }

-void AwgInstaller::generateAwgParameters(AwgServerConfig &serverConfig)
+void AwgInstaller::generateAwgParameters(AwgServerConfig &serverConfig, bool isAwg2)
 {
    QString junkPacketCount = QString::number(QRandomGenerator::global()->bounded(4, 7));
    QString junkPacketMinSize = QString::number(10);
    QString junkPacketMaxSize = QString::number(50);

-    int s1 = QRandomGenerator::global()->bounded(protocols::awg::junkPacketSizeMin, protocols::awg::initPacketJunkSizeMax);
-    int s2 = QRandomGenerator::global()->bounded(protocols::awg::junkPacketSizeMin, protocols::awg::responsePacketJunkSizeMax);
-    int s3 = QRandomGenerator::global()->bounded(protocols::awg::junkPacketSizeMin, protocols::awg::cookieReplyPacketJunkSizeMax);
-    int s4 = protocols::awg::defaultTransportPacketJunkSize;
+    int s1 = QRandomGenerator::global()->bounded(15, 150);
+    int s2 = QRandomGenerator::global()->bounded(15, 150);
+    int s3 = QRandomGenerator::global()->bounded(0, 64);
+    int s4 = QRandomGenerator::global()->bounded(0, 20);

    // Ensure all values are unique and don't create equal packet sizes
-    QSet<int> usedValues { s1, s4 };
+    QSet<int> usedValues;
+    usedValues.insert(s1);

    while (usedValues.contains(s2) || s1 + amnezia::AwgConstant::messageInitiationSize == s2 + amnezia::AwgConstant::messageResponseSize) {
-        s2 = QRandomGenerator::global()->bounded(protocols::awg::junkPacketSizeMin, protocols::awg::responsePacketJunkSizeMax);
+        s2 = QRandomGenerator::global()->bounded(15, 150);
    }
    usedValues.insert(s2);

    while (usedValues.contains(s3) || s1 + amnezia::AwgConstant::messageInitiationSize == s3 + amnezia::AwgConstant::messageCookieReplySize
           || s2 + amnezia::AwgConstant::messageResponseSize == s3 + amnezia::AwgConstant::messageCookieReplySize) {
-        s3 = QRandomGenerator::global()->bounded(protocols::awg::junkPacketSizeMin, protocols::awg::cookieReplyPacketJunkSizeMax);
+        s3 = QRandomGenerator::global()->bounded(0, 64);
+    }
+    usedValues.insert(s3);
+
+    while (usedValues.contains(s4)) {
+        s4 = QRandomGenerator::global()->bounded(0, 20);
+    }
+
+    QString initPacketJunkSize = QString::number(s1);
+    QString responsePacketJunkSize = QString::number(s2);
+    QString cookieReplyPacketJunkSize = QString::number(s3);
+    QString transportPacketJunkSize = QString::number(s4);
+
+    QString initPacketMagicHeader;
+    QString responsePacketMagicHeader;
+    QString underloadPacketMagicHeader;
+    QString transportPacketMagicHeader;
+
+    if (isAwg2) {
+        // AWG 2.0: use range format for magic headers
+        QVector<QPair<QString, QString>> headersValue;
+        int min = 5;
+        auto max = (std::numeric_limits<qint32>::max)();
+        while (headersValue.size() != 4) {
+            auto first = QRandomGenerator::global()->bounded(min, max);
+            auto second = QRandomGenerator::global()->bounded(first, max);
+            min = second;
+            headersValue.push_back(QPair<QString, QString>(QString::number(first), QString::number(second)));
+        }
+
+        initPacketMagicHeader = headersValue.at(0).first + "-" + headersValue.at(0).second;
+        responsePacketMagicHeader = headersValue.at(1).first + "-" + headersValue.at(1).second;
+        underloadPacketMagicHeader = headersValue.at(2).first + "-" + headersValue.at(2).second;
+        transportPacketMagicHeader = headersValue.at(3).first + "-" + headersValue.at(3).second;
+    } else {
+        // AWG legacy: use single values for magic headers
+        QSet<QString> headersValue;
+        while (headersValue.size() != 4) {
+            auto max = (std::numeric_limits<qint32>::max)();
+            headersValue.insert(QString::number(QRandomGenerator::global()->bounded(5, max)));
+        }
+
+        auto headersValueList = headersValue.values();
+        initPacketMagicHeader = headersValueList.at(0);
+        responsePacketMagicHeader = headersValueList.at(1);
+        underloadPacketMagicHeader = headersValueList.at(2);
+        transportPacketMagicHeader = headersValueList.at(3);
    }

    serverConfig.junkPacketCount = junkPacketCount;
    serverConfig.junkPacketMinSize = junkPacketMinSize;
    serverConfig.junkPacketMaxSize = junkPacketMaxSize;
-    serverConfig.initPacketJunkSize = QString::number(s1);
-    serverConfig.responsePacketJunkSize = QString::number(s2);
-    serverConfig.cookieReplyPacketJunkSize = QString::number(s3);
-    serverConfig.transportPacketJunkSize = QString::number(s4);
+    serverConfig.initPacketJunkSize = initPacketJunkSize;
+    serverConfig.responsePacketJunkSize = responsePacketJunkSize;
+    serverConfig.initPacketMagicHeader = initPacketMagicHeader;
+    serverConfig.responsePacketMagicHeader = responsePacketMagicHeader;
+    serverConfig.underloadPacketMagicHeader = underloadPacketMagicHeader;
+    serverConfig.transportPacketMagicHeader = transportPacketMagicHeader;

-    serverConfig.initPacketMagicHeader = protocols::awg::defaultInitPacketMagicHeader;
-    serverConfig.responsePacketMagicHeader = protocols::awg::defaultResponsePacketMagicHeader;
-    serverConfig.underloadPacketMagicHeader = protocols::awg::defaultUnderloadPacketMagicHeader;
-    serverConfig.transportPacketMagicHeader = protocols::awg::defaultTransportPacketMagicHeader;
+    serverConfig.cookieReplyPacketJunkSize = cookieReplyPacketJunkSize;
+    serverConfig.transportPacketJunkSize = transportPacketJunkSize;

-    serverConfig.headerProtectionKey = WireguardConfigurator::genClientKeys().clientPrivKey;
-    serverConfig.contentPaddingAddition = protocols::awg::defaultContentPaddingAddition;
-    serverConfig.rekeyAfterTime = protocols::awg::defaultRekeyAfterTime;
-    serverConfig.rekeyTimeout = protocols::awg::defaultRekeyTimeout;
-    serverConfig.rejectAfterTime = protocols::awg::defaultRejectAfterTime;
-    serverConfig.keepaliveTimeout = protocols::awg::defaultKeepaliveTimeout;
-    serverConfig.maxHandshakeAttempts = protocols::awg::defaultMaxHandshakeAttempts;
+    serverConfig.specialJunk1 = protocols::awg::defaultSpecialJunk1;
+    serverConfig.specialJunk2 = protocols::awg::defaultSpecialJunk2;
+    serverConfig.specialJunk3 = protocols::awg::defaultSpecialJunk3;
+    serverConfig.specialJunk4 = protocols::awg::defaultSpecialJunk4;
+    serverConfig.specialJunk5 = protocols::awg::defaultSpecialJunk5;
 }

 ErrorCode AwgInstaller::extractConfigFromContainer(DockerContainer container, const ServerCredentials &credentials,
@@ -134,20 +187,14 @@ ErrorCode AwgInstaller::extractConfigFromContainer(DockerContainer container, co
        awgConfig->serverConfig.specialJunk4 = serverConfigMap.value(QString("# ") + configKey::specialJunk4);
        awgConfig->serverConfig.specialJunk5 = serverConfigMap.value(QString("# ") + configKey::specialJunk5);

-        awgConfig->serverConfig.cookieReplyPacketJunkSize = serverConfigMap.value(configKey::cookieReplyPacketJunkSize);
-        awgConfig->serverConfig.transportPacketJunkSize = serverConfigMap.value(configKey::transportPacketJunkSize);
-
-        awgConfig->serverConfig.headerProtectionKey = serverConfigMap.value(configKey::headerProtectionKey);
-        awgConfig->serverConfig.contentPaddingAddition = serverConfigMap.value(configKey::contentPaddingAddition);
-        awgConfig->serverConfig.rekeyAfterTime = serverConfigMap.value(configKey::rekeyAfterTime);
-        awgConfig->serverConfig.rekeyTimeout = serverConfigMap.value(configKey::rekeyTimeout);
-        awgConfig->serverConfig.rejectAfterTime = serverConfigMap.value(configKey::rejectAfterTime);
-        awgConfig->serverConfig.keepaliveTimeout = serverConfigMap.value(configKey::keepaliveTimeout);
-        awgConfig->serverConfig.maxHandshakeAttempts = serverConfigMap.value(configKey::maxHandshakeAttempts);
-
-        awgConfig->serverConfig.protocolVersion = awgConfig->serverProtocolVersion();
+        // AWG 2.0 specific fields
+        if (container == DockerContainer::Awg2) {
+            awgConfig->serverConfig.protocolVersion = "2";
+            awgConfig->serverConfig.cookieReplyPacketJunkSize = serverConfigMap.value(configKey::cookieReplyPacketJunkSize);
+            awgConfig->serverConfig.transportPacketJunkSize = serverConfigMap.value(configKey::transportPacketJunkSize);
+        }
    }
-
+    
    return ErrorCode::NoError;
 }

