diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index a31ca0e10..3e3fe6be1 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -10,12 +10,6 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v3
- - uses: actions/setup-node@v3
- with:
- node-version: "16"
- cache: "yarn"
- cache-dependency-path: |
- www/yarn.lock
- uses: actions/setup-python@v2
with:
python-version: "3.9"
@@ -29,10 +23,6 @@ jobs:
- name: Install Python Dependencies
run: |
pip install -r requirements.txt
- - name: Install node modules
- run: |
- cd www/
- yarn install --frozen-lockfile
- name: Run pre-commit
run: |
pre-commit install
diff --git a/www/static/.nojekyll b/website/.gitkeep
similarity index 100%
rename from www/static/.nojekyll
rename to website/.gitkeep
diff --git a/www/.gitignore b/www/.gitignore
deleted file mode 100644
index 5667f22e8..000000000
--- a/www/.gitignore
+++ /dev/null
@@ -1,23 +0,0 @@
-# Dependencies
-/node_modules
-
-# Generated OpenAPI docs
-/docs/reference/REST\ API/
-
-# Production
-/build
-
-# Generated files
-.docusaurus
-.cache-loader
-
-# Misc
-.DS_Store
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
diff --git a/www/CNAME b/www/CNAME
deleted file mode 100644
index 795296e60..000000000
--- a/www/CNAME
+++ /dev/null
@@ -1 +0,0 @@
-www.firezone.dev
diff --git a/www/README.md b/www/README.md
deleted file mode 100644
index b759d9024..000000000
--- a/www/README.md
+++ /dev/null
@@ -1,33 +0,0 @@
-# Website
-
-This website is built using [Docusaurus 2](https://docusaurus.io/), a modern
-static website generator.
-
-## Installation
-
-```shell
-yarn
-```
-
-## Local Development
-
-```shell
-yarn run start
-```
-
-This command starts a local development server and opens up a browser window.
-Most changes are reflected live without having to restart the server.
-
-## Build
-
-```shell
-yarn run build
-```
-
-This command generates static content into the `build` directory and can be
-served using any static contents hosting service.
-
-## Deployment
-
-Deployment happens automatically when a new version is published. See the
-`publish_www` CI workflow.
diff --git a/www/babel.config.js b/www/babel.config.js
deleted file mode 100644
index e00595dae..000000000
--- a/www/babel.config.js
+++ /dev/null
@@ -1,3 +0,0 @@
-module.exports = {
- presets: [require.resolve('@docusaurus/core/lib/babel/preset')],
-};
diff --git a/www/blog/2022-07-25-release-0-5-0/index.mdx b/www/blog/2022-07-25-release-0-5-0/index.mdx
deleted file mode 100644
index d447c6aca..000000000
--- a/www/blog/2022-07-25-release-0-5-0/index.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-slug: release-0-5-0
-title: Release 0.5.0
-authors: [jamil]
-tags: [release, beta, acme, reverse proxy, docs]
----
-
-## Firezone 0.5 Released!
-
-As the first post on our new blog, we thought it'd be fitting to kick things
-off with a release announcement. So without further ado, we're excited to
-announce: Firezone [0.5.0 is
-here](https://github.com/firezone/firezone/releases)! It's packed with new
-features, bug fixes, and other improvements — more on that below.
-
-### User-scoped egress rules
-
-Rules can now optionally receive a user scope, limiting the rule's application
-only to devices owned by that user. This allows you to selectively allow or
-deny traffic from a particular user to an IP, set of IPs, or CIDR range.
-
-### Auto-renewed, ECDSA-backed, ACME-powered SSL certificates
-
-One of our most-requested features is now available — Firezone 0.5.0 supports
-ACME SSL certificate renewal backed by Let's Encrypt's new ECDSA key type.
-Other providers and key types are available too. See all ACME configuration
-options in our [configuration file
-reference](/docs/reference/configuration-file/).
-
-**Note**: ACME is disabled by default to remain compatible with existing
-Firezone installations. To enable, set the following in your config file:
-
-```
-default['firezone']['ssl']['acme']['enabled'] = true
-```
-
-### BYORP: Bring Your Own Reverse Proxy
-
-Want to disable Nginx and deploy Firezone under your own reverse proxy or HTTP
-load balancer? Well, now you can! We've documented the required headers and
-other configuration necessary to make this happen. [Check the
-docs](/docs/deploy/advanced/reverse-proxy) for some configuration
-examples for popular proxies. In short:
-
-Set the
-`default['firezone']['phoenix']['external_trusted_proxies']`
-configuration variable to a comma-separated list containing the proxies
-you'd like to receive forwarded requests from. If your proxy uses an
-[RFC1918 address](https://en.wikipedia.org/wiki/Private_network), add its
-IP to `default['firezone']['phoenix']['private_clients']` instead of
-`default['firezone']['phoenix']['external_trusted_proxies']`.
-Update your proxy's configuration to point to Firezone, making sure to set
-the `X-Forwarded-For` header and enable WebSocket connection upgrades.
-
-**Note:** ACME support is tied to Nginx. If you disable the bundled
-Firezone Nginx service, you'll need to provide your own SSL certificates
-(or configure ACME renewal manually).
-
-**Additional note:** If you go this route, you'll need to terminate SSL
-yourself — Firezone sets the secure attribute on all cookies and thus
-requires the downstream proxy to terminate SSL.
-
-### Runtime configuration available in the UI
-
-Some Firezone configuration settings are now configurable in the product UI
-under the Security settings. This will override anything you have set in the
-config file. Moving runtime configuration into the application itself brings us
-a step closer to Docker-based deployments (coming Soon™).
-
-### New and improved documentation
-
-Our docs have been migrated from Jekyll to [Docusaurus](https://docusaurus.io).
-Aside from all the Formatting is improved, user guides are updated and many
-pages have been edited for clarify and further detail. As an added bonus, our
-docs are feature improved search thanks to the powerful search functionality
-provided by [DocSearch by Algolia](https://docsearch.algolia.com/).
-Contributions welcome!
-
-### Red Hat and Debian package repositories
-
-If you're on one of our [supported
-distros](/docs/deploy/omnibus/supported-platforms/) (or its
-derivatives), the one-line install script will automatically install Firezone
-from our package repository and track further updates from there. This means
-your Firezone installation can be managed like any other package on your system
-and will be marked for upgrades by the same apt and yum tools you're already
-familiar with. Be sure to check the [upgrade
-notes](/docs/administer/upgrade/) prior to each
-upgrade in case there are any backwards-incompatible changes or manual steps
-involved.
-
-If you've got an existing installation and still want to add our package
-repository for easier package management, just follow the [relevant
-section](/docs/deploy/omnibus) in the manual
-install guide.
-
-### Smaller package sizes
-
-Speaking of packages, we've done a bit of work reducing the size of our Omnibus
-release package. The Nodejs, Python, Erlang, and Elixir runtimes have all been
-removed, reducing the package size by 50% and total installed size by even
-more. There's still lots of work to be done to be done here — we expect
-package sizes to be reduced even further moving forward.
-
-### Custom landing page logo
-
-In the first round of what we hope to be the start of a full-featured
-customization experience, it's now possible to change the landing page logo.
-Upload an image up to 1 MB or specify a URL to an image your end users will see
-when landing at your Firezone portal.
-
-## Conclusion
-
-That's all we've got for now. If you'd like to spin up Firezone to try it out,
-head to the [deploy guide](/docs/deploy) in our docs.
diff --git a/www/blog/2022-10-17-release-0-6-0/index.mdx b/www/blog/2022-10-17-release-0-6-0/index.mdx
deleted file mode 100644
index 3e42097ca..000000000
--- a/www/blog/2022-10-17-release-0-6-0/index.mdx
+++ /dev/null
@@ -1,126 +0,0 @@
----
-slug: release-0-6-0
-title: Release 0.6.0
-authors: [jamil]
-tags: [release, docker, saml]
----
-
-## Firezone 0.6 Released!
-
-Today, I'm excited to announce we've closed the [first public issue
-](https://github.com/firezone/firezone/issues/260) on our GitHub repository,
-more than a year after it was originally opened: Containerization support!
-We're also releasing preliminary support for SAML 2.0 identity providers
-like Okta and OneLogin.
-
-### Docker Support
-
-Docker is now the preferred method for deploying Firezone. Our [
-automatic install script](https://raw.githubusercontent.com/firezone/firezone/master/scripts/docker_install.sh)
-now uses Docker by default, and we even have a new [Docker migration script
-](https://raw.githubusercontent.com/firezone/firezone/master/scripts/docker_migrate.sh)
-that will non-destructively migrate your Omnibus-based Firezone installation
-to a Docker-based one with minimal downtime.
-
-#### How to Deploy
-
-You can now deploy Firezone complete with valid SSL certificates and a
-provisioned administrator in just a couple minutes:
-
-
-
-This also means Firezone runs on any platform that supports Docker,
-like my Mac in the video above. The automatic install script will _probably_
-barf on Windows, though. In that case, try the
-[manual install method](/docs/deploy/docker/#option-2-manual-install)!
-
-#### Why Docker?
-
-Docker offers a number of benefits over the old Omnibus-based method of deploying
-Firezone:
-
-- **Simpler, more robust upgrades**: In most cases, simply pull the latest `firezone/firezone`
- image and restart the container.
-- **Simpler configuration**: Most day-to-day configuration of Firezone can now
- be done in the web UI instead of the `/etc/firezone/firezone.rb` configuration
- file. All other configuration variables can be specified as ENV vars to the
- Firezone container.
-- **Smaller footprint**: The Firezone image weighs in at a couple dozen
- megabytes versus hundreds of megabytes for the Omnibus package.
-- **Portability**: Firezone now runs on any platform that supports Docker.
-- **Security**: Containerization providers better security isolation than
- simply running as an unprivileged local user.
-
-It also makes it easier to build and test Firezone. CI pipelines rejoice!
-No more 4-hour long compiles and intermittent build failures.
-
-#### What about Omnibus?
-
-[Chef Omnibus](https://github.com/chef/omnibus) is a Ruby-based build system
-designed to make building and distributing complex software easier. You define
-your dependencies as source tarballs, configure options, and platform-specific
-build flags, and Omnibus automatically fetches, builds, and links all your
-dependencies automagically, emitting an OS-native installer artifact when
-complete.
-
-Omnibus was a popular choice for distributing self-hosted software before
-Docker was popular -- GitLab and Mattermost are two popular self-hosted products
-that still support Omnibus-based deployments today. It's still used in many
-cases where Docker can't be used (on the \*BSDs, for example).
-
-But, since Omnibus is [effectively EOL in 2024](https://docs.chef.io/versions/)
-due to its reliance on Chef Infra Client, we've decided to deprioritize
-reliance on it, and dedicate those resources to containerized deployments
-instead.
-
-**Note**: Beginning with 0.6, Omnibus support in Firezone is **deprecated**.
-We'll be removing support for it completely in a future Firezone release.
-
-#### How to migrate from Omnibus to Docker
-
-We've written an in-depth migration guide to migrate your instance from Omnibus
-to Docker:
-
-https://www.firezone.dev/docs/administer/migrate
-
-Most instances will migrate without issue. If you're running Firezone in production
-for your team or business, [contact us](/contact/support)
-so we can better understand how we can help with your migration.
-
-### SAML 2.0
-
-Also in 0.6 is preliminary support for SAML 2.0 authentication. You'll need the
-IdP Metadata XML document to set it up. In most cases the identity provider
-will provide it for you. If not, you should be able to build it manually or
-using a tool such as
-[this nifty online IdP builder](https://www.samltool.com/idp_metadata.php).
-
-In general we recommend using OpenID Connect integration over SAML whenever possible.
-It's simpler, tends to be implemented more consistently across identity providers,
-and much easier to debug when things go wrong.
-
-Speaking of OIDC, 0.6 also introduces a couple improvements to make integrating
-your identity provider a more pleasant experience:
-
-- `auto_create_oidc_users` is now a per-provider configuration setting. Enable or disable
- autocreation of users when logging into Firezone via that provider.
-- New web form for entering OIDC details, with improved validation and error checking:
-
-
-
-
-
-#### IdP not supported?
-
-If your IdP isn't supported or you'd like to learn about your options for
-custom integrations, [contact us](/contact/support) to learn more about custom integrations.
diff --git a/www/blog/2023-01-10-first-offsite/index.mdx b/www/blog/2023-01-10-first-offsite/index.mdx
deleted file mode 100644
index b8497ab60..000000000
--- a/www/blog/2023-01-10-first-offsite/index.mdx
+++ /dev/null
@@ -1,138 +0,0 @@
----
-slug: first-offsite-retro
-title: Lessons from Firezone’s first off-site
-description: In December, Firezone organized an off-site in California. Here's what we learned.
-authors: [jason]
-tags: [company, off-site]
----
-
-My first tech job was at [Strong](https://www.strong.app/), a workout journal app that was pretty popular at the time. The founders were “digital nomads,” and the team was fully remote.
-
-Back in 2016, this was highly uncommon.
-
-We spent a lot of time creating processes to work together effectively on opposite sides of the world. One of these was meeting up in person regularly.
-
-
-
-
-
-At first, it was by accident. Since everyone was traveling anyway, we would coordinate being in the same city at the same time.
-
-After working in person, we quickly noticed the way we worked remotely improved. People were more comfortable sharing their ideas, better at giving constructive criticism, and happier in general.
-
-It just _felt_ better to work together in person.
-
-## Why try this at Firezone?
-
-If you believe Firezone can take a sizable bite out of the usual suspects of legacy remote access products, we’ll need to use every advantage.
-
-As a startup, our biggest advantage is the ability to move quickly as a team.
-
-This is much easier when everyone is comfortable sharing ideas and engaging in lively debate. Plus, it’s a lot more fun.
-
-So we decided to try it out. After much planning, canceled bookings, and a few long flights, our team met in Santa Rosa, California.
-
-
-
-
-
-## What did we do?
-
-Our itinerary included architecture planning, a multi-day hackathon, and plenty of fun activities around the Bay Area.