--- a/client/core/installers/awgInstaller.h
+++ b/client/core/installers/awgInstaller.h
@@ -14,7 +14,7 @@ public:
                                         SshSession* serverController, amnezia::ContainerConfig &config) override;

 private:
-    void generateAwgParameters(amnezia::AwgServerConfig &serverConfig);
+    void generateAwgParameters(amnezia::AwgServerConfig &serverConfig, bool isAwg2 = false);
 };

 #endif // AWGINSTALLER_H
--- a/client/core/installers/installerBase.cpp
+++ b/client/core/installers/installerBase.cpp
@@ -14,8 +14,6 @@
 #include "core/models/protocols/xrayProtocolConfig.h"
 #include "core/models/protocols/sftpProtocolConfig.h"
 #include "core/models/protocols/socks5ProxyProtocolConfig.h"
-#include "core/models/protocols/mtProxyProtocolConfig.h"
-#include "core/models/protocols/telemtProtocolConfig.h"
 #include "core/models/protocols/ikev2ProtocolConfig.h"
 #include "core/models/protocols/torProtocolConfig.h"

@@ -56,7 +54,6 @@ ContainerConfig InstallerBase::createBaseConfig(DockerContainer container, int p
            AwgProtocolConfig awgConfig;
            awgConfig.serverConfig.port = portStr;
            awgConfig.serverConfig.transportProto = transportProtoStr;
-            awgConfig.serverConfig.subnetAddress = protocols::wireguard::defaultSubnetAddress;
            config.protocolConfig = awgConfig;
            break;
        }
@@ -64,7 +61,6 @@ ContainerConfig InstallerBase::createBaseConfig(DockerContainer container, int p
            WireGuardProtocolConfig wgConfig;
            wgConfig.serverConfig.port = portStr;
            wgConfig.serverConfig.transportProto = transportProtoStr;
-            wgConfig.serverConfig.subnetAddress = protocols::wireguard::defaultSubnetAddress;
            config.protocolConfig = wgConfig;
            break;
        }
@@ -78,16 +74,8 @@ ContainerConfig InstallerBase::createBaseConfig(DockerContainer container, int p
        case Proto::Xray:
        case Proto::SSXray: {
            XrayProtocolConfig xrayConfig;
-            XrayServerConfig &srv = xrayConfig.serverConfig;
-            srv.port = portStr;
-            srv.transportProto = transportProtoStr;
-            srv.transport = protocols::xray::defaultTransport;
-            srv.security = protocols::xray::defaultSecurity;
-            srv.flow = protocols::xray::defaultFlow;
-            srv.site = protocols::xray::defaultSite;
-            srv.sni = protocols::xray::defaultSni;
-            srv.fingerprint = protocols::xray::defaultFingerprint;
-            srv.alpn = protocols::xray::defaultAlpn;
+            xrayConfig.serverConfig.port = portStr;
+            xrayConfig.serverConfig.transportProto = transportProtoStr;
            config.protocolConfig = xrayConfig;
            break;
        }
@@ -103,18 +91,6 @@ ContainerConfig InstallerBase::createBaseConfig(DockerContainer container, int p
            config.protocolConfig = socks5Config;
            break;
        }
-        case Proto::MtProxy: {
-            MtProxyProtocolConfig mtConfig;
-            mtConfig.port = portStr;
-            config.protocolConfig = mtConfig;
-            break;
-        }
-        case Proto::Telemt: {
-            TelemtProtocolConfig telemtConfig;
-            telemtConfig.port = portStr;
-            config.protocolConfig = telemtConfig;
-            break;
-        }
        case Proto::Ikev2: {
            Ikev2ProtocolConfig ikev2Config;
            config.protocolConfig = ikev2Config;
--- a/client/core/installers/mtProxyInstaller.cpp
+++ b/client/core/installers/mtProxyInstaller.cpp
@@ -1,231 +0,0 @@
-#include "mtProxyInstaller.h"
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/mtProxyProtocolConfig.h"
-
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QJsonParseError>
-#include <QRegularExpression>
-
-#include <QtGlobal>
-
-using namespace amnezia;
-
-namespace {
-    constexpr QLatin1String kMtProxyClientJsonPath("/data/amnezia-mtproxy-client.json");
-    constexpr QLatin1String kMtProxyClientJsonUploadPath("data/amnezia-mtproxy-client.json");
-    constexpr QLatin1String kMtProxySecretPath("/data/secret");
-    constexpr QLatin1String kMtProxyMetaPath("/data/mtproxy-meta");
-    constexpr QLatin1String kMtProxyStartScriptPath("/opt/amnezia/start.sh");
-}
-
-MtProxyInstaller::MtProxyInstaller(QObject *parent)
-        : InstallerBase(parent) {
-}
-
-ErrorCode MtProxyInstaller::extractConfigFromContainer(DockerContainer container, const ServerCredentials &credentials,
-                                                       SshSession *sshSession, ContainerConfig &config) {
-    if (container != DockerContainer::MtProxy || !sshSession) {
-        return ErrorCode::NoError;
-    }
-
-    MtProxyProtocolConfig *mt = config.getMtProxyProtocolConfig();
-    if (!mt) {
-        return ErrorCode::NoError;
-    }
-
-    ErrorCode jsonErr = ErrorCode::NoError;
-    const QByteArray jsonRaw =
-            sshSession->getTextFileFromContainer(container, credentials, QString(kMtProxyClientJsonPath), jsonErr);
-    if (jsonErr == ErrorCode::NoError && !jsonRaw.trimmed().isEmpty()) {
-        QJsonParseError parseError;
-        const QJsonDocument doc = QJsonDocument::fromJson(jsonRaw.trimmed(), &parseError);
-        if (parseError.error == QJsonParseError::NoError && doc.isObject()) {
-            QJsonObject merged = mt->toJson();
-            const QJsonObject snap = doc.object();
-            for (auto it = snap.constBegin(); it != snap.constEnd(); ++it) {
-                merged.insert(it.key(), it.value());
-            }
-            *mt = MtProxyProtocolConfig::fromJson(merged);
-        }
-    }
-
-    static const QRegularExpression hex32(QStringLiteral("^[0-9a-fA-F]{32}$"));
-    const auto addExtra = [&](const QString &s) {
-        if (hex32.match(s).hasMatch() && !mt->additionalSecrets.contains(s)) {
-            mt->additionalSecrets.append(s);
-        }
-    };
-
-    ErrorCode secretErr = ErrorCode::NoError;
-    const QByteArray secretRaw =
-            sshSession->getTextFileFromContainer(container, credentials, QString(kMtProxySecretPath), secretErr);
-    const QString sec = QString::fromUtf8(secretRaw).trimmed();
-    if (sec.length() == 32 && hex32.match(sec).hasMatch()) {
-        mt->secret = sec;
-    }
-
-    bool metaRestored = false;
-    ErrorCode metaErr = ErrorCode::NoError;
-    const QByteArray metaRaw =
-            sshSession->getTextFileFromContainer(container, credentials, QString(kMtProxyMetaPath), metaErr);
-    if (metaErr == ErrorCode::NoError && !metaRaw.trimmed().isEmpty()) {
-        QString mode, domain, workersMode, workers, natInternal, natExternal;
-        bool natEnabled = false;
-        const QList<QByteArray> lines = metaRaw.split('\n');
-        for (const QByteArray &rawLine : lines) {
-            const QString line = QString::fromUtf8(rawLine).trimmed();
-            const int eq = line.indexOf('=');
-            if (eq < 0) {
-                continue;
-            }
-            const QString key = line.left(eq);
-            const QString val = line.mid(eq + 1).trimmed();
-            if (key == QLatin1String("mode")) mode = val;
-            else if (key == QLatin1String("domain")) domain = val;
-            else if (key == QLatin1String("tag")) { if (mt->tag.isEmpty()) mt->tag = val; }
-            else if (key == QLatin1String("additional")) {
-                for (const QString &s : val.split(',', Qt::SkipEmptyParts)) addExtra(s.trimmed());
-            }
-            else if (key == QLatin1String("workers_mode")) workersMode = val;
-            else if (key == QLatin1String("workers")) workers = val;
-            else if (key == QLatin1String("nat_enabled")) natEnabled = (val == QLatin1String("1"));
-            else if (key == QLatin1String("nat_internal")) natInternal = val;
-            else if (key == QLatin1String("nat_external")) natExternal = val;
-            else if (key == QLatin1String("public_host")) { if (mt->publicHost.isEmpty()) mt->publicHost = val; }
-        }
-        if (!mode.isEmpty()) {
-            mt->transportMode = mode;
-            if (!domain.isEmpty()) mt->tlsDomain = domain;
-            if (!workersMode.isEmpty()) mt->workersMode = workersMode;
-            if (workersMode == QLatin1String(protocols::mtProxy::workersModeManual) && !workers.isEmpty()) {
-                mt->workers = workers;
-            }
-            if (natEnabled) {
-                mt->natEnabled = true;
-                mt->natInternalIp = natInternal;
-                mt->natExternalIp = natExternal;
-            }
-            metaRestored = true;
-        }
-    }
-    if (!metaRestored) {
-        ErrorCode startErr = ErrorCode::NoError;
-        const QByteArray startRaw =
-                sshSession->getTextFileFromContainer(container, credentials, QString(kMtProxyStartScriptPath), startErr);
-        if (startErr == ErrorCode::NoError && !startRaw.trimmed().isEmpty()) {
-            const QString start = QString::fromUtf8(startRaw);
-            static const QRegularExpression modeRe(QStringLiteral("\\[ \"(standard|faketls)\" = \"faketls\" \\]"));
-            const QRegularExpressionMatch m = modeRe.match(start);
-            if (m.hasMatch()) {
-                mt->transportMode = m.captured(1);
-                if (m.captured(1) == QLatin1String(protocols::mtProxy::transportModeFakeTLS)) {
-                    static const QRegularExpression domRe(QStringLiteral("--domain ([A-Za-z0-9.\\-]+)"));
-                    const QRegularExpressionMatch dm = domRe.match(start);
-                    if (dm.hasMatch()) mt->tlsDomain = dm.captured(1);
-                }
-            }
-            static const QRegularExpression tagRe(QStringLiteral("-P ([0-9a-fA-F]{32})"));
-            const QRegularExpressionMatch tm = tagRe.match(start);
-            if (tm.hasMatch() && mt->tag.isEmpty()) mt->tag = tm.captured(1);
-
-            static const QRegularExpression addRe(QStringLiteral("echo \"([0-9a-fA-F,]+)\" \\| tr ',' ' '"));
-            const QRegularExpressionMatch am = addRe.match(start);
-            if (am.hasMatch()) {
-                for (const QString &s : am.captured(1).split(',', Qt::SkipEmptyParts)) addExtra(s.trimmed());
-            }
-
-            static const QRegularExpression natRe(QStringLiteral("NAT_VALUE=\"([0-9.]+):([0-9.]+)\""));
-            const QRegularExpressionMatch nm = natRe.match(start);
-            if (nm.hasMatch()) {
-                mt->natEnabled = true;
-                mt->natInternalIp = nm.captured(1);
-                mt->natExternalIp = nm.captured(2);
-            }
-        }
-    }
-
-    return ErrorCode::NoError;
-}
-
-ErrorCode MtProxyInstaller::queryDiagnostics(SshSession &sshSession, const ServerCredentials &credentials,
-                                             DockerContainer container, int listenPort,
-                                             MtProxyContainerDiagnostics &out)
-{
-    out = { };
-    if (container == DockerContainer::MtProxy || container == DockerContainer::Telemt) {
-        const QString containerName = ContainerUtils::containerToString(container);
-        const bool isTelemt = container == DockerContainer::Telemt;
-
-        const QString sportFilter = QString::number(listenPort);
-        const QString peersCmd = QStringLiteral("sudo conntrack -L -p tcp --dport ") + sportFilter
-                + QStringLiteral(" 2>/dev/null | grep ESTABLISHED | awk '{for(i=1;i<=NF;i++) if($i ~ /^src=/){print "
-                                 "substr($i,5); break}}'");
-        const QString publicFilter = QStringLiteral(" | grep -vE "
-                                                    "'^(10\\.|127\\.|169\\.254\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3["
-                                                    "01])\\.|::1$|fe80:|f[cd][0-9a-f][0-9a-f]:)'");
-        const QString clientsCmd =
-                QStringLiteral("CLIENTS=$(") + peersCmd + publicFilter + QStringLiteral(" | sort -u | grep -c .); ");
-        const QString confFile =
-                isTelemt ? QStringLiteral("/data/config.toml") : QStringLiteral("/data/proxy-multi.conf");
-        const QString statsUrl = QString();
-
-        const QString script = QStringLiteral("CN=") + containerName + QStringLiteral("; ")
-                + QStringLiteral("PORT_OK=$(sudo ss -tlnp 2>/dev/null | grep -q :") + QString::number(listenPort)
-                + QStringLiteral(" && echo yes || echo no); ")
-                + QStringLiteral("TG_OK=$(curl -s --max-time 5 -o /dev/null -w '%{http_code}' "
-                                 "https://core.telegram.org/getProxySecret 2>/dev/null | grep -q '200' && echo yes || "
-                                 "echo no); ")
-                + clientsCmd + QStringLiteral("CONF_TIME=$(sudo docker exec \"$CN\" sh -c 'stat -c \"%y\" ") + confFile
-                + QStringLiteral(" 2>/dev/null | cut -d. -f1' 2>/dev/null || echo unknown); ")
-                + QStringLiteral("echo \"PORT_OK=${PORT_OK}\"; ") + QStringLiteral("echo \"TG_OK=${TG_OK}\"; ")
-                + QStringLiteral("echo \"CLIENTS=${CLIENTS:-0}\"; ") + QStringLiteral("echo \"CONF_TIME=${CONF_TIME}\"; ")
-                + QStringLiteral("echo \"STATS=") + statsUrl + QStringLiteral("\";");
-
-        QString stdOut;
-        auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
-            stdOut += data;
-            return ErrorCode::NoError;
-        };
-        const ErrorCode errorCode = sshSession.runScript(credentials, script, cbReadStdOut);
-        if (errorCode != ErrorCode::NoError) {
-            return errorCode;
-        }
-        for (const QString &line : stdOut.split('\n', Qt::SkipEmptyParts)) {
-            if (line.startsWith(QLatin1String("PORT_OK="))) {
-                out.portReachable = line.mid(8).trimmed() == QLatin1String("yes");
-            } else if (line.startsWith(QLatin1String("TG_OK="))) {
-                out.upstreamReachable = line.mid(6).trimmed() == QLatin1String("yes");
-            } else if (line.startsWith(QLatin1String("CLIENTS="))) {
-                out.clientsConnected = line.mid(8).trimmed().toInt();
-            } else if (line.startsWith(QLatin1String("CONF_TIME="))) {
-                out.lastConfigRefresh = line.mid(10).trimmed();
-            } else if (line.startsWith(QLatin1String("STATS="))) {
-                out.statsEndpoint = line.mid(6).trimmed();
-            }
-        }
-        return ErrorCode::NoError;
-    }
-
-    return ErrorCode::InternalError;
-}
-
-void MtProxyInstaller::uploadClientSettingsSnapshot(SshSession &sshSession, const ServerCredentials &credentials,
-                                                    DockerContainer container, const ContainerConfig &config) {
-    const MtProxyProtocolConfig *mt = config.getMtProxyProtocolConfig();
-    if (!mt) {
-        return;
-    }
-    const QByteArray payload = QJsonDocument(mt->toJson()).toJson(QJsonDocument::Compact);
-    const ErrorCode err = sshSession.uploadTextFileToContainer(container, credentials, QString::fromUtf8(payload),
-                                                               QString(kMtProxyClientJsonUploadPath));
-    if (err != ErrorCode::NoError) {
-        qWarning() << "MtProxyInstaller::uploadClientSettingsSnapshot failed" << err;
-    }
-}
--- a/client/core/installers/mtProxyInstaller.h
+++ b/client/core/installers/mtProxyInstaller.h
@@ -1,34 +0,0 @@
-#ifndef MTPROXYINSTALLER_H
-#define MTPROXYINSTALLER_H
-
-#include "installerBase.h"
-
-#include <QString>
-
-struct MtProxyContainerDiagnostics {
-    bool portReachable = false;
-    bool upstreamReachable = false;
-    int clientsConnected = -1;
-    QString lastConfigRefresh;
-    QString statsEndpoint;
-};
-
-class MtProxyInstaller : public InstallerBase {
-Q_OBJECT
-public:
-    explicit MtProxyInstaller(QObject *parent = nullptr);
-
-    amnezia::ErrorCode
-    extractConfigFromContainer(amnezia::DockerContainer container, const amnezia::ServerCredentials &credentials,
-                               SshSession *sshSession, amnezia::ContainerConfig &config) override;
-
-    static void uploadClientSettingsSnapshot(SshSession &sshSession, const amnezia::ServerCredentials &credentials,
-                                             amnezia::DockerContainer container,
-                                             const amnezia::ContainerConfig &config);
-
-    static amnezia::ErrorCode queryDiagnostics(SshSession &sshSession, const amnezia::ServerCredentials &credentials,
-                                               amnezia::DockerContainer container, int listenPort,
-                                               MtProxyContainerDiagnostics &out);
-};
-
-#endif // MTPROXYINSTALLER_H
--- a/client/core/installers/socks5Installer.cpp
+++ b/client/core/installers/socks5Installer.cpp
@@ -1,17 +1,15 @@
 #include "socks5Installer.h"

-#include "core/models/protocols/socks5ProxyProtocolConfig.h"
 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
 #include "core/utils/protocolEnum.h"
+#include "core/utils/protocolEnum.h"
 #include "core/protocols/protocolUtils.h"
 #include "core/utils/constants/configKeys.h"
 #include "core/utils/constants/protocolConstants.h"
 #include "core/utils/selfhosted/sshSession.h"
 #include "core/utils/utilities.h"

-#include <QRegularExpression>
-
 using namespace amnezia;
 using namespace ProtocolUtils;