-
-
-
-
-
-The focus of the off-site was building. We each defined a few tasks that could realistically be completed by the end of the trip. So what did we work on?
-
-- A new Firezone gateway (coming in 0.8!) that will eventually allow decoupling the web portal from the WireGuard data plane. A single Firezone web portal will soon be able to manage hundreds or even thousands of little Firezone gateways securing access to their respective private resources. More details to come!
-- A [new REST API in 0.7](https://github.com/firezone/firezone/releases) to allow configuring Firezone in a more automatable way. Users love our snappy web portal, but nothing beats the power of an API for automation.
-- Various documentation improvements to improve consistency between Omnibus and Docker sections, detail logging, and implement a v1 style guide.
-
-Of course, no visit to the Bay Area would be complete without a tour of San Francisco. It rained most of the time, so we missed out on much of the picturesque hiking. But we still managed to snap some photos of the Golden Gate bridge and devour a few In-N-Out burgers.
-
-Of special mention are the team dinners. Remote companies lack that familiar bond typically formed over team lunches in the office, so we sought to recreate that when we met in person. As an added bonus, we also split cooking duties. In many ways preparing food for your teammates is like opening a pull request: make something, request feedback on it, then merge and enjoy.
-
-As someone whose culinary talents rival his passion for building security products, our resident chef [Jamil](https://twitter.com/jamilbk) led most of the culinary endeavors, including a 2-hour drive around Santa Rosa in search of live Dungeness crab.
-
-
-
-
-
-## Lessons learned for next time
-
-Since this was our first off-site, some things could have gone better. Here’s a small list of hiccups and other things we’d do differently next time.
-
-### Turn on low power mode
-
-
-
-
-
-If you’re booking an Airbnb, check for planned maintenance and outages! We were notified three days before arrival the power would be out during two full workdays.
-
-Fortunately, we had a small power bank and mobile hotspot with unlimited data. Unfortunately, our lead Rust engineer’s beefy Linux machine only gets a single hour of battery life on a full charge.
-
-When his machine died, we migrated to our local coffee shop, where power and WiFi were surprisingly abundant. _Editor’s note: Coffee shops in Santa Rosa are much more accommodating as a makeshift office than most in San Francisco._
-
-When you’re building software, electricity and internet are vital -- splurge for that bigger battery bank and faster hotspot!
-
-### Lumbar support is underrated
-
-You’ll sacrifice some ergonomics when you work out of an Airbnb. Put a premium on large work surfaces, open common areas, and comfortable chairs. After a few days of working hunched over on a sofa, we learned the hard way.
-
-Even better, leave heads down work until after the off-site. Instead, prioritize architecture discussions, brainstorming sessions, and design sprints.
-
-### Stock the right fuel
-
-We got carried away at Costco. Our out-of-town guests had never witnessed the spectacle of an American snack aisle. Fortunately, our talented engineers can turn Funyuns into elegant lines of Rust code (shoutout [@Gabi](https://github.com/conectado)).
-
-All jokes aside, you’ll need the right fuel for your hackathons and deep product discussions. We recommend stocking up with plenty of coffee and healthy snacks.
-
-### Plan ahead: it’ll pay off
-
-As is often the case with startups, we planned the trip on short notice. This meant many last-minute restaurant bookings and trips to the store for basic supplies.
-
-So, make a shopping list, book a few restaurants in advance, and have a backup plan. If you’re looking for a template, take a look at this [guide](https://posthog.com/handbook/company/offsites#how-to-plan-an-offsite-in-8-weeks---a-checklist) from our friends at PostHog. A great checklist is hard to beat.
-
-## What’s next?
-
-In a few short days, we:
-
-- Aligned on Firezone’s product direction
-- Made critical architecture decisions for the gateway and client apps
-- Made significant progress on a few key features
-- Bonded over great food, conversation, and Mario Kart
-
-We could have accomplished some of these over a few long Zoom calls and chat threads, but not as quickly. There’s something about mind melding over a few days of intense work that’s hard to replicate.
-
-So, will we have another off-site? Definitely!
-
-Until next time!
-
-:::info 👋 thanks for reading
-Firezone secures remote access to private resources. This post doesn't have much to do about security, networking, or a fancy new feature. But hey, our product improves the remote work experience - organizing a great off-site helps too.
-
-If you want to try it out, our [Docker install script](/docs/deploy) gets Firezone running in just a few minutes.
-:::
diff --git a/www/blog/_2022-10-21-3000-stars/index.mdx b/www/blog/_2022-10-21-3000-stars/index.mdx
deleted file mode 100644
index a6025a879..000000000
--- a/www/blog/_2022-10-21-3000-stars/index.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
----
-slug: 3000-stars
-title: 3,000 GitHub Stars
-authors: [jamil]
-tags: [open-source, github]
----
-
-## 3,000 GitHub Stars
diff --git a/www/blog/_2022-12-23-yc-as-oss-company/index.mdx b/www/blog/_2022-12-23-yc-as-oss-company/index.mdx
deleted file mode 100644
index ae9e546bb..000000000
--- a/www/blog/_2022-12-23-yc-as-oss-company/index.mdx
+++ /dev/null
@@ -1,181 +0,0 @@
----
-slug: yc-oss-experience
-title: Going through YC as an open source company
-authors: [jason]
-tags: [open-source, ycombinator, company]
----
-
-# Going through YC as an open source company
-
-During YC's three-month bootcamp, your goal is simple. Make meaningful progress.
-
-In our batch, we met a company that made powdered breast milk. Multiple hospital networks as customers and $150k+ of MRR. Their problems were scaling production and FDA approval.
-
-Firezone, our company, had launched a few weeks prior on HN. We had no revenue and only a small handful of users.
-
-YC's challenge is to give advice that helps these two companies and everything in between.
-
-Open-source security is a relatively new category for YC investments. About half of the 240 open-source YC investments made by YC since S05 (17 years ago) were made in the past 2 years. Only 7 are security companies.
-
-During the batch, we had come up with our own interpretation of advice meant for traditional enterprise Saas or B2B freemium software companies. This post is my attempt at sharing what we did and learned in our journey.
-
-## How it all started
-
-As a business guy, I have long felt the business pains of a slow, clunky VPN.
-
-Slow VPN speeds are an eroding pain. One that makes every task 10% slower. Like loading my Kibana dashboard, and having to wait an extra few seconds, so I go check my email or my phone. A 2 second wait that triggers a few minutes of lost productivity. A hiccup of 1 minute at the start of every zoom call that throws off all the prep I had coming into it. “How does my mic sound?”.
-
-Big pains come from blockers. Halting the onboarding of a new contractor because our internal resources have not been segmented for least privilege. The contractor needs to build a website, but would get access to customer data and network access to production servers. There was no way we'd adopt a new tool for just this problem. In a past company we spent weeks installing a firewall appliance
-
-When I met my co-founder Jamil last summer, he showed me a solution to these problems. A new faster VPN protocol called WireGuard (read more about that here) and a modern UX built for end users. One that's easy to self-serve for IT admins, SREs, and DevOps engineers.
-
-The latter may seem like a silly differentiator, but it isn't. In the past software was sold top-down to large companies. The buyer was often not the user, so products with a laundry list of features won. They checked all the boxes.
-
-In fact, for many of Firezone's users, a VPN was a checkbox. A feature that came with their legacy firewall that's cumbersome to deploy and configure. Not to mention that firewall is now sitting in an empty office as employees move to remote work.
-
-This wasn't apparent to us at the beginning, but after we posted our project to HN, we quickly realized technical IT staff needed a product like Firezone.
-
-## Why open-source?
-
-Firezone is core IT infrastructure. It deals with network security and cryptography, and runs in pretty sensitive environments. On your employee's laptops and behind firewalls on your servers. Private data about your company and customers flow through our gateways and apps. And with remote work, almost every employee relies on it to get work done.
-
-We don't expect many organization to run such critical software without knowing what's in it.
-
-We also don't expect all organizations to leave control of their network to a third party. One that can experience outages, be targeted by hackers, or even snoop on your data themselves.
-
-So we leave it all open for you to see and make it easy to host yourself.
-
-Of course, there are other benefits of building in the open. We hired world class engineers, but with such a complex product mistakes can happen. More eyes on our code means vulnerabilities are spotted and resolved faster. As we've grown, we are even getting contributions from the community.
-
-## Why Y Combinator?
-
-After our ShowHN, a long list of feature requests appeared in our GitHub repo. A list we couldn't close alone. At least not within a reasonable amount of time.
-
-For a new product with no revenue (yet), VC funding seemed to fit. It would allow us to create something for the community and in parallel investigate the right model to build a sustainable business. As first time founders, YC seemed like a good fit. After all, they helped GitLab and Mattermost get off the ground.
-
-A brief summary for those that don't know. For a stake in your company, YC offers 3 things: capital, advice, and community.
-
-When we accepted the invitation, YC's investment was $125k for 7% of our company. A few weeks into the batch we were offered an additional $375k as an uncapped MFN safe. Lucky us! You can read more about it here.
-
-Advice comes in the form of interactive workshops and long-form posts. They are invaluable resources and often come with snappy titles, like “how not to fail”.
-
-Community is YC's magic. Thousands of past founders who can make introductions to investors, give advice, and even become users of your product. They can help you understand what “how not to fail” should mean to an open-source security company. Same with general advice on setting metrics, talking to users, and pricing.
-
-Here's some of our learnings.
-
-## Should I collect telemetry?
-
-As a VC backed-startup, probably yes.
-
-Even with a crystal ball on what users want, metrics can still help identify reliability issues and add insight to reported bugs.
-
-From a business point of view, they tell you who and how many people like your product and which features are getting used.
-
-It's a great way to focus the team on what matters.
-
-Best of all when the data-points start lining up like a hockey stick, it can get you the funding you need to build a great product.
-
-YC's advice is to set a primary metric that accurately captures the value you're delivering to users. This primary metric should be paired with secondary metrics that drive the primary metric and you can actionably move and iterate on.
-
-In case you're curious, we've set users in production as our primary metric. Our secondary metrics help add context to the growth.
-
-For example, here are 3 different graphs of our progress near demo day. Our star count, number of live instances, and number of devices. Each graph tells a slightly different story. Star count shows growing awareness in the open-source community. Instances show steady growth in actual adoption. Number of users tell us more about the deployments of Firezone. Since it outpaced the growth of instances, we knew larger teams were adopting Firezone over time and existing deployments were growing inside organizations.
-
-
-
-So, how do you measure usage? Not as simple as you think.
-
-For most software products, telemetry is a small script in the header of your website and an annoying cookie banner. Sometimes it's also a few lines of code sprinkled through the backend. Most users expect to be tracked by the hosted services they use. They may not like it, but they generally won't fuss about it.
-
-Open-source is different.
-
-Though it's getting more common, not everyone expects a self-hosted open-source project to report their usage. We had to be careful what we tracked, how we anonymized it, and how we communicate it to users.
-
-We spoke to a few other open source companies we respected. Here's the advice we received.
-
-- Explain why you do it: Document what you track, how it's stored, and what you use it for. We took heavy inspiration from companies like Mattermost and made our own page in our documentation.
-- Make it clear and easy to opt-out: To make it simple for users, we created a deployment script that streamlines the install process. In the script we explicitly ask for permission and make it easy to switch off later directly in the UI.
-- Don't unnecessarily expose user data to third parties: Those annoying cookie banners on websites you visit generally mean one thing. You're being tracked, and your information is being sent to third party tools like CRMs and ad platforms. If you've signed up for an account and checked the box for terms and conditions, you're agreeing to that as well. With Firezone, we try to use open-source and self-hosted products whenever possible. This includes our telemetry platform as well.
-
-So, now we know about users in aggregate.
-
-But, our product is early and legacy VPNs are painful in many ways. We need more information to prioritize what to build first. The best way to do that is by talking to users.
-
-## We don't know who our users are
-
-“Write code and talk to users” is consistently echoed during YC.
-
-A great summary why is in “do things that don't scale”. I recommend reading the article, but it boils down to this:
-
-You often build the initial product for yourself. The MVP is usually not good enough - it's never quite right. You should get it in front of users as soon as it provides utility so you can get feedback to iterate and improve.
-
-The average user of Firezone is technical. Usually a system admin, IT manager, or DevOps engineer. They're fully capable of setting up Firezone and reading our docs to figure out what the product can do.
-
-We get frequent GitHub issues and Discourse posts pointing at issues or desired features. Sometimes they'll even fix it for us!
-
-However, Firezone does not require a valid email to sign up. It's hosted entirely on your infrastructure. It would be weird to lock anything behind a signup.
-
-I would be equally distasteful to hijack discussions with requests for a user interview.
-
-So, to generate more conversations, we increased the surface area of how users can reach us. It's important to note who you're getting feedback from as well. Often for developer facing products, the person that's deploying the product is not the person who decides what to use, what the budget is, or even the only one benefiting from it.
-
-Firezone ties into security playbooks, compliance requirements, hiring plans for contractors globally, and risk planning from risk departments.
-
-Here's how we're currently reaching them:
-Source Types of conversations Who we speak with
-Install script email (opt-in) Deployment issues ICs, IT Managers
-Slack Group and Discourse threads Deployment and configuration issues ICs, IT Managers
-GitHub issues Feature requests ICs, IT Managers, IT Leaders
-Inbound sales leads Required functionality, pricing discussions CTO, CISO, IT Leaders
-Outbound leads Problem discovery, product roadmap planning CTO, CISO, IT Leaders
-
-One example of why it's important to dig deeper involves a request to “load a custom logo”. When we got on a Zoom call, we would uncover a group of re-sellers who want to white-label our product with their clients. Turns out they have other requirements they'd be happy to pay for if we had them.
-
-These conversations helped make the product better and form our view on our business model.
-
-This leads into the final piece of advice from YC, pricing.
-
-## Paying user feedback > free users
-
-Figuring out your pricing model and generating meaningful revenue is the great filter between early MVPs and successful companies.
-
-The main question however is when.