@@ -35,29 +33,10 @@ ContainerConfig Socks5Installer::generateConfig(DockerContainer container, int p
 ErrorCode Socks5Installer::extractConfigFromContainer(DockerContainer container, const ServerCredentials &credentials,
                                                       SshSession* sshSession, ContainerConfig &config)
 {
-    if (container != DockerContainer::Socks5Proxy || !sshSession) {
-        return ErrorCode::NoError;
-    }
-
-    Socks5ProxyProtocolConfig *socks5Config = config.getSocks5ProxyProtocolConfig();
-    if (!socks5Config) {
-        return ErrorCode::NoError;
-    }
-
-    ErrorCode readError = ErrorCode::NoError;
-    const QByteArray configRaw = sshSession->getTextFileFromContainer(
-            container, credentials, QString::fromUtf8(protocols::socks5Proxy::proxyConfigPath), readError);
-    if (readError != ErrorCode::NoError || configRaw.trimmed().isEmpty()) {
-        return ErrorCode::NoError;
-    }
-
-    const QString proxyConfig = QString::fromUtf8(configRaw);
-    static const QRegularExpression usernameAndPasswordRegExp(QStringLiteral("users (\\w+):CL:(\\w+)"));
-    const QRegularExpressionMatch usernameAndPasswordMatch = usernameAndPasswordRegExp.match(proxyConfig);
-    if (usernameAndPasswordMatch.hasMatch()) {
-        socks5Config->userName = usernameAndPasswordMatch.captured(1);
-        socks5Config->password = usernameAndPasswordMatch.captured(2);
-    }
-
+    Q_UNUSED(container);
+    Q_UNUSED(credentials);
+    Q_UNUSED(sshSession);
+    Q_UNUSED(config);
    return ErrorCode::NoError;
 }
+
--- a/client/core/installers/telemtInstaller.cpp
+++ b/client/core/installers/telemtInstaller.cpp
@@ -1,154 +0,0 @@
-#include "telemtInstaller.h"
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/telemtProtocolConfig.h"
-
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QJsonParseError>
-#include <QRegularExpression>
-
-#include <QtGlobal>
-
-using namespace amnezia;
-
-namespace {
-    constexpr QLatin1String kTelemtClientJsonPath("/data/amnezia-telemt-client.json");
-    constexpr QLatin1String kTelemtClientJsonUploadPath("data/amnezia-telemt-client.json");
-    constexpr QLatin1String kTelemtSecretPath("/data/secret");
-    constexpr QLatin1String kTelemtConfigTomlPath("/data/config.toml");
-}
-
-TelemtInstaller::TelemtInstaller(QObject *parent) : InstallerBase(parent) {}
-
-ErrorCode TelemtInstaller::extractConfigFromContainer(DockerContainer container, const ServerCredentials &credentials,
-                                                      SshSession *sshSession, ContainerConfig &config) {
-    if (container != DockerContainer::Telemt || !sshSession) {
-        return ErrorCode::NoError;
-    }
-
-    TelemtProtocolConfig *tc = config.getTelemtProtocolConfig();
-    if (!tc) {
-        return ErrorCode::NoError;
-    }
-
-    ErrorCode jsonErr = ErrorCode::NoError;
-    const QByteArray jsonRaw =
-            sshSession->getTextFileFromContainer(container, credentials, QString(kTelemtClientJsonPath), jsonErr);
-    if (jsonErr == ErrorCode::NoError && !jsonRaw.trimmed().isEmpty()) {
-        QJsonParseError parseError;
-        const QJsonDocument doc = QJsonDocument::fromJson(jsonRaw.trimmed(), &parseError);
-        if (parseError.error == QJsonParseError::NoError && doc.isObject()) {
-            QJsonObject merged = tc->toJson();
-            const QJsonObject snap = doc.object();
-            for (auto it = snap.constBegin(); it != snap.constEnd(); ++it) {
-                merged.insert(it.key(), it.value());
-            }
-            *tc = TelemtProtocolConfig::fromJson(merged);
-        }
-    }
-
-    ErrorCode secretErr = ErrorCode::NoError;
-    const QByteArray secretRaw =
-            sshSession->getTextFileFromContainer(container, credentials, QString(kTelemtSecretPath), secretErr);
-    const QString sec = QString::fromUtf8(secretRaw).trimmed();
-    static const QRegularExpression hex32(QStringLiteral("^[0-9a-fA-F]{32}$"));
-    if (sec.length() == 32 && hex32.match(sec).hasMatch()) {
-        tc->secret = sec;
-    }
-
-    ErrorCode tomlErr = ErrorCode::NoError;
-    const QByteArray tomlRaw =
-            sshSession->getTextFileFromContainer(container, credentials, QString(kTelemtConfigTomlPath), tomlErr);
-    if (tomlErr == ErrorCode::NoError && !tomlRaw.trimmed().isEmpty()) {
-        QString section;
-        bool userNameSet = false;
-        const QList<QByteArray> lines = tomlRaw.split('\n');
-        for (const QByteArray &rawLine : lines) {
-            const QString line = QString::fromUtf8(rawLine).trimmed();
-            if (line.isEmpty() || line.startsWith('#')) {
-                continue;
-            }
-            if (line.startsWith('[')) {
-                section = line;
-                continue;
-            }
-            const int eq = line.indexOf('=');
-            if (eq < 0) {
-                continue;
-            }
-            const QString key = line.left(eq).trimmed();
-            QString val = line.mid(eq + 1).trimmed();
-            if (val.startsWith('"')) {
-                const int last = val.lastIndexOf('"');
-                val = (last > 0) ? val.mid(1, last - 1) : val.mid(1);
-            } else {
-                const int inlineComment = val.indexOf(QLatin1String(" #"));
-                if (inlineComment >= 0) {
-                    val = val.left(inlineComment).trimmed();
-                }
-            }
-
-            if (section == QLatin1String("[access.users]")) {
-                if (key.startsWith(QLatin1String("extra"))) {
-                    if (hex32.match(val).hasMatch() && !tc->additionalSecrets.contains(val)) {
-                        tc->additionalSecrets.append(val);
-                    }
-                } else if (!userNameSet) {
-                    tc->userName = key;
-                    userNameSet = true;
-                    if (tc->secret.isEmpty() && hex32.match(val).hasMatch()) {
-                        tc->secret = val;
-                    }
-                }
-                continue;
-            }
-
-            if (key == QLatin1String("tls") && section == QLatin1String("[general.modes]")) {
-                tc->transportMode = (val == QLatin1String("true"))
-                        ? QString::fromUtf8(protocols::telemt::transportModeFakeTLS)
-                        : QString::fromUtf8(protocols::telemt::transportModeStandard);
-            } else if (key == QLatin1String("tls_domain") && section == QLatin1String("[censorship]")) {
-                tc->tlsDomain = val;
-            } else if (key == QLatin1String("mask") && section == QLatin1String("[censorship]")) {
-                tc->maskEnabled = (val == QLatin1String("true"));
-            } else if (key == QLatin1String("tls_emulation") && section == QLatin1String("[censorship]")) {
-                tc->tlsEmulation = (val == QLatin1String("true"));
-            } else if (key == QLatin1String("use_middle_proxy") && section == QLatin1String("[general]")) {
-                tc->useMiddleProxy = (val == QLatin1String("true"));
-            } else if (key == QLatin1String("middle_proxy_nat_ip") && section == QLatin1String("[general]")) {
-                if (!val.isEmpty()) {
-                    tc->natExternalIp = val;
-                    tc->natEnabled = true;
-                }
-            } else if (key == QLatin1String("ad_tag") && section == QLatin1String("[general]") && tc->tag.isEmpty()) {
-                tc->tag = val;
-            } else if (key == QLatin1String("public_host") && section == QLatin1String("[general.links]")
-                       && tc->publicHost.isEmpty()) {
-                tc->publicHost = val;
-            } else if (key == QLatin1String("port") && section == QLatin1String("[server]") && tc->port.isEmpty()) {
-                tc->port = val;
-            }
-        }
-    }
-
-    return ErrorCode::NoError;
-}
-
-void TelemtInstaller::uploadClientSettingsSnapshot(SshSession &sshSession, const ServerCredentials &credentials,
-                                                   DockerContainer container, const ContainerConfig &config) {
-    const TelemtProtocolConfig *tc = config.getTelemtProtocolConfig();
-    if (!tc) {
-        return;
-    }
-    const QByteArray payload = QJsonDocument(tc->toJson()).toJson(QJsonDocument::Compact);
-    const ErrorCode err = sshSession.uploadTextFileToContainer(container, credentials, QString::fromUtf8(payload),
-                                                               QString(kTelemtClientJsonUploadPath));
-    if (err != ErrorCode::NoError) {
-        qWarning() << "TelemtInstaller::uploadClientSettingsSnapshot failed" << err;
-    }
-}
--- a/client/core/installers/telemtInstaller.h
+++ b/client/core/installers/telemtInstaller.h
@@ -1,20 +0,0 @@
-#ifndef TELEMTINSTALLER_H
-#define TELEMTINSTALLER_H
-
-#include "installerBase.h"
-
-class TelemtInstaller : public InstallerBase {
-Q_OBJECT
-public:
-    explicit TelemtInstaller(QObject *parent = nullptr);
-
-    amnezia::ErrorCode
-    extractConfigFromContainer(amnezia::DockerContainer container, const amnezia::ServerCredentials &credentials,
-                               SshSession *sshSession, amnezia::ContainerConfig &config) override;
-
-    static void uploadClientSettingsSnapshot(SshSession &sshSession, const amnezia::ServerCredentials &credentials,
-                                             amnezia::DockerContainer container,
-                                             const amnezia::ContainerConfig &config);
-};
-
-#endif // TELEMTINSTALLER_H
--- a/client/core/installers/xrayInstaller.cpp
+++ b/client/core/installers/xrayInstaller.cpp
@@ -14,43 +14,8 @@
 #include "core/models/protocols/xrayProtocolConfig.h"
 #include "logger.h"

-namespace
-{
+namespace {
    Logger logger("XrayInstaller");
-
-    // Xray expects uTLS preset names (chrome, firefox, …). Old Amnezia/server templates used "Mozilla/5.0".
-    QString normalizeXrayFingerprint(const QString &fp)
-    {
-        if (fp.isEmpty() || fp.contains(QLatin1String("Mozilla/5.0"), Qt::CaseInsensitive)) {
-            return QString::fromLatin1(protocols::xray::defaultFingerprint);
-        }
-        return fp;
-    }
-
-    // Parse an xray int range: "from-to" string, plain int, or legacy {from,to} object.
-    void parseIntRange(const QJsonValue &v, QString &minOut, QString &maxOut)
-    {
-        if (v.isString()) {
-            const QString s = v.toString().trimmed();
-            const int dash = s.indexOf(QLatin1Char('-'), 1);
-            if (dash > 0) {
-                minOut = s.left(dash).trimmed();
-                maxOut = s.mid(dash + 1).trimmed();
-            } else if (!s.isEmpty()) {
-                minOut = s;
-                maxOut = s;
-            }
-        } else if (v.isDouble()) {
-            minOut = QString::number(v.toInt());
-            maxOut = minOut;
-        } else if (v.isObject()) {
-            const QJsonObject o = v.toObject();
-            if (o.contains(QLatin1String("from")) || o.contains(QLatin1String("to"))) {
-                minOut = QString::number(o.value(QLatin1String("from")).toInt());
-                maxOut = QString::number(o.value(QLatin1String("to")).toInt());
-            }
-        }
-    }
 }

 using namespace amnezia;
@@ -98,249 +63,18 @@ ErrorCode XrayInstaller::extractConfigFromContainer(DockerContainer container, c
    }

    QJsonObject streamSettings = inbound[protocols::xray::streamSettings].toObject();
-    auto *xrayConfig = config.getXrayProtocolConfig();
-    if (!xrayConfig) {
-        logger.error() << "No XrayProtocolConfig in ContainerConfig";
+    QJsonObject realitySettings = streamSettings[protocols::xray::realitySettings].toObject();
+    if (!realitySettings.contains(protocols::xray::serverNames)) {
+        logger.error() << "Settings missing 'serverNames' field";
        return ErrorCode::InternalError;
    }

-    XrayServerConfig &srv = xrayConfig->serverConfig;
+    QString siteName = realitySettings[protocols::xray::serverNames][0].toString();

-    // ── Port ─────────────────────────────────────────────────────────
-    if (inbound.contains(protocols::xray::port)) {
-        srv.port = QString::number(inbound[protocols::xray::port].toInt());
+    if (auto* xrayConfig = config.getXrayProtocolConfig()) {
+        xrayConfig->serverConfig.site = siteName;
    }
-
-    // ── Network (transport) ───────────────────────────────────────────
-    QString networkVal = streamSettings.value(protocols::xray::network).toString("tcp");
-    if (networkVal == "xhttp") {
-        srv.transport = "xhttp";
-    } else if (networkVal == "kcp") {
-        srv.transport = "mkcp";
-    } else {
-        srv.transport = "raw";
-    }
-
-    // ── Security ──────────────────────────────────────────────────────
-    srv.security = streamSettings.value(protocols::xray::security).toString("reality");
-
-    // ── Reality settings ──────────────────────────────────────────────
-    if (srv.security == "reality") {
-        QJsonObject rs = streamSettings.value(protocols::xray::realitySettings).toObject();
-
-        // serverNames array → site + sni
-        if (rs.contains(protocols::xray::serverNames)) {
-            QString sniVal = rs[protocols::xray::serverNames].toArray().first().toString();
-            srv.sni = sniVal;
-            srv.site = sniVal;
-        } else if (rs.contains(protocols::xray::serverName)) {
-            srv.sni = rs[protocols::xray::serverName].toString();
-            srv.site = srv.sni;
-        }
-
-        srv.fingerprint = normalizeXrayFingerprint(rs.value(protocols::xray::fingerprint).toString());
-    }
-
-    // ── TLS settings ──────────────────────────────────────────────────
-    if (srv.security == "tls") {
-        QJsonObject tls = streamSettings.value("tlsSettings").toObject();
-        srv.sni = tls.value(protocols::xray::serverName).toString();
-        srv.fingerprint = normalizeXrayFingerprint(tls.value(protocols::xray::fingerprint).toString());
-
-        QJsonArray alpnArr = tls.value("alpn").toArray();
-        QStringList alpnList;
-        for (const QJsonValue &v : alpnArr) {
-            QString t = v.toString().trimmed();
-            if (t.compare(QLatin1String("HTTP/2"), Qt::CaseInsensitive) == 0)
-                t = QStringLiteral("h2");
-            else if (t.compare(QLatin1String("HTTP/1.1"), Qt::CaseInsensitive) == 0)
-                t = QStringLiteral("http/1.1");
-            if (!t.isEmpty())
-                alpnList << t;
-        }
-        srv.alpn = alpnList.join(",");
-    }
-
-    // ── Flow (from users array) ───────────────────────────────────────
-    if (inbound.contains(protocols::xray::settings)) {
-        QJsonObject s = inbound[protocols::xray::settings].toObject();
-        QJsonArray clientsArr = s.value(protocols::xray::clients).toArray();
-        if (!clientsArr.isEmpty()) {
-            srv.flow = clientsArr[0].toObject().value(protocols::xray::flow).toString();
-        }
-    }
-
-    // ── XHTTP settings (Xray-core SplitHTTPConfig + legacy Amnezia keys) ──
-    if (srv.transport == "xhttp") {
-        QJsonObject xhttpObj = streamSettings.value("xhttpSettings").toObject();
-        {
-            const QString m = xhttpObj.value("mode").toString();
-            if (m.isEmpty() || m == QLatin1String("auto"))
-                srv.xhttp.mode = QStringLiteral("Auto");
-            else if (m == QLatin1String("packet-up"))
-                srv.xhttp.mode = QStringLiteral("Packet-up");
-            else if (m == QLatin1String("stream-up"))
-                srv.xhttp.mode = QStringLiteral("Stream-up");
-            else if (m == QLatin1String("stream-one"))
-                srv.xhttp.mode = QStringLiteral("Stream-one");
-            else
-                srv.xhttp.mode = m;
-        }
-
-        srv.xhttp.host = xhttpObj.value("host").toString();
-        srv.xhttp.path = xhttpObj.value("path").toString();
-
-        if (xhttpObj.contains(QLatin1String("uplinkHTTPMethod")))
-            srv.xhttp.uplinkMethod = xhttpObj.value("uplinkHTTPMethod").toString();
-        else
-            srv.xhttp.uplinkMethod = xhttpObj.value("method").toString();
-
-        srv.xhttp.disableGrpc = xhttpObj.value("noGRPCHeader").toBool(true);
-        srv.xhttp.disableSse = xhttpObj.value("noSSEHeader").toBool(true);
-
-        auto sessionSeqUi = [](const QString &core) -> QString {
-            if (core.isEmpty() || core == QLatin1String("path"))
-                return QStringLiteral("Path");
-            if (core == QLatin1String("cookie"))
-                return QStringLiteral("Cookie");
-            if (core == QLatin1String("header"))
-                return QStringLiteral("Header");
-            if (core == QLatin1String("query"))
-                return QStringLiteral("Query");
-            return core;
-        };
-        QString sess = xhttpObj.value("sessionIDPlacement").toString();
-        if (sess.isEmpty())
-            sess = xhttpObj.value("sessionPlacement").toString();
-        if (sess.isEmpty())
-            sess = xhttpObj.value("scSessionPlacement").toString();
-        srv.xhttp.sessionPlacement = sessionSeqUi(sess);
-
-        QString seq = xhttpObj.value("seqPlacement").toString();
-        if (seq.isEmpty())
-            seq = xhttpObj.value("scSeqPlacement").toString();
-        srv.xhttp.seqPlacement = sessionSeqUi(seq);
-
-        auto uplinkDataUi = [](const QString &core) -> QString {
-            if (core.isEmpty() || core == QLatin1String("body"))
-                return QStringLiteral("Body");
-            if (core == QLatin1String("auto"))
-                return QStringLiteral("Auto");
-            if (core == QLatin1String("header"))
-                return QStringLiteral("Header");
-            if (core == QLatin1String("cookie"))
-                return QStringLiteral("Cookie");
-            return core;
-        };
-        QString udata = xhttpObj.value("uplinkDataPlacement").toString();
-        if (udata.isEmpty())
-            udata = xhttpObj.value("scUplinkDataPlacement").toString();
-        srv.xhttp.uplinkDataPlacement = uplinkDataUi(udata);
-
-        srv.xhttp.sessionKey = xhttpObj.value("sessionIDKey").toString();
-        if (srv.xhttp.sessionKey.isEmpty())
-            srv.xhttp.sessionKey = xhttpObj.value("sessionKey").toString();
-        srv.xhttp.seqKey = xhttpObj.value("seqKey").toString();
-        srv.xhttp.uplinkDataKey = xhttpObj.value("uplinkDataKey").toString();
-
-        if (xhttpObj.contains(QLatin1String("uplinkChunkSize"))) {
-            QString ucMin, ucMax;
-            parseIntRange(xhttpObj.value("uplinkChunkSize"), ucMin, ucMax);
-            if (!ucMin.isEmpty())
-                srv.xhttp.uplinkChunkSize = ucMin;
-        } else if (xhttpObj.contains(QLatin1String("xhttpUplinkChunkSize"))) {
-            srv.xhttp.uplinkChunkSize = QString::number(xhttpObj.value("xhttpUplinkChunkSize").toInt());
-        }
-        if (xhttpObj.contains(QLatin1String("scMaxBufferedPosts"))) {
-            srv.xhttp.scMaxBufferedPosts = QString::number(xhttpObj.value("scMaxBufferedPosts").toVariant().toLongLong());
-        }
-
-        auto readRange = [&](const char *key, QString &minOut, QString &maxOut) {
-            parseIntRange(xhttpObj.value(QLatin1String(key)), minOut, maxOut);
-        };
-        readRange("scMaxEachPostBytes", srv.xhttp.scMaxEachPostBytesMin, srv.xhttp.scMaxEachPostBytesMax);
-        readRange("scMinPostsIntervalMs", srv.xhttp.scMinPostsIntervalMsMin, srv.xhttp.scMinPostsIntervalMsMax);
-        readRange("scStreamUpServerSecs", srv.xhttp.scStreamUpServerSecsMin, srv.xhttp.scStreamUpServerSecsMax);
-
-        auto loadPaddingFromObject = [&](const QJsonObject &pad) {
-            if (pad.contains(QLatin1String("xPaddingObfsMode")))
-                srv.xhttp.xPadding.obfsMode = pad.value("xPaddingObfsMode").toBool(true);
-            srv.xhttp.xPadding.key = pad.value("xPaddingKey").toString();
-            srv.xhttp.xPadding.header = pad.value("xPaddingHeader").toString();
-            srv.xhttp.xPadding.placement = pad.value("xPaddingPlacement").toString();
-            srv.xhttp.xPadding.method = pad.value("xPaddingMethod").toString();
-            QString bytesMin, bytesMax;
-            parseIntRange(pad.value("xPaddingBytes"), bytesMin, bytesMax);
-            if (!bytesMin.isEmpty()) {
-                srv.xhttp.xPadding.bytesMin = bytesMin;
-                srv.xhttp.xPadding.bytesMax = bytesMax;
-            }
-            QString pl = srv.xhttp.xPadding.placement.toLower();
-            if (pl == QLatin1String("cookie"))
-                srv.xhttp.xPadding.placement = QStringLiteral("Cookie");
-            else if (pl == QLatin1String("header"))
-                srv.xhttp.xPadding.placement = QStringLiteral("Header");
-            else if (pl == QLatin1String("query"))
-                srv.xhttp.xPadding.placement = QStringLiteral("Query");
-            else if (pl == QLatin1String("queryinheader"))
-                srv.xhttp.xPadding.placement = QStringLiteral("Query in header");
-            QString met = srv.xhttp.xPadding.method.toLower();
-            if (met == QLatin1String("repeat-x"))
-                srv.xhttp.xPadding.method = QStringLiteral("Repeat-x");
-            else if (met == QLatin1String("tokenish"))
-                srv.xhttp.xPadding.method = QStringLiteral("Tokenish");
-        };
-        if (xhttpObj.contains(QLatin1String("xPaddingObfsMode")) || xhttpObj.contains(QLatin1String("xPaddingKey"))
-            || xhttpObj.contains(QLatin1String("xPaddingBytes"))) {
-            loadPaddingFromObject(xhttpObj);
-        } else if (xhttpObj.contains(QLatin1String("xPadding")) && xhttpObj.value("xPadding").isObject()) {
-            const QJsonObject nested = xhttpObj.value("xPadding").toObject();
-            if (!nested.isEmpty()) {
-                loadPaddingFromObject(nested);
-                if (!nested.contains(QLatin1String("xPaddingObfsMode")))
-                    srv.xhttp.xPadding.obfsMode = true;
-            }
-        }
-
-        if (xhttpObj.contains(QLatin1String("xmux"))) {
-            QJsonObject mux = xhttpObj.value("xmux").toObject();
-            srv.xhttp.xmux.enabled = true;
-
-            auto readMuxRange = [&](const char *key, QString &minOut, QString &maxOut) {
-                parseIntRange(mux.value(QLatin1String(key)), minOut, maxOut);
-            };
-            readMuxRange("maxConcurrency", srv.xhttp.xmux.maxConcurrencyMin, srv.xhttp.xmux.maxConcurrencyMax);
-            readMuxRange("maxConnections", srv.xhttp.xmux.maxConnectionsMin, srv.xhttp.xmux.maxConnectionsMax);
-            readMuxRange("cMaxReuseTimes", srv.xhttp.xmux.cMaxReuseTimesMin, srv.xhttp.xmux.cMaxReuseTimesMax);
-            readMuxRange("hMaxRequestTimes", srv.xhttp.xmux.hMaxRequestTimesMin, srv.xhttp.xmux.hMaxRequestTimesMax);
-            readMuxRange("hMaxReusableSecs", srv.xhttp.xmux.hMaxReusableSecsMin, srv.xhttp.xmux.hMaxReusableSecsMax);
-
-            if (mux.contains(QLatin1String("hKeepAlivePeriod")))
-                srv.xhttp.xmux.hKeepAlivePeriod = QString::number(mux.value("hKeepAlivePeriod").toVariant().toLongLong());
-        }
-    }
-
-    // ── mKCP settings ─────────────────────────────────────────────────
-    if (srv.transport == "mkcp") {
-        QJsonObject kcp = streamSettings.value("kcpSettings").toObject();
-        if (kcp.contains("tti")) {
-            srv.mkcp.tti = QString::number(kcp["tti"].toInt());
-        }
-        if (kcp.contains("uplinkCapacity")) {
-            srv.mkcp.uplinkCapacity = QString::number(kcp["uplinkCapacity"].toInt());
-        }
-        if (kcp.contains("downlinkCapacity")) {
-            srv.mkcp.downlinkCapacity = QString::number(kcp["downlinkCapacity"].toInt());
-        }
-        if (kcp.contains("readBufferSize")) {
-            srv.mkcp.readBufferSize = QString::number(kcp["readBufferSize"].toInt());
-        }
-        if (kcp.contains("writeBufferSize")) {
-            srv.mkcp.writeBufferSize = QString::number(kcp["writeBufferSize"].toInt());
-        }
-        srv.mkcp.congestion = kcp.value("congestion").toBool(true);
-    }
-
+    
    return ErrorCode::NoError;
 }