-
-With limited resources, generating revenue is almost always a tradeoff. Less growth, slower development of features, and the potential to ruin a perfectly good story for investors. Queue Silicon Valley:
-
-
-
-So, when to figure out revenue?
-
-For B2B software, the answer should probably be “right now”.
-
-Steering early user conversations toward pricing tells you if the product is viable and solves a big enough pain. YC echoes this advice.
-
-A startup I previously worked at, Kite, failed partly because we punted the question of “will people pay?” too many times. It was an AI powered co-pilot, an early iteration of GitHub Copilot.
-
-When we finally tried, it was clear the product needed to evolve to generate meaningful revenue. By the time we realized that, it was too late. Adam, the founder of Kite and an investor in Firezone, recently open-sourced the codebase and wrote a great post-mortem:
-
-https://www.kite.com/blog/product/kite-is-saying-farewell/
-
-For self-hosted open-source software the answer is not as clear.
-
-[As a self-hosted security product, layering feature gating logic into the core product is problematic. Feature flags are complex to write, and even harder to maintain as our product evolves. Being critical infrastructure for remote work, we also don't want your company to come to a halt when your credit card expires. There's more to say here, but I'll leave this to a future deep-dive from my co-founder, Jamil.]
-
-So, similar to other successful open-source projects, our early goal was to grow the community. During YC we focused on building out the core parts of our platform, driving adoption, and optimizing for learning from our users. One of things we wanted to learn was how to build a business around Firezone.
-
-As usage grew, a pattern emerged when talking to users. Our largest deployments all started with an individual spinning Firezone up without ever speaking to us.
-
-As usage grew, they reached out to inquire about additional features and services.
-
-As we continue to develop our pricing model, we want to ensure the following:
-- Individuals and hobbyists can use Firezone for free
-- Small teams can use Firezone for free (if they support it themselves)
-- Large organizations can run a PoC without any calls with sales
-
-If this sounds familiar, it's similar to how GitLab thinks about their pricing. We're obviously big fans.
-
-## Paying it forward (still writing this part...)
-
-[not sure how to end this]
-
-- https://a16z.com/2019/10/04/open-source-from-community-to-commercialization/
diff --git a/www/blog/_2023-02-13-ebpf-firewall/index.mdx b/www/blog/_2023-02-13-ebpf-firewall/index.mdx
deleted file mode 100644
index 37b255358..000000000
--- a/www/blog/_2023-02-13-ebpf-firewall/index.mdx
+++ /dev/null
@@ -1,544 +0,0 @@
----
-slug: ebpf-firewall
-title: How We Built an eBPF-based General Purpose Packet Filter
-authors: [conectado]
-tags: [ebpf, firewall, rust, aya]
----
-
-## Introduction
-
-As part of our migration to multi-site in Firezone the VPN and Firewall were rewritten in Rust. As part of that rewrite we decided to improve how we were handling the firewall.
-
-In the past we were using [nftables](https://netfilter.org/projects/nftables/), the way we did this was shelling-out to the console and use the nft cli.
-
-This has a number of problems, for one shelling out can be prone to error, inefficient and hard to unit-test, also there's no Rust lib to call into nftables and even the existing libraries in C can be too complicated to use. Furthermore, we were limited to nft's data structure which meant doing a lot of work to not mess up the rules, this in turn made doing improvements really slow.
-
-So after a lot of consideration we decided that creating our own firewall using [ebpf](https://ebpf.io/).
-
-## eBPF
-
-We will briefly go into what eBPF is, however If you want a more detailed introduction you can take a look at [the official introduction](https://ebpf.io/what-is-ebpf).
-
-### What is eBPF
-
-eBPF stands for extended Berkeley Packet Filter, which is an upgrade from BPF(Berkely Packet Filter), while eBPF brings a lot of improvements over BPF the gist is the same, run user-defined packet-filtering code inside of the kernel as part of the packet processing pipeline.
-
-This is an oversimplification because eBPF programs can be hooked into multiple different events in the kernel but for our intent and purposes, we just want to hook into the packet-classifier pipeline.
-
-
-### How the kernel safely run user-defined code
-
-eBPF has its own ISA and there is a runtime for said ISA in the kernel (JIT'd), the instructions allows calling into parts of the kernel that we might need and gives us the necessary context to process a given packet.
-
-Furthermore, to prevent crashes in the kernel and hogging out resources before an eBPF program gets loaded into the kernel it goes through a verification process, a verificator program sets a bunch of limitations to the program to prevent situations like infinite loops and crashes:
-
-* It sets an upper-bound for the number of times a loop within the code can run (or strictly prohibits them in older kernel versions).
-* An upper-bound in the number of instructions the program can execute in total.
-* Keeps tracks of read/writes to know that you are using valid memory locations.
-
-To know the specifics of how it works, you should take a look at the [kernel's doc](https://www.kernel.org/doc/Documentation/networking/filter.txt) and even more in details you can take a look at [cillium's docs](https://docs.cilium.io/en/stable/bpf/#bpf-guide).
-
-### Packet pipeline
-
-Without getting into the specific an eBPF program can be hooked into different hooks on the packet processing pipeline for the linux kernel. eBPF allows hooking into [XDP](https://www.iovisor.org/technology/xdp) which runs just after the packet reached the NIC. However, [XDP doesn't support Wireguard](https://lore.kernel.org/netdev/20200813195816.67222-1-Jason@zx2c4.com/T/) since wireguard doesn't have L2 headers, for more info on this see [this fly.io blogpost](https://fly.io/blog/bpf-xdp-packet-filters-and-udp/#xdp).
-
-Fret not, for eBPF can also hook into the network's [TC Ingress](https://man7.org/linux/man-pages/man8/tc-bpf.8.html) that doesn't make any assumption about the packet's header.
-
-### Maps
-
-Maps are the kernel structures that enables us to share data between the eBPF kernel program and a user-space program. Maps, as their name suggest allow us to store relations as `Key -> Value` the types of maps offered by eBPF is limited however there are a lot of them. For our use case we just need to concern us with [trie](https://github.com/torvalds/linux/blob/master/kernel/bpf/lpm_trie.c) and hash maps.
-
-Again I reffer to [cillium's documentation](https://docs.cilium.io/en/v1.12/bpf/#maps) for more information.
-
-### TL;DR
-
-eBPF is an ISA and its corresponding implementation for user-defined programs that run in the kernel that we used for filtering packets, however, the programs we can run have some severe limitations so that they don't crash the kernel.
-
-## Firewall
-
-With this in mind we wanted to write a Firewall that can allow/deny traffic based on the following:
-
-- Destination CIDR
-- Possibly multiple sender IPs
-- Possibly a port-range along associated with UDP, TCP or both
-
-We took an additional simplification to make the implementation easier(we will see why further along), you can configure the firewall to allow all or deny all, then when a packet match a rule it'd invert that behavior:
-> A firewall that denies all traffic with a rule for destination `10.20.30.40`, would deny all traffic from all sources to all destinations except for traffic for `10.20.30.40` from any destination.
-
-### Aya
-
-When implementing the firewall in Rust two possible libraries:
-
-- [aya](https://github.com/aya-rs/aya)
-- [redbpf](https://github.com/foniod/redbpf)
-
-`redbpf` relies on bindings to `libbpf` while `aya` only relies on `libc`, also, aya's tooling seems to be easier to use and it uses cargo's target for ebpf instead of relying on `cargo bpf` which is easier when writing the Firewall as a library.
-
-So taking that into account we went with `aya`.
-
-Normally, the way an aya program is structured: we have a user-space crate that loads the eBPF program and is a proxy between it and the user and a crate that targets eBPF which has more limitations(such as being `no-std`).
-
-Aya normally expects to be run as a binary and not as a library or as a separate userspace/bpf library, so we needed to do some tuning for the template to be able to run it as we wanted, a single library crate that you include.
-
-More about how we did this in a separate blogpost.
-
-### Architecture
-
-** TODO: ** Add diagrams
-
-So, with this information, we can plan an architecture.
-
-Thinking about the steps how ideally, the firewall would work:
-
-1. A packet arrives
-2. The source is classified into a `user_id` if any
-3. Check existing rules if match
-4. Decide REJECT/ACCEPT action based on previous step
-
-Let's go over how we can achieve this.
-
-### The anatomy of a rule
-
-As we said before a rule has 3 components
-
-- Associated `user_id`
-- Destination CIDR
-- Destination Port Ranges
-
-The `user_id` is an arbitrary name, the idea is that a single rule can associate multiple source ips, so we can associate a rule with an `id` and then we can update the `id` association with multiple ips during runtime.
-
-Rules need to be stored in eBPF's maps, that way we can update the maps during run-time from userspace to be able to update the rules.
-
-And we need to be able to lookup those maps using information from the incoming packets.
-
-The way we did this is having the following maps:
-
-- `SOURCE_MAP`: A hashmap mapping source ips to `id`s
-- `RULE_MAP`: A trie mapping CIDR to port ranges
-
-** Note: ** There is actually an ipv6 and ipv4 version for both of those maps, so we have 4 maps in total.
-
-### `SOURCE_MAP`
-
-The `SOURCE_MAP` is really simple, we store the mapping IP -> ID, so we can associate let's say IP `10.10.10.3` and `10.10.10.4` with id `4` and `10.1.1.5` with id `7`. Now when a packet comes from `10.10.10.4` we lookup the map and get `4` and for `10.1.1.5` we get `7`.
-
-### `RULE_MAP`
-
-[Tries](https://en.wikipedia.org/wiki/Trie) are prefix-matching trees, they let us efficiently store and lookup ranges grouped by prefix. For ips this is exactly how [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) works.
-
-The nodes in the trie tree correspond to a an ip and a prefix, so `10.5.8.0/24` corresponds to to the bits of `10.5.8.0` and 24 bits so that node would match with `10.5.8.0` to `10.5.8.255` but if you store `10.5.8.128/25` that'd match with `10.5.8.128` to `10.5.8.255`.
-
-Both nodes, `10.5.8.0/24 and `10.5.8.128/25`, could be stored but the `lookup` method in the `trie` only allows us to find the node with the most specific match. so `10.5.8.110` would match with `10.5.8.0/24` and `10.5.8.170` would match with `10.5.8.128/25` but we would never learn that it also match with `10.5.8.0/24`.
-
-So a trie would give us a way to associate CIDR with... something? The question is what's this "something".
-
-Well, we don't need an action, since we know the action is just inverting the default one. What we still lack to know if the rule matches is a port-range(With its protocol) and the associated `id`.
-
-However, if we store multiple rules, all associated with the same destination IP we would need to lookup all the rules for each packet and this is incredibly inefficient. But there's a solution, we can easily store the ID and protocol in the key!
-
-So instead of storing as the key `10.5.8.0/24` and when we do lookup we get all the other data we store as the key `6.TCP.10.5.8.0` and the prefix instead of 24 is 33, 4 extra bytes for the id, 1 for the protocol(We use the protocol number).
-
-If this is still unclear we will see more when we discuss the specific of the code, just know that we store the id and protocol as part of the key, so we can compose the number `id.protocol.ip` with the prefix and look that up.
-
-The result value will be the port range, which we have to map to the port of the incoming packet, we will talk more about how we do this below.
-
-For sources with no id we use `0` as the id. For non-TCP/UDP packets, we store the rule in both the TCP and UDP key and look up TCP(arbitrarily) but only match for port 0 (which we use to encode all ports), for rules with both protocols, we store the rule twice once for TCP and once for UDP.
-
-### Another look at the ip matching
-
-Let's look again at the steps when a packet arrives:
-
-1. Packet arrives
-2. Lookup destination IP get an ID or use 0
-3. Create the lookup key (ID.PROTOCOL.DESTINATION_IP)
-4. Use the lookup key to get the port ranges
-5. Lookup the port in the port ranges
-6. REJECT/ACCEPT based on that
-
-Basically, this is a high-level on how the ebpf side works. Now, let's take a look at the userspace-side.
-
-### Userspace
-
-Now that we know how we access the rules let's see how we need to store them from userspace.
-
-Remember, that the Trie map provided by the kernel, for search, only have its lookup method that let us know the longest prefix. So let's think about this scenario:
-
-We store these rules:
-
-```
-10.0.0.0/24 port 80 Allowed
-10.0.0.1/32 port 23 Allowed
-```
-
-now a packet comes from 10.0.0.1 with port 80, and we use the Trie lookup method to see if it's allowed, the lookup method returns all the ports from the longest prefix, meaning port 23 is allowed but the packet has port 80 so it's denied.
-
-This is of course, erroneous because IP `10.0.0.1` is part of range `10.0.0.0/24` which has port 80 is allowed. So what do we do about this? Changing the trie API is impossible without modifying the kernel and even if we submit the PR for that the new API would only be included in the latest kernels.
-
-We could lookup manually each range before deciding an action, so when packet with `10.0.0.1` comes we check `10.0.0.1/32` then `10.0.0.0/31` the `10.0.0.0/30` so on and so on before taking a decision. The performance of this is bad, specially if we are going to do that about each packet.
-
-What we can do, is from userspace present an API that when adding rules, it propagates them to all pertinent ips, so:
-
-If you have:
-
-```
-10.0.0.1/32 port 23 Allowed
-```
-
-and you want to add `10.0.0.0/24 port 80`, the API would automatically propagate it to:
-
-```
-10.0.0.1/32 port 23, 80 Allowed
-10.0.0.0/24 port 80 Allowed
-```
-
-and if you have:
-
-```
-10.0.0.0/24 port 80 Allowed
-```
-
-then you add `10.0.0.1/32 port 23` the api actually updates the rules like:
-
-```
-10.0.0.1/32 port 23, 80 Allowed
-10.0.0.0/24 port 80 allowed
-```
-
-So you see, how the api automatically propagates rules to have a consistent table.
-
-### Port Ranges
-
-## At last, CODE!
-
-With the previous section you should have a clear picture at the architecture of what we built and why but from now on we will **need** to see code.
-
-Will not go over how Aya's API or eBPF code works, hopefully it will be self-evident with the explanations until now enough to understand the gist of it.
-
-### Code structure
-
-We have 3 crates in our repo:
-* Userspace
-* Common (This contains the codebase shared by both)
-* eBPF
-
-From userspace we have the `Firewall` which is the entrypoint for everything. You first initialize and load a firewall by calling `Firewall::new` for a given interface.
-
-The most interesting part is the `RuleTracker` this is an internal struct (which is almost directly exposed by `Firewall` using pass-through methods), this is where the magic happens, userspace `Rule`s are converted into valid eBPF `Rule`, we keep track of them to propagate them and obviously add them to the maps in eBPF.
-
-So let's see how that happens.
-
-### A rule
-
-#### eBPF
-
-So, how does a rule looks in reality:
-
-```rs
-#[repr(C)]
-pub struct RuleStore {
- // Sorted non-overlapping ranges
- // bit 0-15: port-start
- // bit 16-31: port-end
- rules: [u32; MAX_RULES],
- rules_len: u32,
-}
-```
-
-Structs in eBPF need to be `repr(C)`, which just means it uses C's ABI, eBPF structs need to be simple array of bytes (with no padding to convince the eBPF verifier that we never read uninitialized memory).
-
-So, let's analyze this struct, this is the value that we are going to store in the map. This only need to be the port-ranges (remember that the key already stores the `id`, `destination`, `protocol`).
-
-So we store the rules as an array of port-ranges. With a range being the inclusive intervals of the port covered by the rule. we use the first 2 bytes for the starting port and the last 2 bytes for the ending port.
-
-Then in `rules_len` we just have the number of rules stored (the rest is padded with 0).
-
-#### Useraspace
-
-From userspace we have many different structs that represent a rule at different stage of processing, these are not complex but we have different parts of the code that require different information for what to do with the rule.
-
-But for user-facing API a rule looks like:
-
-```rs
-pub enum Rule {
- V4(RuleImpl),
- V6(RuleImpl),
-}
-```
-
-Alright, not very interesting without knowing how `RuleImpl` looks:
-
-```rs
-pub struct RuleImpl {
- pub(crate) id: Option,
- pub(crate) dest: T,
- pub(crate) port_range: Option,
-}
-```
-
-So we see that a rule in userspace contains all the information for a rule but the important part is:
-
-```rs
-pub(crate) struct PortRange {
- pub(crate) ports: RangeInclusive,
- pub(crate) proto: Protocol,
-}
-```
-
-Cool! Use rust's `RangeInclusive` to represent ports with `u16` as a port and a `Protocol` (which is just an enum to indicate the kind of rule)
-
-So when we do `Firewall::add_rule(rule)` we need to make it arrive to eBPF with the struct we previously saw.
-
-We also need to propagate correctly like we saw in the previous userspace architecture, so let's walk through how does that work!
-
-#### Translation
-
-So at some point we want to add the `rule` to the eBPF map. For that, we first need to determine the key that we are going to use.
-
-That's easy:
-
-```rs
-// Convert the id to big endian bytes
-let key_id = id.to_be_bytes();
-
-// Convert the ip to bytes
-let key_cidr = ip.normalize().as_octets();
-let mut key_data = [0u8; N];
-
-// Store in a new `key_data`: protocol.id.ip
-let (left_key_data, cidr) = key_data.split_at_mut(5);
-let (id, prot) = left_key_data.split_at_mut(4);
-prot[0] = proto;
-id.copy_from_slice(&key_id);
-cidr.copy_from_slice(key_cidr.as_ref());
-
-// Calculate the prefix and return the eBPF key
-Key::new(
- u32::from(ip.prefix()) + (left_key_data.len() * 8) as u32,
- key_data,
-)
-```
-
-Cool, this is the key that we are going to insert to the eBPF map
-
-Now we need to calculate the value that we are going to insert.
-
-Remember that the `rule` field in the ebpf `RuleStore` looked like this:
-
-```rs
- rules: [u32; MAX_RULES],
-```
-
-So we have a maximum number of rules, one reason for this, is that we need to store an array, we can't store a vector (we can't share heap allocations). But this number is also limited by the lookup algorithm.
-
-Remember, that the verifier imposes a limit on the number of times a loop can run, so if we linearly search all ranges we were getting capped at around 1000 intervals we would reach the upper limit on loops, this is okay, this would be enough but we can do better.
-
-If we can somehow sort the port ranges we could do binary search, this means less loop iterations and faster lookup in general. But how to sort it exactly?
-
-This is actually the reason each rule, doesn't have an Accept/Reject instead it only inverts the default behavior, also why we store all UDP rules together and TCP rules together.
-
-To sort, we just need to merge intervals. Merging intervals is a well studied problem that can be done in `O(N)` and since it's from userspace we could afford worse performance.
-
-Mergining intervals just means that from the existing intervals we create a series of new non-overlapping intervals that cover the same area and we sort them.
-
-So `[10-20, 15-30, 6-9]` would become `[6-9, 10-30]`. Then we can do binary search on this interval. We will see below the specific of that but this is the code to get the intervals from a series of port ranges:
-
-
-```rs
-fn resolve_overlap(port_ranges: &mut [&PortRange]) -> Vec<(u16, u16)>
-{
- let mut res = Vec::new();
-
- // Sort the ranges by the starting potr
- port_ranges.sort_by_key(|p| p.ports.ports.start());
-
- Get the first prot into the result
- if let Some(range) = port_ranges.first() {
- res.push((*range.ports.ports.start(), *range.ports.ports.end()));
- } else {
- return res;
- }
-
- // Go through each range
- for range in &port_ranges[1..] {
- let last_res = res
- .last_mut()
- .expect("should contain at least the first element of port_ranges");
-
- // If the new range fall within the last one extend it
- if last_res.1 >= *range.ports.ports.start() {
- *last_res = (last_res.0, last_res.1.max(*range.ports.ports.end()));
- // Otherwise, add a new range
- } else {
- res.push((*range.ports.ports.start(), *range.ports.ports.end()));
- }
- }
-
- res
-}
-```
-
-As you see doing this is really easy. We still need to do some small work to get it from `Vec<(u16, u16)>` to `[u32; RULE_MAX]` but you can imagine it's pretty trivial.
-
-### Propagating Rules
-
-Then the last interesting part from userspace is how to propagate the rules.
-
-So when you insert a new rule, you need to keep track of all the rules that would include it, since when a lookup happen it would return the new rule because it's more specific. So basically the gist is traverse all rules and include all the port ranges from those "above" in the new rule.
-
-```rs
-(The code here requires a lot of context on the specifics of how we did this but it's nothing interesting, check if you can rewrite it in a "context-free" way)
-```
-
-And then there could be more specific rules that are included in the new rule, you need to propagate the new rule (the port-range) to those.
-
-```rs
-(The code here requires a lot of context on the specifics of how we did this but it's nothing interesting, check if you can rewrite it in a "context-free" way)
-```
-
-### eBPF Rule lookup
-
-
-When a packet arrives we first extract the network headers (source, destination, protocol and port).
-
-```rs
- let (source, dest, proto) = load_ntw_headers(&ctx, version)?;
- let port = get_port(&ctx, version, proto)?;
- let class = source_class(source_map, source);
- let action = get_action(class, dest, rule_map, port, proto);
-```
-
-Then, we get the source id:
-
-```rs
-unsafe fn source_class(
- source_map: &HashMap<[u8; N], u32>,
- address: [u8; N],
-) -> Option<[u8; 4]> {
- source_map.get(&address).map(|x| u32::to_be_bytes(*x))
-}
-```
-Then we try to calculate what action we should take:
-
-```rs
-fn get_action(
- group: Option<[u8; 4]>,
- address: [u8; N],
- rule_map: &LpmTrie<[u8; M], RuleStore>,
- port: u16,
- proto: u8,
-) -> i32 {
- let proto = if port == 0 { TCP } else { proto };
- let default_action = get_default_action();
-
- let rule_store = rule_map.get(&Key::new((M * 8) as u32, get_key(group, proto, address)));
- if is_stored(&rule_store, port) {
- return invert_action(default_action);
- }
-
- if group.is_some() {
- let rule_store = rule_map.get(&Key::new((M * 8) as u32, get_key(None, proto, address)));
- if is_stored(&rule_store, port) {
- return invert_action(default_action);
- }
- }
-
- default_action
-}
-```
-
-Here we try to extract the action from the existing map, we get the `RuleStore` by constructing the key corresponding to that packet:
-
-```rs
-fn get_key(
- group: Option<[u8; 4]>,
- proto: u8,
- address: [u8; N],
-) -> [u8; M] {
- let group = group.unwrap_or_default();
- let mut res = [0; M];
- let (res_left, res_address) = res.split_at_mut(5);
- let (res_group, res_proto) = res_left.split_at_mut(4);
- res_group.copy_from_slice(&group);
- res_proto[0] = proto;
- res_address.copy_from_slice(&address);
- res
-}
-```
-And most importantly we lookup in the rulestore if the `port` that arrived exists.
-
-```rs
- pub fn lookup(&self, val: u16) -> bool {
- // 0 means all ports
- if self.rules_len > 0 {
- // SAFETY: We know that rules_len < MAX_RULES
- if start(*unsafe { self.rules.get_unchecked(0) }) == 0 {
- return true;
- }
- }
-
- // We test for 0 in all non tcp/udp packets
- // it's worth returning early for those cases.
- if val == 0 {
- return false;
- }
-
- // Reimplementation of partition_point to satisfy verifier
- let mut size = self.rules_len as usize;
- // appeasing the verifier
- if size >= MAX_RULES {
- return false;
- }
- let mut left = 0;
- let mut right = size;
- #[cfg(not(feature = "user"))]
- let mut i = 0;
- while left < right {
- let mid = left + size / 2;
-
- // This can never happen but we need the verifier to believe us
- let r = if mid < MAX_RULES {
- // SAFETY: We are already bound checking
- *unsafe { self.rules.get_unchecked(mid) }
- } else {
- return false;
- };
- let cmp = start(r) <= val;
- if cmp {
- left = mid + 1;
- } else {
- right = mid;
- }
- size = right - left;
-
- #[cfg(not(feature = "user"))]
- {
- i += 1;
- // This should never happen, here just to satisfy verifier
- if i >= MAX_ITER {
- return false;
- }
- }
- }
-
- if left == 0 {
- false
- } else {
- let indx = left - 1;
- if indx >= MAX_RULES {
- return false;
- }
- // SAFETY: Again, we are already bound checking
- end(*unsafe { self.rules.get_unchecked(indx) }) >= val
- }
- }
-```
-
-If 0 is included we consider it to be "all ports".
-
-Otherwise we basically do binary search on the starting port to see the maximum starting port that is less than the port we are checking for and then we check for the ending port to see if it's more than the port we are checking.
-
-Binary search for the maximum that keeps a predicate as true is an algorithm that already exists in Rust called partition point, we needed to reimplement it to make it compatible with eBPF due to the verifier limitations.
-
-## Conclusion
-
-ebpf is awesome but complicated! (something along those lines) and future for firezone rearchitecture and check it out!
diff --git a/www/blog/authors.yml b/www/blog/authors.yml
deleted file mode 100644
index 189b7469c..000000000
--- a/www/blog/authors.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-jamil:
- name: Jamil Bou Kheir
- title: Co-founder
- url: https://github.com/jamilbk
- image_url: https://www.gravatar.com/avatar/3c8434814eec26026718e992322648c8
-
-jason:
- name: Jason Gong
- title: Co-founder
- url: https://github.com/gongjason
- image_url: https://www.gravatar.com/avatar/d688e2280a36287f61c4426334dce065
-
-conectado:
- name: Gabriel Steinberg
- title: Senior Rust Engineer
- url: https://github.com/conectado
diff --git a/www/docs/README.mdx b/www/docs/README.mdx
deleted file mode 100644
index a7ccb391c..000000000
--- a/www/docs/README.mdx
+++ /dev/null
@@ -1,49 +0,0 @@
----
-title: Overview
-sidebar_position: 1
----
-
-[Firezone](/) is an open-source secure remote access
-platform that can be deployed on your own infrastructure in minutes.
-Use it to **quickly and easily** secure access to
-your private network and internal applications from an intuitive web UI.
-
-
-
-These docs explain how to deploy, configure, and use Firezone.
-
-## Quick start
-
-1. [Deploy](deploy): A step-by-step walk-through setting up Firezone.
- Start here if you are new.
-1. [Authenticate](authenticate): Set up authentication using local
- email/password, OpenID Connect, or SAML 2.0 and optionally enable
- TOTP-based MFA.
-1. [Administer](administer): Day to day administration of the Firezone
- server.
-1. [User Guides](user-guides): Useful guides to help you learn how to use
- Firezone and troubleshoot common issues. Consult this section
- after you successfully deploy the Firezone server.
-
-## Common configuration guides
-
-1. [Split Tunneling](./user-guides/use-cases/split-tunnel):
- Only route traffic to certain IP ranges through the VPN.
-1. [Setting up a NAT Gateway with a Static IP](./user-guides/use-cases/nat-gateway):
- Configure Firezone with a static IP address to provide
- a single egress IP for your team's traffic.
-1. [Reverse Tunnels](./user-guides/use-cases/reverse-tunnel):
- Establish tunnels between multiple peers.
-
-import SupportOptions from "@site/src/partials/_support_options.mdx";
-;
-
-## Contribute to firezone
-
-We deeply appreciate any and all contributions to the project and do our best to
-ensure your contribution is included. To get started, see [CONTRIBUTING.md
-](https://github.com/firezone/firezone/blob/master/CONTRIBUTING.md).
-
-
-
-
diff --git a/www/docs/administer/README.mdx b/www/docs/administer/README.mdx
deleted file mode 100644
index a7830cb43..000000000
--- a/www/docs/administer/README.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Administer
-sidebar_position: 4
----
-
-```mdx-code-block
-import DocCardList from '@theme/DocCardList';
-import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
-
-
-```
diff --git a/www/docs/administer/backup.mdx b/www/docs/administer/backup.mdx
deleted file mode 100644
index cf5aaa934..000000000
--- a/www/docs/administer/backup.mdx
+++ /dev/null
@@ -1,101 +0,0 @@
----
-title: Backup and Restore
-sidebar_position: 4
----
-
-Firezone can be safely backed up and restored in a couple of minutes under
-most circumstances.