--- a/client/core/models/api/apiConfig.cpp
+++ b/client/core/models/api/apiConfig.cpp
@@ -144,6 +144,10 @@ QJsonObject ApiConfig::toJson() const
        obj[apiDefs::key::availableCountries] = availableCountries;
    }
    
+    if (!supportedProtocols.isEmpty()) {
+        obj[apiDefs::key::supportedProtocols] = supportedProtocols;
+    }
+    
    QJsonObject serviceInfoObj = serviceInfo.toJson();
    if (!serviceInfoObj.isEmpty()) {
        obj[apiDefs::key::serviceInfo] = serviceInfoObj;
@@ -194,6 +198,7 @@ ApiConfig ApiConfig::fromJson(const QJsonObject& json)
    config.issuedConfigs = json.value(apiDefs::key::issuedConfigs).toInt(0);
    
    config.availableCountries = json.value(apiDefs::key::availableCountries).toArray();
+    config.supportedProtocols = json.value(apiDefs::key::supportedProtocols).toArray();
    
    QJsonObject serviceInfoObj = json.value(apiDefs::key::serviceInfo).toObject();
    if (!serviceInfoObj.isEmpty()) {
--- a/client/core/models/api/apiConfig.h
+++ b/client/core/models/api/apiConfig.h
@@ -6,7 +6,7 @@
 #include <QString>
 #include <QDateTime>

-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/api/apiEnums.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"

@@ -34,6 +34,7 @@ struct ApiConfig
    int maxDeviceCount;
    int issuedConfigs;
    QJsonArray availableCountries;
+    QJsonArray supportedProtocols;
    
    struct ServiceInfo {
        bool isAdVisible = false;
@@ -57,7 +58,7 @@ struct ApiConfig
    
    QString stackType;
    QString cliVersion;
-    bool isTestPurchase = false;
+    bool isTestPurchase;
    bool isInAppPurchase = false;
    bool subscriptionExpiredByServer = false;
    