-
-:::info
-This guide is written for Firezone deployments using **Docker Engine** on **Linux** only.
-:::
-
-Unless your hosting provider supports taking live VM snapshots, you'll
-need to stop Firezone before backing it up. This ensures the Postgres data
-directory is in a consistent state when the backup is performed. Backing up a
-running Firezone instance will **most likely** result in data loss when restored;
-you have been warned.
-
-After stopping Firezone, backing up Firezone is mostly a matter of copying the relevant
-[files and directories](/docs/reference/file-and-directory-locations/) to a location of your
-choosing.
-
-See the steps below for specific examples for Docker and Omnibus.
-
-
-
-
-### Backup
-
-For Docker-based deployments, this will consist of backing up the `$HOME/.firezone`
-directory along with the Postgres data directory, typically located at
-`/var/lib/docker/volumes/firezone_postgres-data` on Linux if you're using the default
-Docker compose template.
-
-1. Stop Firezone (warning: this **will** disconnect any users connected to the VPN):
-
-```
-docker compose -f $HOME/.firezone/docker-compose.yml down
-```
-
-2. Copy relevant files and folders. If your made any customizations to `/etc/docker/daemon.json`
- (for example, for IPv6 support), be sure to include that in the backup as well.
-
-```
-tar -zcvfp $HOME/firezone-back-$(date +'%F-%H-%M').tgz $HOME/.firezone /var/lib/docker/volumes/firezone_postgres-data
-```
-
-A backup file named `firezone-back-TIMESTAMP.tgz` will then be stored in `$HOME/`.
-
-### Restore
-
-1. Copy the files back to their original location:
-
-```
-tar -zxvfp /path/to/firezone-back.tgz -C / --numeric-owner
-```
-
-2. Optionally, enable Docker to boot on startup:
-
-```
-systemctl enable docker
-```
-
-
-
-
-### Backup
-
-1. Stop Firezone (warning: this **will** disconnect any users connected to the VPN):
-
-```
-firezone-ctl stop
-```
-
-2. Copy relevant files and folders:
-
-```
-tar -zcvfp $HOME/firezone-back-$(date +'%F-%H-%M').tgz /var/opt/firezone /opt/firezone /usr/bin/firezone-ctl /etc/systemd/system/firezone-runsvdir-start.service /etc/firezone
-```
-
-A backup file named `firezone-back-TIMESTAMP.tgz` will then be stored in `$HOME/`.
-
-### Restore
-
-1. Copy the files back to their original location:
-
-```
-tar -zxvfp /path/to/firezone-back.tgz -C / --numeric-owner
-```
-
-2. Reconfigure Firezone to ensure configuration is applied to the host system:
-
-```
-firezone-ctl reconfigure
-```
-
-
-
-
-import SupportOptions from "@site/src/partials/_support_options.mdx";
-;
diff --git a/www/docs/administer/debug-logs.mdx b/www/docs/administer/debug-logs.mdx
deleted file mode 100644
index 834d875c6..000000000
--- a/www/docs/administer/debug-logs.mdx
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Debug Logs
-sidebar_position: 8
-description:
- Docker deployments of Firezone generate and store debug logs to a JSON
- file on the host machine.
----
-
-:::note
-This article is written for Docker based deployments of Firezone.
-:::
-
-Docker deployments of Firezone consist of 3 running containers:
-
-| Container | Function | Example logs |
-| --------- | ------------- | --------------------------------------------- |
-| firezone | Web portal | HTTP requests received and responses provided |
-| postgres | Database | |
-| caddy | Reverse proxy | |
-
-Each container generates and stores logs to a JSON file on the host
-machine. These files can be found at
-`var/lib/docker/containers/{CONTAINER_ID}/{CONTAINER_ID}-json.log`.
-
-Run the `docker compose logs` command to view the log output from all running
-containers. Note, `docker compose` commands need to be run in the Firezone
-root directory. This is `$HOME/.firezone` by default.
-
-See additional options of the `docker compose logs` command
-[here](https://docs.docker.com/engine/reference/commandline/compose_logs/).
-
-## Managing and configuring Docker logs
-
-By default, Firezone uses the `json-file` logging driver without
-[additional configuration](https://docs.docker.com/config/containers/logging/json-file/).
-This means logs from each container are individually stored in a file format
-designed to be exclusively accessed by the Docker daemon. Log rotation is not
-enabled, so logs on the host can build up and consume excess storage space.
-
-For production deployments of Firezone you may want to configure how logs are
-collected and stored. Docker provides
-[multiple mechanisms](https://docs.docker.com/config/containers/logging/configure/)
-to collect information from running containers and services.
-
-Examples of popular plugins, configurations, and use cases are:
-
-- Export container logs to your SIEM or observability platform (i.e.
- [Splunk](https://docs.docker.com/config/containers/logging/splunk/)
- or
- [Google Cloud Logging](https://docs.docker.com/config/containers/logging/gcplogs/)
- )
-- Enable log rotation and max file size.
-- [Customize log driver output](https://docs.docker.com/config/containers/logging/log_tags/)
- with tags.
diff --git a/www/docs/administer/migrate.mdx b/www/docs/administer/migrate.mdx
deleted file mode 100644
index b9bb0d9a6..000000000
--- a/www/docs/administer/migrate.mdx
+++ /dev/null
@@ -1,74 +0,0 @@
----
-title: Migrate to Docker
-sidebar_position: 2
----
-
-# Migrate from Omnibus to Docker
-
-Chef Infra Client, the configuration system Chef Omnibus relies on, has been
-[scheduled for End-of-Life in 2024](https://docs.chef.io/versions/).
-Firezone 0.7 will be the last version to offer Omnibus-based deployments.
-Users are encouraged to migrate to a Docker-based deployment of Firezone using
-this guide.
-
-Existing Omnibus-based deployments of Firezone will continue to function as-is,
-but no officially supported RedHat or Debian packages will be published for
-Firezone 0.8 and above.
-
-See this [GitHub issue tracking discussion
-](https://github.com/firezone/firezone/issues/1304) for more details.
-
-Follow this guide to migrate from an Omnibus-based deployment to a Docker-based
-deployment. In most cases this can be done with minimal downtime and without
-requiring you to regenerate WireGuard configurations for each device.
-
-Heavily customized deployments (such as those using an external database or
-custom reverse proxy) will likely need extra troubleshooting and manual
-steps taken to perform a successful migration.
-
-Take a look at the [migration script source
-](https://github.com/firezone/firezone/blob/master/scripts/docker_migrate.sh)
-to get a detailed idea of the steps involved.
-
-Estimated time to complete: **2 hours**.
-
-## Steps to migrate
-
-1. **Back up** your server. This ensures you have a working state to roll back to
- in case anything goes terribly wrong. At a _bare minimum_ you'll want to back up the
- [file and directories Firezone uses
- ](/docs/reference/file-and-directory-locations/), but we recommend taking a full
- snapshot of your VPS if possible.
-1. Ensure you're running the latest version of Firezone. See our [upgrade guide
- ](/docs/administer/upgrade/) if not.
-1. Install the latest version of [**Docker**
- ](https://docs.docker.com/engine/install/) and [Docker Compose
- ](https://docs.docker.com/compose/install/linux/#install-compose)
- for your OS. **Docker Compose version 2 or higher is required**.
- We recommend using Docker Server for Linux. Docker Desktop will work too, but is not
- preferred for production use cases at this time because it rewrites packets under
- some conditions and may cause unexpected issues with Firezone.
-1. Download and run the migration script:
-
-```bash
-bash <(curl -fsSL https://github.com/firezone/firezone/raw/master/scripts/docker_migrate.sh)
-```
-
-This will ask you a few questions, then attempt to migrate your installation to
-Docker. If all goes well, your Firezone instance should be running with Docker, data intact.
-
-## Rolling back
-
-If anything goes wrong, you can abort the migration by simply bringing the Docker
-services down and the Omnibus ones back up:
-
-```bash
-docker-compose down
-sudo firezone-ctl start
-```
-
-If you've found a bug, please [open a GitHub issue](https://github.com/firezone/firezone/issues) with the error output and
-any steps needed to reproduce.
-
-import SupportOptions from "@site/src/partials/_support_options.mdx";
-;
diff --git a/www/docs/administer/regen-keys.mdx b/www/docs/administer/regen-keys.mdx
deleted file mode 100644
index c9abd1250..000000000
--- a/www/docs/administer/regen-keys.mdx
+++ /dev/null
@@ -1,67 +0,0 @@
----
-title: Regenerate Secret Keys
-sidebar_position: 7
----
-
-When you install Firezone, secrets are generated for encrypting database
-fields, securing WireGuard tunnels, securing cookie sessions, and more.
-
-If you're looking to regenerate one or more of these secrets, it's possible
-to do so using the same bootstrap scripts that were used when installing
-Firezone.
-
-## Regenerate secrets
-
-:::warning
-Replacing the `DATABASE_ENCRYPTION_KEY` will render all encrypted data in the
-database useless. This **will** break your Firezone install unless you are
-starting with an empty database. You have been warned.
-:::
-
-:::caution
-Replacing `GUARDIAN_SECRET_KEY`, `SECRET_KEY_BASE`, `LIVE_VIEW_SIGNING_SALT`,
-`COOKIE_SIGNING_SALT`, and `COOKIE_ENCRYPTION_SALT` will reset all browser
-sessions and REST API tokens.
-:::
-
-Use the procedure below to regenerate secrets:
-
-
-
-
-Navigate to the Firezone installation directory, then:
-
-```bash
-mv .env .env.bak
-docker run firezone/firezone bin/gen-env > .env
-```
-
-Now, move desired env vars from `.env.bak` back to `.env`, keeping
-the new secrets intact.
-
-
-
-
-## Regenerate WireGuard private key
-
-:::warning
-Replacing the WireGuard private key will render all existing device configs
-invalid. Only do so if you're prepared to also regenerate device configs
-after regenerating the WireGuard private key.
-:::
-
-To regenerate WireGuard private key, simply move or rename the private key file.
-Firezone will generate a new one on next start.
-
-
-
-
-```bash
-cd $HOME/.firezone
-docker-compose stop firezone
-sudo mv firezone/private_key firezone/private_key.bak
-docker-compose start firezone
-```
-
-
-
diff --git a/www/docs/administer/troubleshoot.mdx b/www/docs/administer/troubleshoot.mdx
deleted file mode 100644
index 01e722646..000000000
--- a/www/docs/administer/troubleshoot.mdx
+++ /dev/null
@@ -1,153 +0,0 @@
----
-title: Troubleshoot
-sidebar_position: 6
-description: Troubleshoot common connectivity and configuration issues with Firezone's WireGuard®-based secure access platform.
----
-
-This guide documents common configuration and connectivity issues. For
-any problems that arise, a good first bet is to check the Firezone logs.
-
-
-
-
-Each container stores logs as a JSON file on the host machine. These can be shown with the
-`docker logs {CONTAINER}` command. Log files are found at
-`var/lib/docker/containers/{CONTAINER_ID}/{CONTAINER_ID}-json.log` by default.
-
-See [debug logs](../debug-logs) for additional details.
-
-
-
-
-## Application crash loop preventing config changes
-
-In cases where the application is crash looping because of corrupt, inaccessible, or
-invalid OIDC or SAML configuration in the DB, you can try clearing the affected fields.
-
-For example, to clear OIDC configs:
-
-
-
-
-```text
-psql -d firezone -h 127.0.0.1 -U postgres -c "UPDATE configurations SET openid_connect_providers = '[]'"
-```
-
-Similarly, to clear SAML configs:
-
-```text
-psql -d firezone -h 127.0.0.1 -U postgres -c "UPDATE configurations SET saml_identity_providers = '[]'"
-```
-
-
-
-
-## Debugging WebSocket connectivity issues
-
-The Web UI requires a secure websocket connection to function.
-If a secure websocket connection can't be established, you'll see a red dot
-indicator in the upper-right portion of the Firezone web UI and a corresponding
-message when you hover over it:
-
-```text
-Secure websocket not connected! ...
-```
-
-If you're accessing Firezone using the same URL defined in your
-`EXTERNAL_URL` variable from above, the issue is likely to be in your reverse
-proxy configuration. Ensure your reverse proxy has WebSocket support enabled
-for Firezone. If you're using the default Caddy reverse proxy, WebSocket
-is enabled and configured automatically.
-
-In most cases, you'll find clues in one or more of the following locations:
-
-
-
-## Debugging WireGuard connectivity issues
-
-Most connectivity issues with Firezone are caused by other `iptables` or
-`nftables` rules which interfere with Firezone's operation. If you have rules
-active, you'll need to ensure these don't conflict with the Firezone rules.
-
-### Internet connectivity drops when tunnel is active
-
-If your Internet connectivity drops whenever you activate your WireGuard
-tunnel, you should make sure that the `FORWARD` chain allows packets
-from your WireGuard clients to the destinations you want to allow through
-Firezone.
-
-If you're using `ufw`, this can be done by making sure the default routing
-policy is `allow`:
-
-```text
-ubuntu@fz:~$ sudo ufw default allow routed
-Default routed policy changed to 'allow'
-(be sure to update your rules accordingly)
-```
-
-A `ufw` status for a typical Firezone server might look like this:
-
-```text
-ubuntu@fz:~$ sudo ufw status verbose
-Status: active
-Logging: on (low)
-Default: deny (incoming), allow (outgoing), allow (routed)
-New profiles: skip
-
-To Action From
--- ------ ----
-22/tcp ALLOW IN Anywhere
-80/tcp ALLOW IN Anywhere
-443/tcp ALLOW IN Anywhere
-51820/udp ALLOW IN Anywhere
-22/tcp (v6) ALLOW IN Anywhere (v6)
-80/tcp (v6) ALLOW IN Anywhere (v6)
-443/tcp (v6) ALLOW IN Anywhere (v6)
-51820/udp (v6) ALLOW IN Anywhere (v6)
-```
-
-## Admin login isn't working
-
-If the password for the account with email `DEFAULT_ADMIN_EMAIL` isn't working, you can
-reset it using the process below.
-
-
-
-
-First change directory to your Firezone installation directory
-(`$HOME/.firezone` by default), then run the `bin/create-or-reset-admin` script
-to reset the admin user's password. The password for the user specified by
-`DEFAULT_ADMIN_EMAIL`
-in `$HOME/.firezone/.env` will be reset to the `DEFAULT_ADMIN_PASSWORD` variable.
-
-```shell
-cd $HOME/.firezone
-docker compose exec firezone bin/create-or-reset-admin
-```
-
-**Note**: If local authentication is disabled, resetting the admin user's
-password will not re-enable it.
-
-
-
-
-## Re-enable local authentication via CLI
-
-If you've configured an [OIDC](/docs/authenticate/oidc/) or [SAML](/docs/authenticate/saml/)
-provider, you can consider disabling local authentication for additional security.
-
-If, however, issues arise with your identity provider integration, it's possible you
-could be locked out of the admin portal. To re-enable local authentication so
-you can log in and resolve the issue, you can temporarily re-enable local authentication
-via the [REST API](/docs/reference/rest-api/configurations).
-
-If that's not an option, you can re-enable local authentication by
-running the following commands on the host of your Firezone instance:
-
-```shell
-cd $HOME/.firezone
-docker compose exec postgres psql -U postgres -h 127.0.0.1 -d firezone -c "UPDATE configurations SET local_auth_enabled = 't'"
-```
-
-import SupportOptions from "@site/src/partials/_support_options.mdx";
-;
diff --git a/www/docs/administer/uninstall.mdx b/www/docs/administer/uninstall.mdx
deleted file mode 100644
index 7c4bd94fc..000000000
--- a/www/docs/administer/uninstall.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: Uninstall
-sidebar_position: 5
----
-
-Firezone can be uninstalled using the steps below.
-
-:::warning
-This will irreversibly destroy ALL Firezone data and can't be undone.
-:::
-
-
-
-
-For docker-based deployments, simply bring the firezone services down,
-then delete the working directory where you installed the Firezone docker
-files (`$HOME/.firezone` by default):
-
-```bash
-# default install dir
-installDir=$HOME/.firezone
-docker compose -f $installDir/docker-compose.yml down -v
-rm -rf $installDir
-```
-
-
-
-
-To completely remove Omnibus-based deployments of Firezone run the [uninstall.sh
-script](https://github.com/firezone/firezone/blob/master/scripts/omnibus-uninstall.sh):
-
-```bash
-sudo /bin/bash -c "$(curl -fsSL https://github.com/firezone/firezone/raw/master/scripts/omnibus-uninstall.sh)"
-```
-
-
-
diff --git a/www/docs/administer/upgrade.mdx b/www/docs/administer/upgrade.mdx
deleted file mode 100644
index ee2504b12..000000000
--- a/www/docs/administer/upgrade.mdx
+++ /dev/null
@@ -1,283 +0,0 @@
----
-title: Upgrade
-sidebar_position: 3
----
-
-Upgrading Firezone will pause all VPN sessions and temporarily bring
-down the web UI.
-
-:::info
-Automatic rollbacks are still under development. We recommend backing up
-relevant [files and folders](/docs/reference/file-and-directory-locations/)
-before upgrading in case anything goes wrong.
-:::
-
-Follow the steps below to upgrade Firezone:
-
-
-
-
-1. Change to your Firezone installation directory, by default `$HOME/.firezone`:
-
-```
-cd $HOME/.firezone
-```
-
-1. If your `.env` file has a `VERSION` variable, update it to the desired version.
- By default `latest` is assumed if not set. This variable is read in newer versions
- of the docker-compose.yml template to populate the `image:` key for the `firezone`
- service.
-1. Update service images:
-
-```
-docker compose pull
-```
-
-1. Re-up the services (**warning: this will restart updated services**):
-
-```
-docker compose up -d
-```
-
-
-
-
-1. If not setup already, install our package repository based on your distro's
- package format:
-
-- [deb packages](https://cloudsmith.io/~firezone/repos/firezone/setup/#formats-deb)
-- [rpm packages](https://cloudsmith.io/~firezone/repos/firezone/setup/#formats-rpm)
-
-1. Upgrade the `firezone` package using your distro's package manager.
-1. Run `firezone-ctl reconfigure` to pick up the new changes.
-1. Run `firezone-ctl restart` to restart services.
-
-
-
-
-If you hit any issues, please let us know by [filing an
-issue](https://github.com/firezone/firezone/issues/new/choose).
-
-## Upgrading to 0.7.x
-
-Firezone 0.7.0 introduces a new [REST API](/docs/reference/rest-api/) that allows administrators
-to automate much of the day to day configuration of Firezone.
-
-The REST API `/v0/configuration` endpoint supersedes some of the previous environment
-variables used for WireGuard server configuration.
-
-If you're running Firezone < 0.6, we recommend updating to the latest
-0.6.x release **before** upgrading to 0.7. This will ensure any environment variables
-are properly parsed and migrated into the DB as runtime `configurations`.
-
-**Note**: Omnibus deployments are deprecated in 0.7.x and will be removed in Firezone
-0.8 and above. We recommend [migrating your installation](/docs/administer/migrate/) to
-Docker if you haven't done so already.
-
-## Upgrading to >= 0.6.12
-
-### WIREGUARD\_\* env vars
-
-Firezone 0.6.12 moves the `WIREGUARD_ALLOWED_IPS`, `WIREGUARD_PERSISTENT_KEEPALIVE`,
-and `WIREGUARD_DNS` environment variables to the database to be configured in the
-UI at `/settings/client_defaults`. If the corresponding value at
-`/settings/client_defaults` was empty, the environment variable's value was used to
-populate the field.
-
-This is a small step in our quest to move more runtime configuration from environment
-variables to the DB.
-
-### `AUTH_OIDC_JSON` config
-
-Similar to the `WIREGUARD_*` env vars above, the `AUTH_OIDC_JSON` env var has similarly
-been moved to the database and can be configured at `/settings/site`. In Firezone 0.7 this
-is now configurable via the [REST API](/docs/reference/rest-api/configurations) as well.
-
-### Fix IPv6
-
-0.6.12 fixes IPv6 routing within Docker networks.
-To enable, add IPv6 addresses to your `$HOME/.firezone/docker-compose.yml` by setting the following fields:
-
-```yaml
-services:
- firezone:
- networks:
- firezone-network:
- ipv6_address: 2001:3990:3990::99
-
-# ...
-networks:
- firezone-network:
- ipam:
- config:
- - subnet: 2001:3990:3990::/64
- - gateway: 2001:3990:3990::1
-```
-
-You also need to update the Docker daemon to enable IPv6. See our [IPv6 guide](/docs/deploy/docker/#step-4-enable-ipv6-optional) for more info.
-
-## Upgrading from 0.5.x to 0.6.x
-
-Firezone 0.6 introduces **Docker support**, SAML 2.0 authentication,
-more granular user provisioning options, and a slew of minor improvements and bugfixes.
-
-### Migrate to Docker
-
-Docker is now the preferred way to deploy and manage Firezone. See the [migration
-guide](/docs/administer/migrate/) to migrate today. In most cases this can be done in a few minutes
-using our automatic migration script.
-
-### Update Configuration
-
-Some configuration variables have recently moved to the DB in order to be configurable
-at runtime. Check the [configure guide](/docs/deploy/configure/) for more information.
-
-## Upgrading from < 0.5.0 to >= 0.5.0
-
-0.5.0 introduces a few breaking changes and configuration updates that will need
-to be addressed. Read more below.
-
-### Bundled Nginx non_ssl_port (HTTP) requests removed
-
-0.5.0 and above removes the `force_ssl` and `non_ssl_port` settings for
-Nginx. SSL is required for Firezone to function; if you're using (or would like
-to use) your own reverse proxy, we recommend disabling the bundle Nginx service
-by setting `default['firezone']['nginx']['enabled'] = false` and pointing your
-reverse proxy directly to the Phoenix app on port 13000 (by default).
-
-Read more about setting up a custom reverse proxy
-[here](/docs/deploy/advanced/reverse-proxy/).
-
-### ACME protocol support
-
-0.5.0 introduces ACME protocol support for automatically renewing SSL
-certificates with the bundled Nginx service. To enable,
-
-- Make sure `default['firezone']['external_url']` contains a valid FQDN that
- resolves to your server's public IP address.
-
-- Ensure port `80/tcp` is reachable
-
-- Enable ACME protocol support with
- `default['firezone']['ssl']['acme']['enabled'] = true` in your config file.
-
-### Overlapping egress rule destinations
-
-Firezone 0.5.0 removes the ability to add rules with overlapping destinations.
-When upgrading to 0.5.0, our migration script will automatically detect these
-cases and **keep only the rules whose destination encompasses the other rule**.
-If this is OK, **there is nothing you need to do**.
-
-Otherwise, we recommend modifying your ruleset to eliminate these cases before
-upgrading.
-
-### Preconfigured Okta and Google SSO
-
-Firezone 0.5.0 removes support for the old-style Okta and Google SSO
-configuration in favor of the new, more flexible OIDC-based configuration.
-If you have any configuration under the
-`default['firezone']['authentication']['okta']` or
-`default['firezone']['authentication']['google']` keys, **you need to migrate
-these to our OIDC-based configuration using the guide below.**
-
-#### Existing Google OAuth configuration
-
-Remove these lines containing the old Google OAuth configs from your configuration
-file located at `/etc/firezone/firezone.rb`
-
-```rb
-default['firezone']['authentication']['google']['enabled']
-default['firezone']['authentication']['google']['client_id']
-default['firezone']['authentication']['google']['client_secret']
-default['firezone']['authentication']['google']['redirect_uri']
-```
-
-Then, follow the instructions [here](/docs/authenticate/oidc/google/) to configure Google
-as an OIDC provider.
-
-#### Existing Okta OAuth configuration
-
-Remove these lines containing the old Okta OAuth configs from your configuration
-file located at `/etc/firezone/firezone.rb`
-
-```rb
-default['firezone']['authentication']['okta']['enabled']
-default['firezone']['authentication']['okta']['client_id']
-default['firezone']['authentication']['okta']['client_secret']
-default['firezone']['authentication']['okta']['site']
-```
-
-Then, follow the instructions [here](/docs/authenticate/oidc/okta/) to configure Okta as
-an OIDC provider.
-
-## Upgrading from 0.3.x to >= 0.3.16
-
-Follow the instructions below based on your current version and setup:
-
-### I have an existing OIDC integration
-
-Upgrading to >= 0.3.16 requires the `offline_access` scope for some OIDC providers
-to obtain a refresh token.
-This ensures Firezone syncs with the identity provider and VPN access is terminated
-once the user is removed. Previous versions of Firezone do not have this capability.
-Users who are removed from your identity provider will still have active VPN sessions
-in some cases.
-
-For OIDC providers that support the `offline_access` scope, you will need to add
-`offline_access` to the `scope` parameter of your OIDC config. The
-Firezone configuration file can be found at `/etc/firezone/firezone.rb` and requires
-running `firezone-ctl reconfigure` to pick up the changes.
-
-If Firezone is able to successfully retrieve the refresh token, you will see
-the **OIDC Connections** heading in the user details page of the web UI for
-users authenticated through your OIDC provider.
-
-
-
-If this does not work, you will need to delete your existing OAuth app
-and repeat the OIDC setup steps to
-[create a new app integration](/docs/authenticate/oidc/) .
-
-### I have an existing OAuth integration
-
-Prior to 0.3.11, Firezone used pre-configured OAuth2 providers. Follow the
-instructions [here](/docs/authenticate/oidc/) to migrate to OIDC.
-
-### I have not integrated an identity provider
-
-No action needed. You can follow the instructions
-[here](/docs/authenticate/oidc)
-to enable SSO through an OIDC provider.
-
-## Upgrading from 0.3.1 to >= 0.3.2
-
-The configuration option `default['firezone']['fqdn']` has been removed in favor
-of `default['firezone']['external_url']`. Please set this to the
-publicly-accessible URL of your Firezone web portal. If left unspecified it will
-default to `https://` + the FQDN of your server.
-
-Reminder, the configuration file can be found at `/etc/firezone/firezone.rb`.
-For an exhaustive list of configuration variables and their descriptions, see the
-[configuration file reference](/docs/reference/configuration-file).
-
-## Upgrading from 0.2.x to 0.3.x
-
-Starting with version 0.3.0, Firezone no longer stores device private
-keys on the Firezone server. Any existing devices should continue to function
-as-is, but you will not be able to re-download or view these configurations in
-the Firezone Web UI.
-
-## Upgrading from 0.1.x to 0.2.x
-
-Firezone 0.2.x contains some configuration file changes that will need to be
-handled manually if you're upgrading from 0.1.x. Run the commands below as root
-to perform the needed changes to your `/etc/firezone/firezone.rb` file.
-
-```bash
-cp /etc/firezone/firezone.rb /etc/firezone/firezone.rb.bak
-sed -i "s/\['enable'\]/\['enabled'\]/" /etc/firezone/firezone.rb
-echo "default['firezone']['connectivity_checks']['enabled'] = true" >> /etc/firezone/firezone.rb
-echo "default['firezone']['connectivity_checks']['interval'] = 3_600" >> /etc/firezone/firezone.rb
-firezone-ctl reconfigure
-firezone-ctl restart
-```
diff --git a/www/docs/authenticate/README.mdx b/www/docs/authenticate/README.mdx
deleted file mode 100644
index a989df386..000000000
--- a/www/docs/authenticate/README.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
----
-title: Authenticate
-sidebar_position: 3
----
-
-Firezone supports the following authentication methods:
-
-1. [Local email/password (default)](local-auth)
-1. [SSO authentication via OpenID Connect](oidc)
-1. [SSO authentication via SAML 2.0](saml)
-
-:::note
-If your Identity Provider doesn't work with the methods listed above,
-[contact us](/contact/support) about a custom integration.