--- a/client/core/models/api/apiV1ServerConfig.cpp
+++ b/client/core/models/api/apiV1ServerConfig.cpp
@@ -0,0 +1,140 @@
+#include "apiV1ServerConfig.h"
+
+#include <QJsonArray>
+#include <QJsonDocument>
+
+#include "core/utils/containerEnum.h"
+#include "core/utils/containers/containerUtils.h"
+#include "core/utils/protocolEnum.h"
+#include "core/utils/protocolEnum.h"
+#include "core/protocols/protocolUtils.h"
+#include "core/utils/constants/apiKeys.h"
+#include "core/utils/constants/configKeys.h"
+#include "core/utils/constants/protocolConstants.h"
+#include "core/utils/api/apiUtils.h"
+
+namespace amnezia
+{
+
+using namespace ContainerEnumNS;
+
+bool ApiV1ServerConfig::isPremium() const
+{
+    constexpr QLatin1String premiumV1Endpoint(PREM_V1_ENDPOINT);
+    return apiEndpoint.contains(premiumV1Endpoint);
+}
+
+bool ApiV1ServerConfig::isFree() const
+{
+    constexpr QLatin1String freeV2Endpoint(FREE_V2_ENDPOINT);
+    return apiEndpoint.contains(freeV2Endpoint);
+}
+
+QString ApiV1ServerConfig::vpnKey() const
+{
+    QJsonObject json = toJson();
+    return apiUtils::getPremiumV1VpnKey(json);
+}
+
+bool ApiV1ServerConfig::hasContainers() const
+{
+    return !containers.isEmpty();
+}
+
+ContainerConfig ApiV1ServerConfig::containerConfig(DockerContainer container) const
+{
+    if (!containers.contains(container)) {
+        return ContainerConfig{};
+    }
+    return containers.value(container);
+}
+
+QJsonObject ApiV1ServerConfig::toJson() const
+{
+    QJsonObject obj;
+    
+    if (!name.isEmpty()) {
+        obj[configKey::name] = name;
+    }
+    if (!description.isEmpty()) {
+        obj[configKey::description] = description;
+    }
+    if (!protocol.isEmpty()) {
+        obj[apiDefs::key::protocol] = protocol;
+    }
+    if (!apiEndpoint.isEmpty()) {
+        obj[apiDefs::key::apiEndpoint] = apiEndpoint;
+    }
+    if (!apiKey.isEmpty()) {
+        obj[apiDefs::key::apiKey] = apiKey;
+    }
+    
+    obj[configKey::configVersion] = configVersion;
+    
+    if (!hostName.isEmpty()) {
+        obj[configKey::hostName] = hostName;
+    }
+    
+    QJsonArray containersArray;
+    for (auto it = containers.begin(); it != containers.end(); ++it) {
+        QJsonObject containerObj = it.value().toJson();
+        containersArray.append(containerObj);
+    }
+    if (!containersArray.isEmpty()) {
+        obj[configKey::containers] = containersArray;
+    }
+    
+    if (defaultContainer != DockerContainer::None) {
+        obj[configKey::defaultContainer] = ContainerUtils::containerToString(defaultContainer);
+    }
+    
+    if (!dns1.isEmpty()) {
+        obj[configKey::dns1] = dns1;
+    }
+    if (!dns2.isEmpty()) {
+        obj[configKey::dns2] = dns2;
+    }
+    
+    if (crc > 0) {
+        obj[configKey::crc] = crc;
+    }
+    
+    return obj;
+}
+
+ApiV1ServerConfig ApiV1ServerConfig::fromJson(const QJsonObject& json)
+{
+    ApiV1ServerConfig config;
+    
+    config.name = json.value(configKey::name).toString();
+    config.description = json.value(configKey::description).toString();
+    config.protocol = json.value(apiDefs::key::protocol).toString();
+    config.apiEndpoint = json.value(apiDefs::key::apiEndpoint).toString();
+    config.apiKey = json.value(apiDefs::key::apiKey).toString();
+    config.configVersion = json.value(configKey::configVersion).toInt(1);
+    config.hostName = json.value(configKey::hostName).toString();
+    
+    QJsonArray containersArray = json.value(configKey::containers).toArray();
+    for (const QJsonValue& val : containersArray) {
+        QJsonObject containerObj = val.toObject();
+        ContainerConfig containerConfig = ContainerConfig::fromJson(containerObj);
+        
+        QString containerStr = containerObj.value(configKey::container).toString();
+        DockerContainer container = ContainerUtils::containerFromString(containerStr);
+        
+        config.containers.insert(container, containerConfig);
+    }
+    
+    QString defaultContainerStr = json.value(configKey::defaultContainer).toString();
+    config.defaultContainer = ContainerUtils::containerFromString(defaultContainerStr);
+    
+    config.dns1 = json.value(configKey::dns1).toString();
+    config.dns2 = json.value(configKey::dns2).toString();
+    
+    config.crc = json.value(configKey::crc).toInt(0);
+    
+    return config;
+}
+
+} // namespace amnezia
+
--- a/client/core/models/api/apiV1ServerConfig.h
+++ b/client/core/models/api/apiV1ServerConfig.h
@@ -0,0 +1,47 @@
+#ifndef APIV1SERVERCONFIG_H
+#define APIV1SERVERCONFIG_H
+
+#include <QJsonObject>
+#include <QMap>
+
+#include "core/utils/containerEnum.h"
+#include "core/utils/containers/containerUtils.h"
+#include "core/utils/protocolEnum.h"
+#include "core/models/containerConfig.h"
+#include "core/utils/api/apiEnums.h"
+#include "core/utils/constants/apiKeys.h"
+#include "core/utils/constants/apiConstants.h"
+
+namespace amnezia
+{
+
+using namespace ContainerEnumNS;
+
+struct ApiV1ServerConfig {
+    QString description;
+    QString hostName;
+    QMap<DockerContainer, ContainerConfig> containers;
+    DockerContainer defaultContainer;
+    QString dns1;
+    QString dns2;
+    
+    QString name;
+    QString protocol;
+    QString apiEndpoint;
+    QString apiKey;
+    int crc;
+    int configVersion;
+    
+    bool isPremium() const;
+    bool isFree() const;
+    QString vpnKey() const;
+    bool hasContainers() const;
+    ContainerConfig containerConfig(DockerContainer container) const;
+    QJsonObject toJson() const;
+    static ApiV1ServerConfig fromJson(const QJsonObject& json);
+};
+
+} // namespace amnezia
+
+#endif // APIV1SERVERCONFIG_H
+
--- a/client/core/models/api/apiV2ServerConfig.cpp
+++ b/client/core/models/api/apiV2ServerConfig.cpp
@@ -13,7 +13,6 @@
 #include "core/utils/api/apiUtils.h"
 #include "core/models/api/apiConfig.h"
 #include "core/models/api/authData.h"
-#include "core/utils/networkUtilities.h"

 namespace amnezia
 {
@@ -68,20 +67,6 @@ ContainerConfig ApiV2ServerConfig::containerConfig(DockerContainer container) co
    return containers.value(container);
 }

-QPair<QString, QString> ApiV2ServerConfig::getDnsPair(const QString &primaryDns, const QString &secondaryDns) const
-{
-    QString d1 = dns1;
-    QString d2 = dns2;
-
-    if (d1.isEmpty() || !NetworkUtilities::checkIPv4Format(d1)) {
-        d1 = primaryDns;
-    }
-    if (d2.isEmpty() || !NetworkUtilities::checkIPv4Format(d2)) {
-        d2 = secondaryDns;
-    }
-    return { d1, d2 };
-}
-
 QJsonObject ApiV2ServerConfig::toJson() const
 {
    QJsonObject obj;
@@ -121,11 +106,7 @@ QJsonObject ApiV2ServerConfig::toJson() const
    if (!dns2.isEmpty()) {
        obj[configKey::dns2] = dns2;
    }
-
-    if (!sendPayload.isEmpty()) {
-        obj[configKey::sendPayload] = sendPayload;
-    }
-
+    
    if (crc > 0) {
        obj[configKey::crc] = crc;
    }
@@ -169,7 +150,6 @@ ApiV2ServerConfig ApiV2ServerConfig::fromJson(const QJsonObject& json)
    
    config.dns1 = json.value(configKey::dns1).toString();
    config.dns2 = json.value(configKey::dns2).toString();
-    config.sendPayload = json.value(configKey::sendPayload).toArray();
    
    config.crc = json.value(configKey::crc).toInt(0);
    
@@ -183,10 +163,6 @@ ApiV2ServerConfig ApiV2ServerConfig::fromJson(const QJsonObject& json)
        config.authData = AuthData::fromJson(authDataObj);
    }
    
-    if (config.displayName.isEmpty()) {
-        config.displayName = config.name.isEmpty() ? config.description : config.name;
-    }
-    
    return config;
 }

--- a/client/core/models/api/apiV2ServerConfig.h
+++ b/client/core/models/api/apiV2ServerConfig.h
@@ -1,10 +1,8 @@
 #ifndef APIV2SERVERCONFIG_H
 #define APIV2SERVERCONFIG_H

-#include <QJsonArray>
 #include <QJsonObject>
 #include <QMap>
-#include <QPair>

 #include "core/utils/containerEnum.h"
 #include "core/utils/containers/containerUtils.h"
@@ -12,7 +10,7 @@
 #include "core/models/containerConfig.h"
 #include "core/models/api/apiConfig.h"
 #include "core/models/api/authData.h"
-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/api/apiEnums.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"

@@ -23,13 +21,11 @@ using namespace ContainerEnumNS;

 struct ApiV2ServerConfig {
    QString description;
-    QString displayName;
    QString hostName;
    QMap<DockerContainer, ContainerConfig> containers;
    DockerContainer defaultContainer;
    QString dns1;
    QString dns2;
-    QJsonArray sendPayload;
    
    QString name;
    bool nameOverriddenByUser = false;
@@ -46,9 +42,6 @@ struct ApiV2ServerConfig {
    bool isExternalPremium() const;
    bool hasContainers() const;
    ContainerConfig containerConfig(DockerContainer container) const;
-
-    QPair<QString, QString> getDnsPair(const QString &primaryDns, const QString &secondaryDns) const;
-
    QJsonObject toJson() const;
    static ApiV2ServerConfig fromJson(const QJsonObject& json);
 };
--- a/client/core/models/api/authData.h
+++ b/client/core/models/api/authData.h
@@ -4,7 +4,7 @@
 #include <QJsonObject>
 #include <QString>

-#include "core/utils/serverConfigUtils.h"
+#include "core/utils/api/apiEnums.h"
 #include "core/utils/constants/apiKeys.h"
 #include "core/utils/constants/apiConstants.h"

--- a/client/core/models/api/legacyApiServerConfig.cpp
+++ b/client/core/models/api/legacyApiServerConfig.cpp
@@ -1,41 +0,0 @@
-#include "legacyApiServerConfig.h"
-
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/constants/configKeys.h"
-
-namespace amnezia
-{
-
-bool LegacyApiServerConfig::hasContainers() const
-{
-    return !containers.isEmpty();
-}
-
-ContainerConfig LegacyApiServerConfig::containerConfig(DockerContainer container) const
-{
-    if (!containers.contains(container)) {
-        return ContainerConfig{};
-    }
-    return containers.value(container);
-}
-
-LegacyApiServerConfig LegacyApiServerConfig::fromJson(const QJsonObject &json)
-{
-    LegacyApiServerConfig config;
-
-    config.description = json.value(configKey::description).toString();
-    config.hostName = json.value(configKey::hostName).toString();
-
-    config.crc = json.value(configKey::crc).toInt(0);
-
-    config.configVersion = json.value(configKey::configVersion).toInt(1);
-    config.apiEndpoint = json.value(apiDefs::key::apiEndpoint).toString();
-
-    if (config.displayName.isEmpty()) {
-        config.displayName = config.name.isEmpty() ? config.description : config.name;
-    }
-
-    return config;
-}
-
-} // namespace amnezia
--- a/client/core/models/api/legacyApiServerConfig.h
+++ b/client/core/models/api/legacyApiServerConfig.h
@@ -1,38 +0,0 @@
-#ifndef LEGACYAPISERVERCONFIG_H
-#define LEGACYAPISERVERCONFIG_H
-
-#include <QJsonObject>
-#include <QMap>
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/protocolEnum.h"
-#include "core/models/containerConfig.h"
-
-namespace amnezia
-{
-
-using namespace ContainerEnumNS;
-
-struct LegacyApiServerConfig {
-    QString description;
-    QString displayName;
-    QString hostName;
-    QMap<DockerContainer, ContainerConfig> containers;
-    DockerContainer defaultContainer = DockerContainer::None;
-    QString dns1;
-    QString dns2;
-
-    QString name;
-    int crc = 0;
-
-    int configVersion = 0;
-    QString apiEndpoint;
-
-    bool hasContainers() const;
-    ContainerConfig containerConfig(DockerContainer container) const;
-    static LegacyApiServerConfig fromJson(const QJsonObject &json);
-};
-
-} // namespace amnezia
-
-#endif // LEGACYAPISERVERCONFIG_H
--- a/client/core/models/containerConfig.cpp
+++ b/client/core/models/containerConfig.cpp
@@ -113,26 +113,6 @@ const Socks5ProxyProtocolConfig* ContainerConfig::getSocks5ProxyProtocolConfig()
    return protocolConfig.as<Socks5ProxyProtocolConfig>();
 }

-MtProxyProtocolConfig* ContainerConfig::getMtProxyProtocolConfig()
-{
-    return protocolConfig.as<MtProxyProtocolConfig>();
-}
-
-const MtProxyProtocolConfig* ContainerConfig::getMtProxyProtocolConfig() const
-{
-    return protocolConfig.as<MtProxyProtocolConfig>();
-}
-
-TelemtProtocolConfig* ContainerConfig::getTelemtProtocolConfig()
-{
-    return protocolConfig.as<TelemtProtocolConfig>();
-}
-
-const TelemtProtocolConfig* ContainerConfig::getTelemtProtocolConfig() const
-{
-    return protocolConfig.as<TelemtProtocolConfig>();
-}
-
 Ikev2ProtocolConfig* ContainerConfig::getIkev2ProtocolConfig()
 {
    return protocolConfig.as<Ikev2ProtocolConfig>();
--- a/client/core/models/containerConfig.h
+++ b/client/core/models/containerConfig.h
@@ -57,12 +57,6 @@ struct ContainerConfig {
    Socks5ProxyProtocolConfig* getSocks5ProxyProtocolConfig();
    const Socks5ProxyProtocolConfig* getSocks5ProxyProtocolConfig() const;
    
-    MtProxyProtocolConfig* getMtProxyProtocolConfig();
-    const MtProxyProtocolConfig* getMtProxyProtocolConfig() const;
-
-    TelemtProtocolConfig* getTelemtProtocolConfig();
-    const TelemtProtocolConfig* getTelemtProtocolConfig() const;
-
    Ikev2ProtocolConfig* getIkev2ProtocolConfig();
    const Ikev2ProtocolConfig* getIkev2ProtocolConfig() const;
    
--- a/client/core/models/protocolConfig.cpp
+++ b/client/core/models/protocolConfig.cpp
@@ -9,8 +9,6 @@
 #include "core/utils/protocolEnum.h"
 #include "core/models/protocols/ikev2ProtocolConfig.h"
 #include "core/models/protocols/dnsProtocolConfig.h"
-#include "core/models/protocols/mtProxyProtocolConfig.h"
-#include "core/models/protocols/telemtProtocolConfig.h"

 namespace amnezia
 {
@@ -40,10 +38,6 @@ Proto ProtocolConfig::type() const
            return Proto::TorWebSite;
        } else if constexpr (std::is_same_v<T, DnsProtocolConfig>) {
            return Proto::Dns;
-        } else if constexpr (std::is_same_v<T, MtProxyProtocolConfig>) {
-            return Proto::MtProxy;
-        } else if constexpr (std::is_same_v<T, TelemtProtocolConfig>) {
-            return Proto::Telemt;
        }
        return Proto::Unknown;
    }, data);
@@ -71,10 +65,6 @@ QString ProtocolConfig::port() const
            return QString();
        } else if constexpr (std::is_same_v<T, DnsProtocolConfig>) {
            return QString();
-        } else if constexpr (std::is_same_v<T, MtProxyProtocolConfig>) {
-            return arg.port.isEmpty() ? QString(protocols::mtProxy::defaultPort) : arg.port;
-        } else if constexpr (std::is_same_v<T, TelemtProtocolConfig>) {
-            return arg.port.isEmpty() ? QString(protocols::telemt::defaultPort) : arg.port;
        }
        return QString();
    }, data);
@@ -98,10 +88,6 @@ QString ProtocolConfig::transportProto() const
            return QString();
        } else if constexpr (std::is_same_v<T, DnsProtocolConfig>) {
            return QString();
-        } else if constexpr (std::is_same_v<T, MtProxyProtocolConfig>) {
-            return QStringLiteral("tcp");
-        } else if constexpr (std::is_same_v<T, TelemtProtocolConfig>) {
-            return QStringLiteral("tcp");
        }
        return QString();
    }, data);
@@ -313,10 +299,6 @@ ProtocolConfig ProtocolConfig::fromJson(const QJsonObject& json, Proto type)
        return ProtocolConfig{TorProtocolConfig::fromJson(json)};
    case Proto::Dns:
        return ProtocolConfig{DnsProtocolConfig::fromJson(json)};
-    case Proto::MtProxy:
-        return ProtocolConfig{MtProxyProtocolConfig::fromJson(json)};
-    case Proto::Telemt:
-        return ProtocolConfig{TelemtProtocolConfig::fromJson(json)};
    default:
        return ProtocolConfig{AwgProtocolConfig{}};
    }
--- a/client/core/models/protocolConfig.h
+++ b/client/core/models/protocolConfig.h
@@ -22,8 +22,6 @@
 #include "core/models/protocols/ikev2ProtocolConfig.h"
 #include "core/models/protocols/torProtocolConfig.h"
 #include "core/models/protocols/dnsProtocolConfig.h"
-#include "core/models/protocols/mtProxyProtocolConfig.h"
-#include "core/models/protocols/telemtProtocolConfig.h"

 namespace amnezia
 {
@@ -38,8 +36,6 @@ struct ProtocolConfig {
        XrayProtocolConfig,
        SftpProtocolConfig,
        Socks5ProxyProtocolConfig,
-        MtProxyProtocolConfig,
-        TelemtProtocolConfig,
        Ikev2ProtocolConfig,
        TorProtocolConfig,
        DnsProtocolConfig
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
NickVs2015	a53eb556b7	fix: : add support new structure	2026-04-30 17:30:59 +03:00
NickVs2015	fd915a4325	fix: replace m_linkDefaultRoutes map with single m_gatewayIfindex	2026-04-30 16:30:15 +03:00
NickVs2015	970fc26113	fix: solve infinite reconnect NM down	2026-04-30 16:30:14 +03:00
NickVs2015	c7b7ecd1d6	fix: killswitch compatible	2026-04-30 16:30:14 +03:00
NickVs2015	0edffc5f88	fix: NM down/up reconnection problem	2026-04-30 16:30:14 +03:00
NickVs2015	dcb097b0b2	fix: dns rewrites and flush	2026-04-30 16:30:14 +03:00
NickVs2015	a78f42a199	fix: make dbus async	2026-04-30 16:30:14 +03:00