-:::
-
-## Integrate an SSO provider
-
-We've included instructions on how to set up Firezone with several popular
-identity providers using our Generic OIDC integration:
-
-- [Okta](oidc/okta)
-- [Azure Active Directory](oidc/azuread)
-- [Google](oidc/google)
-- [Onelogin](oidc/onelogin)
-- [JumpCloud](saml/jumpcloud)
-- [Keycloak](oidc/keycloak)
-- [Zitadel](oidc/zitadel)
-- [Auth0](oidc/auth0)
-
-If your identity provider is not listed above, but has a generic OIDC or SAML
-connector, please consult their documentation to find instructions on obtaining
-the configuration settings required. Instructions for setting up Firezone with any
-generic OIDC provider can be found [here](oidc).
-
-Open a [Github issue](https://github.com/firezone/firezone/issues)
-to request documentation or submit a pull request to add documentation for your
-provider.
-
-### The OIDC redirect URI
-
-For each OIDC provider a corresponding URL is created for redirecting to
-the configured provider's sign-in URL. The URL format is `https://firezone.example.com/auth/oidc/CONFIG_ID`
-where `CONFIG_ID` is the OIDC Config ID for that particular provider.
-
-For example, the OIDC config below:
-
-
-
-
-
-would generate the following OIDC login URL:
-
-- `https://firezone.example.com/auth/oidc/google`
-
-This URL could then be distributed to end users for direct navigation to
-the identity provider's login portal for authentication to Firezone.
-
-## Enforce periodic re-authentication
-
-Periodic re-authentication can be enforced by changing the setting in
-`settings/security`. This can be used to ensure a user must sign in to Firezone
-periodically in order to maintain their VPN session.
-
-You can set the session length to a minimum of **1 hour** and maximum of **90 days**.
-Setting this to Never disables this setting, allowing VPN sessions indefinitely.
-This is the default.
-
-### Re-authentication
-
-To re-authenticate an expired VPN session, a user will need to turn off their
-VPN session and sign in to the Firezone portal (URL specified during
-[deployment](../deploy#prepare-to-deploy)).
-
-See detailed Client Instructions on how to re-authenticate your session
-[here](../user-guides/client-instructions).
-
-#### VPN connection status
-
-A user's connection status is shown on the Users page under the table column
-`VPN Connection`. The connection statuses are:
-
-- ENABLED - The connection is enabled.
-- DISABLED - The connection is disabled by an administrator or OIDC refresh failure.
-- EXPIRED - The connection is disabled due to authentication expiration or a user
- has not signed in for the first time.
-
-import SupportOptions from "@site/src/partials/_support_options.mdx";
-;
diff --git a/www/docs/authenticate/local-auth.mdx b/www/docs/authenticate/local-auth.mdx
deleted file mode 100644
index ce3c2c94e..000000000
--- a/www/docs/authenticate/local-auth.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Local Authentication
-sidebar_position: 1
----
-
-# Local authentication (email & password)
-
-By default, Firezone will use local email / password for authenticating users to
-the Firezone portal. Administrators can add users and assign their passwords on
-the `/users` page. See [Add users](/docs/user-guides/add-users/) for more details.
-
-:::caution
-Although local authentication is quick and easy to get started with, you can
-limit attack surface by [disabling local authentication](#disabling-local-authentication)
-altogether. See our [OIDC](/docs/authenticate/oidc/) or [SAML](/docs/authenticate/saml/) guides
-for details. For production deployments it's usually a good idea to **disable
-local authentication** and enforce MFA through your identity provider.
-:::
-
-If you choose to keep Local authentication enabled, we recommend [enabling TOTP-based MFA
-](/docs/authenticate/multi-factor/) for any accounts that use the local authentication method.
-
-## Disabling local authentication
-
-Local authentication can be enabled or disabled from the `/settings/security` page
-or via the [REST API](/docs/reference/rest-api/configurations).
-If you've disabled local authentication and can no longer authenticate to the portal
-to re-enable it, see our [troubleshooting guide
-](/docs/administer/troubleshoot#re-enable-local-authentication-via-cli) for re-enabling
-local authentication from the CLI.
diff --git a/www/docs/authenticate/multi-factor.mdx b/www/docs/authenticate/multi-factor.mdx
deleted file mode 100644
index e206a48a7..000000000
--- a/www/docs/authenticate/multi-factor.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-title: Multi-Factor Authentication
-sidebar_position: 2
-description:
- Enforce multi-factor authentication with Firezone's WireGuard®-based
- secure access platform.
----
-
-# Multi-factor authentication (MFA)
-
-You have two options for activating MFA with Firezone:
-
-1. Enable a TOTP-based second factor for the local email/password
-authentication method.
-1. Configure Firezone to SSO via one of our [supported identity providers
-](../#integrate-an-sso-provider) and enable MFA through the identity provider.
-
-## MFA with Firezone
-
-Firezone currently supports using a time-based one time password
-(TOTP) as an additional factor. This is supported with the local authentication
-method only; for SSO authentication we recommend enabling your provider's MFA
-functionality [as described below](#mfa-with-identity-provider).
-
-Admins can visit `/settings/account/register_mfa` in the admin portal to
-generate a QR code to be scanned by your authenticator app.
-
-Unprivileged users can visit `/user_account/register_mfa` after logging into
-the user portal.
-
-## MFA with your identity provider
-
-Most identity providers support additional authentication factors in addition to
-email/password. Consult your provider's documentation to enforce an
-additional factor. We have included links to a few common providers below:
-
-* [Okta](https://help.okta.com/en-us/Content/Topics/Security/mfa/mfa-home.htm)
-* [Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks)
-* [Google](https://support.google.com/a/answer/175197)
-* [Onelogin](https://www.onelogin.com/getting-started/free-trial-plan/add-mfa)
diff --git a/www/docs/authenticate/oidc/README.mdx b/www/docs/authenticate/oidc/README.mdx
deleted file mode 100644
index 49771de7c..000000000
--- a/www/docs/authenticate/oidc/README.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: OpenID Connect
-sidebar_position: 10
-description: Setup single sign-on with your identity provider. Integrate
- providers like Okta, Google, Azure, and JumpCloud using Firezone's
- OpenID Connect (OIDC) connector.
----
-
-# Integrate your identity provider using OIDC
-
-Firezone supports Single Sign-On (SSO) via OpenID Connect (OIDC).
-
-## Supported identity providers
-
-In general, most identity providers that offer OIDC support work with Firezone. Some providers
-that only implement the OIDC partially or use uncommon configurations may have
-issues, however. If your identity provider falls into this category, [contact us
-](/contact/support) about a custom integration.
-
-The following OIDC providers are known to work well with Firezone:
-
-| Provider | Support Status | Notes |
-| ------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| [Azure Active Directory](azuread) | **Fully tested and supported** | Ensure the [`email` claim](https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-optional-claims) is present in the token. |
-| [Okta](okta) | **Fully tested and supported** | |
-| [Onelogin](onelogin) | **Fully tested and supported** | |
-| [Keycloak](https://www.keycloak.org/) | **Fully tested and supported** | |
-| [Auth0](auth0) | **Fully tested and supported** | Auth0 does not provide an `end_session_uri` in its OIDC discovery document. Signing out of Auth0 from Firezone is not supported. |
-| [Google Workspace](google) | **Fully tested and supported** | Google does not provide an `end_session_uri` in its OIDC discovery document. Signing out of Google Workspace from Firezone is not supported. |
-| [Zitadel](zitadel) | Untested but known to work | |
-| [Authentik](https://goauthentik.io/) | Untested but known to work | |
-
-## General setup guide
-
-If you're using an OIDC provider not listed above, the following OIDC attributes
-are required for setting up an OIDC provider in Firezone:
-
-1. `discovery_document_uri`: The
- [OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
- which returns a JSON document used to construct subsequent requests to this
- OIDC provider. Some providers refer to this as the "well-known URL".
-1. `client_id`: The client ID of the application.
-1. `client_secret`: The client secret of the application.
-1. `redirect_uri`: Instructs OIDC provider where to redirect after authentication.
- This should be your Firezone `EXTERNAL_URL + /auth/oidc//callback/`
- (e.g. `https://firezone.example.com/auth/oidc/google/callback/`).
-1. `response_type`: Set to `code`.
-1. `scope`: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
- to obtain from your OIDC provider. At a minimum, Firezone requires the `openid`
- and `email` scopes.
-1. `label`: The button label text displayed on the Firezone portal login page.
-
-### PKCE
-
-Firezone supports Proof Key for Code Exchange (PKCE) for increased login security.
-We recommend you enable PKCE in your IdP's settings whenever available. [Read more
-about PKCE here](https://oauth.net/2/pkce/).
-
-### OIDC logout URI
-
-The OpenID Connect standard [defines a mechanism](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
-for a Relying Party (RP) to request that an OpenID Provider log out the End-User.
-
-Unfortunately, not all IdPs support this (e.g. Google, Auth0). For the providers
-that do support this mechanism, Firezone automatically detects the `end_session_uri`
-found in the provider's discovery document and uses that to log out the End-User.
diff --git a/www/docs/authenticate/oidc/auth0.mdx b/www/docs/authenticate/oidc/auth0.mdx
deleted file mode 100644
index 7f77b990a..000000000
--- a/www/docs/authenticate/oidc/auth0.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: Auth0
-sidebar_position: 1
-description:
- Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Auth0
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with Auth0 (OIDC)
-
-Firezone supports Single Sign-On (SSO) using Auth0
-through the generic OIDC connector. This guide will walk you through how to
-obtain the following config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `auth0`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `Auth0`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
-to obtain from your OIDC provider. This should be set to `openid email profile`
-to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
-[OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
-which returns a JSON document used to construct subsequent requests to this OIDC
-provider.
-
-## Step 1: Obtain OIDC configuration parameters
-
-In the Auth0 dashboard, create an application.
-Select **Regular Web Application** as the application type.
-
-
-
-Next, visit the settings tab on the application details page. Take note and
-modify the following parameters:
-
-1. **Name**: `Firezone`
-1. **Domain**: The domain will be used to construct
-the url to retrieve the OIDC discovery document - `https:///.well-known/openid-configuration`
-1. **Icon**:
-[Firezone icon](https://user-images.githubusercontent.com/52545545/156854754-da66a9e1-33d5-47f5-877f-eff8b330ab2b.png)
-(save link as).
-1. Set **Allowed Callback URLs** to `EXTERNAL_URL + /auth/oidc//callback/`
-(e.g. `https://firezone.example.com/auth/oidc/auth0/callback/`).
-
-
-
-
-
-## Step 2: Integrate with Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with Auth0` button on the sign in page.
-
-## Step 3 (optional): Restrict access to specific users
-
-Auth0 supports setting access policies to control which users
-can access the Firezone application. See Auth0's
-[Documentation](https://auth0.com/docs/manage-users/user-accounts/manage-user-access-to-applications)
-for details.
diff --git a/www/docs/authenticate/oidc/azuread.mdx b/www/docs/authenticate/oidc/azuread.mdx
deleted file mode 100644
index a30457f6f..000000000
--- a/www/docs/authenticate/oidc/azuread.mdx
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Azure Active Directory
-sidebar_position: 2
-description: Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Azure AD
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with Azure Active Directory (OIDC)
-
-Firezone supports Single Sign-On (SSO) using Azure Active Directory through the generic
-generic OIDC connector. This guide will walk you through how to obtain the following
-config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `azure`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `Azure`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
- to obtain from your OIDC provider. This should be set to `openid email profile offline_access`
- to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
- [OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
- which returns a JSON document used to construct subsequent requests to this
- OIDC provider.
-
-
-
-## Step 1: Obtain configuration parameters
-
-_This guide is adapted from the [Azure Active Directory documentation](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-oidc)._
-
-Navigate to the Azure Active Directory page on the Azure portal.
-Select the App registrations link under the Manage menu, click
-`New Registration`, and register after entering the following:
-
-1. **Name**: `Firezone`
-1. **Supported account types**: `(Default Directory only - Single tenant)`
-1. **Redirect URI**: This should be your Firezone `EXTERNAL_URL + /auth/oidc//callback/`
- (e.g. `https://firezone.example.com/auth/oidc/azure/callback/`). **Make sure you include the trailing slash both
- when saving the provider in Firezone and in Azure AD (`redirect_uri` field on the screenshot below).**
-
-
-
-After registering, open the details view of the application and copy the
-`Application (client) ID`. **This will be the `client_id` value**. Next, open
-the endpoints menu to retrieve the `OpenID Connect metadata document`.
-**This will be the `discovery_document_uri` value**.
-
-
-
-Next, select the Certificates & secrets link under the Manage menu and
-create a new client secret. Copy the client secret - **this will be the
-`client_secret` value**.
-
-
-
-Lastly, select the API permissions link under the Manage menu,
-click `Add a permission`, and select `Microsoft Graph`. Add `email`, `openid`,
-`offline_access` and `profile` to the required permissions.
-
-
-
-## Step 2: Integrate with Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with Azure` button on the sign in page.
-
-## Step 3 (optional): Restrict access to specific users
-
-Azure AD allows admins to restrict OAuth application access to a subset of users
-within your organization. See Microsoft's
-[documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-users)
-for more information on how to do this.
diff --git a/www/docs/authenticate/oidc/google.mdx b/www/docs/authenticate/oidc/google.mdx
deleted file mode 100644
index a27e2ee03..000000000
--- a/www/docs/authenticate/oidc/google.mdx
+++ /dev/null
@@ -1,92 +0,0 @@
----
-title: Google Workspace
-sidebar_position: 3
-description:
- Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Google Workspace
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with Google Workspace (OIDC)
-
-Firezone supports Single Sign-On (SSO) using Google Workspace and Cloud Identity
-through the generic OIDC connector. This guide will walk you through how to
-obtain the following config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `google`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `Google`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
-to obtain from your OIDC provider. This should be set to `openid email profile`
-to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
-[OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
-which returns a JSON document used to construct subsequent requests to this
-OIDC provider.
-
-
-
-## Step 1: Configure OAuth consent screen
-
-If this is the first time you are creating a new OAuth client ID, you will
-be asked to configure a consent screen.
-
-**IMPORTANT**: Select `Internal` for user type. This ensures only accounts
-belonging to users in your Google Workspace Organization can create device configs.
-DO NOT select `External` unless you want to enable anyone with a valid Google Account
-to create device configs.
-
-
-
-On the App information screen:
-
-1. **App name**: `Firezone`
-1. **App logo**: [Firezone logo](https://user-images.githubusercontent.com/52545545/156854754-da66a9e1-33d5-47f5-877f-eff8b330ab2b.png)
-(save link as).
-1. **Application home page**: the URL of your Firezone instance.
-1. **Authorized domains**: the top level domain of your Firezone instance.
-
-
-
-On the next step add the following scopes:
-
-
-
-## Step 2: Create OAuth client
-
-_This section is based off Google's own documentation on
-[setting up OAuth 2.0](https://support.google.com/cloud/answer/6158849)._
-
-Visit the Google Cloud Console
-[Credentials page](https://console.cloud.google.com/apis/credentials)
-page, click `+ Create Credentials` and select `OAuth client ID`.
-
-
-
-On the OAuth client ID creation screen:
-
-1. Set `Application Type` to `Web application`
-1. Add your Firezone `EXTERNAL_URL + /auth/oidc//callback/`
-(e.g. `https://firezone.example.com/auth/oidc/google/callback/`) as an entry to
-Authorized redirect URIs.
-
-
-
-After creating the OAuth client ID, you will be given a Client ID and Client Secret.
-These will be used together with the redirect URI in the next step.
-
-
-
-## Step 3: Integrate with Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with Google` button on the sign in page.
diff --git a/www/docs/authenticate/oidc/keycloak.mdx b/www/docs/authenticate/oidc/keycloak.mdx
deleted file mode 100644
index 529bfcc3a..000000000
--- a/www/docs/authenticate/oidc/keycloak.mdx
+++ /dev/null
@@ -1,80 +0,0 @@
----
-title: Keycloak
-sidebar_position: 4
-description:
- Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Keycloak
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with Keycloak (OIDC)
-
-Firezone supports Single Sign-On (SSO) using Keycloak
-through the generic OIDC provider. This guide will walk you through how to
-obtain the following config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `keycloak`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `Keycloak`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
-to obtain from your OIDC provider. This should be set to `openid email profile offline_access`
-to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
-[OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
-which returns a JSON document used to construct subsequent requests to this
-OIDC provider.
-
-## Step 1: Obtain configuration parameters
-
-In the Keycloak Admin Console, make sure the realm you want to use with Firezone
-is selected.
-
-
-
-### Create Firezone OAuth client
-
-Create a new Client for Firezone by navigating to **Clients > Create Client** and
-configure the following:
-
-1. **Client type**: `OpenID Connect`
-1. **Client ID**: `firezone`
-1. **Name**: `Firezone`
-1. Click **Next**.
-
-
-
-1. Toggle **Client authentication** to `On` to generate the client secret.
-1. Click **Save**.
-
-
-
-Click **Access settings** to jump to that section and configure the valid redirect URI:
-
-1. **Valid Redirect URIs**: This should be your Firezone `EXTERNAL_URL + /auth/oidc//callback/`
-(e.g. `https://firezone.example.com/auth/oidc/keycloak/callback/`).
-1. Click **Add valid redirect URIs**
-
-
-
-Click the **Credentials** tab and copy the client secret.
-
-
-
-Navigate to the **Realm Settings** page to get the **Discovery Document URI** by
-copying the **OpenID Endpoint Configuration** link at the bottom of the page.
-
-
-
-## Step 2: Integrate with Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with Keycloak` button on the sign in page.
diff --git a/www/docs/authenticate/oidc/okta.mdx b/www/docs/authenticate/oidc/okta.mdx
deleted file mode 100644
index 89a4da2e6..000000000
--- a/www/docs/authenticate/oidc/okta.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-title: Okta
-sidebar_position: 5
-description:
- Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Okta
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with Okta (OIDC)
-
-Firezone supports Single Sign-On (SSO) using Okta
-through the generic OIDC connector. This guide will walk you through how to
-obtain the following config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `okta`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `Okta`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
-to obtain from your OIDC provider. This should be set to `openid email profile offline_access`
-to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
-[OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
-which returns a JSON document used to construct subsequent requests to this
-OIDC provider.
-
-
-
-## Step 1: Create Okta app integration
-
-_This section of the guide is based on
-[Okta's documentation](https://help.okta.com/en/prod/Content/Topics/Apps/Apps_App_Integration_Wizard_OIDC.htm)._
-
-In the Admin Console, go to **Applications > Applications** and click
-**Create App Integration**. Set **Sign-in method** to **OICD - OpenID Connect**
-and **Application type** to **Web application**.
-
-
-
-On the following screen, configure the following settings:
-
-1. **App Name**: `Firezone`
-1. **App logo**:
-[Firezone logo](https://user-images.githubusercontent.com/52545545/155907625-a4f6c8c2-3952-488d-b244-3c37400846cf.png)
-(save link as).
-1. **Proof Key for Code Exchange (PKCE)**: Check `Require PKCE as additional verification` if you're running Firezone
-0.6.8 or higher. [PKCE](https://oauth.net/2/pkce/) is recommended for increased security whenever possible.
-1. **Grant Type**: Check the **Refresh Token** box. This ensures Firezone syncs
-with the identity provider and VPN access is terminated once the user is removed.
-1. **Sign-in redirect URIs**: Add your Firezone `EXTERNAL_URL + /auth/oidc//callback/`
-(e.g. `https://firezone.example.com/auth/oidc/okta/callback/`) as an entry to
-Authorized redirect URIs.
-1. **Assignments**:
-Limit to the groups you wish to provide access to your Firezone instance.
-
-
-
-Once settings are saved, you will be given a **Client ID**, **Client Secret**,
-and **Okta Domain**. These 3 values will be used in Step 2 to configure Firezone.
-
-
-
-## Step 2: Integrate with Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with Okta` button on the sign in page.
-
-## Step 3 (optional): Restrict Access to specific users
-
-Okta can limit the users with access to the Firezone app. To do this,
-go to the Assignments tab of the Firezone App Integration in your Okta
-Admin Console.
-
-
diff --git a/www/docs/authenticate/oidc/onelogin.mdx b/www/docs/authenticate/oidc/onelogin.mdx
deleted file mode 100644
index c043f75d0..000000000
--- a/www/docs/authenticate/oidc/onelogin.mdx
+++ /dev/null
@@ -1,65 +0,0 @@
----
-title: OneLogin
-sidebar_position: 6
-description:
- Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating OneLogin
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with OneLogin (OIDC)
-
-Firezone supports Single Sign-On (SSO) using OneLogin
-through the generic OIDC connector. This guide will walk you through how to
-obtain the following config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `onelogin`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `OneLogin`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
-to obtain from your OIDC provider. This should be set to `openid email profile`
-to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
-[OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
-which returns a JSON document used to construct subsequent requests to this
-OIDC provider.
-
-## Step 1: Create custom connector
-
-Create a new OIDC connector by visiting **Appliances > Custom Connectors**.
-
-1. **App name**: `Firezone`
-1. **Icon**: [Firezone logo](https://user-images.githubusercontent.com/52545545/156854754-da66a9e1-33d5-47f5-877f-eff8b330ab2b.png)
-or
-[Firezone icon](https://user-images.githubusercontent.com/52545545/156854754-da66a9e1-33d5-47f5-877f-eff8b330ab2b.png)
-(save link as).
-1. **Sign on method**: select **OpenID Connect**
-1. **Redirect URI**: Add your Firezone ` + /auth/oidc//callback/`
-(e.g. `https://firezone.example.com/auth/oidc/onelogin/callback/`).
-
-
-
-## Step 2: Obtain configuration parameters
-
-Next, click **Add App to Connector** to create an OIDC application.
-Visit the **SSO** tab, then change the token endpoint authentication method
-to **POST**.
-
-You will find the values for the config settings required by Firezone
-on this page as well.
-
-
-
-## Step 3: Integrate with Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with OneLogin` button on the sign in page.
diff --git a/www/docs/authenticate/oidc/zitadel.mdx b/www/docs/authenticate/oidc/zitadel.mdx
deleted file mode 100644
index c44182311..000000000
--- a/www/docs/authenticate/oidc/zitadel.mdx
+++ /dev/null
@@ -1,103 +0,0 @@
----
-title: Zitadel
-sidebar_position: 7
-description:
- Enforce 2FA/MFA for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Zitadel
- for single sign-on using OpenID Connect (OIDC).
----
-
-# Enable SSO with Zitadel (OIDC)
-
-Firezone supports Single Sign-On (SSO) using Zitadel
-through the generic OIDC connector. This guide will walk you through how to
-obtain the following config settings required for the integration:
-
-1. **Config ID**: The provider's config ID. (e.g. `zitadel`)
-1. **Label**: The button label text that shows up on your Firezone login screen. (e.g. `Zitadel`)
-1. **Scope**: [OIDC scopes](https://openid.net/specs/openid-connect-basic-1_0.html#Scopes)
-to obtain from your OIDC provider. This should be set to `openid email profile offline_access`
-to provide Firezone with the user's email in the returned claims.
-1. **Response type**: Set to `code`.
-1. **Client ID**: The client ID of the application.
-1. **Client secret**: The client secret of the application.
-1. **Discovery Document URI**: The
-[OpenID Connect provider configuration URI](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig)
-which returns a JSON document used to construct subsequent requests to this
-OIDC provider.
-
-
-
-## Requirements
-
-* Setup your own [Zitadel Cloud](https://zitadel.cloud/) account.
-* Create your first Zitadel instance in the
- [Zitadel Customer portal](https://zitadel.cloud/admin/instances)
-* Login to your Zitadel instance and create a project (i.e. "Internal")
-
-More information about these steps can be found in
-[Zitadel's documentation](https://docs.zitadel.com/docs/guides/start/quickstart#try-out-zitadel-cloud).
-
-## Create Zitadel Application
-
-In the Instance Console, go to **Projects** and select the project you want,
-then click **New**.
-
-
-
-Give the application a name (e.g. "Firezone") and select **WEB**
-for the application type.
-
-
-
-Select **CODE** for the authentication method.
-
-
-
-Specify the redirect URI and post logout URI.
-
-1. **Redirect URIs**: `EXTERNAL_URL + /auth/oidc//callback/`
-(e.g. `https://vpn.example.com/auth/oidc/zitadel/callback/`)
-1. **Post Logout URIs**: `EXTERNAL_URL` (e.g. `https://vpn.example.com`)
-
-
-
-Double-check the configuration, then click **Create**.
-
-
-
-Copy the **ClientId** and **ClientSecret** as it will be used for the Firezone
-configuration.
-
-
-
-In the application **Configuration** click **Refresh Token** and then on
-**Save**. The refresh token is optional for some features of Firezone.
-
-
-
-In the application **Token Settings** select **User roles inside ID Token** and
-**User Info inside ID Token**. Save it with a click on **Save**.
-
-
-
-## Integrate With Firezone
-
-Navigate to the `/settings/security` page in the admin portal, click
-"Add OpenID Connect Provider" and enter the details you obtained in the steps
-above.
-
-Enable or disable the **Auto create users** option to automatically create
-an unprivileged user when signing in via this authentication mechanism.
-
-And that's it! The configuration should be updated immediately.
-You should now see a `Sign in with Zitadel` button on the sign in page.
-
-## Step 3 (optional): Restrict access to specific users
-
-Zitadel can limit which users have access to Firezone. To do this,
-go to the project where your created your application. In **General** you can
-find **Check Authorization on Authentication** which allows only users with at
-least one role to login to Firezone.
-
-
diff --git a/www/docs/authenticate/saml/README.mdx b/www/docs/authenticate/saml/README.mdx
deleted file mode 100644
index 9c6c09f27..000000000
--- a/www/docs/authenticate/saml/README.mdx
+++ /dev/null
@@ -1,81 +0,0 @@
----
-title: SAML 2.0
-sidebar_position: 11
-description: Enforce single sign-on with your identity provider. Integrate
- providers like Okta, Google, OneLogin, and JumpCloud using Firezone's
- SAML 2.0 connector.
----
-
-# Integrate your identity provider using SAML 2.0
-
-Firezone supports Single Sign-On (SSO) via SAML 2.0.
-
-## Supported identity providers
-
-In general, most identity providers that support SAML 2.0 should work with
-Firezone.
-
-| Provider | Support Status | Notes |
-| -------------------------- | ------------------------ | ---------------------------------- |
-| [Okta](okta) | **Tested and supported** | |
-| [Google Workspace](google) | **Tested and supported** | Uncheck `Require signed envelopes` |
-| [OneLogin](onelogin) | **Tested and supported** | |
-| [JumpCloud](jumpcloud) | **Tested and supported** | Uncheck `Require signed envelopes` |
-
-Occasionally, providers that don't implement the full SAML 2.0 standard or use
-uncommon configurations may be problematic. If this is the case, [contact us](/contact/support)
-about a custom integration.
-
-## Custom SAML cert and keyfile
-
-SAML 2.0 requires a set of private and public keys using the RSA or
-DSA algorithms along with an X.509 certificate that contains the public key.
-
-Firezone automatically generates these for on both Docker and Omnibus-based
-deployments. If you'd like to use your own cert and key, however, you can generate
-them with `openssl`:
-
-```
-openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout saml.key -out saml.crt
-```
-
-Then use them with your Firezone installation:
-
-
-
-
-Set the `SAML_KEYFILE_PATH` and `SAML_CERTFILE_PATH` environment variables to
-the path containing your `saml.key` and `saml.crt` above. If using our [example
-docker compose file](https://github.com/firezone/firezone/blob/master/docker-compose.prod.yml),
-which includes a volume for mapping configuration,
-save these files to `$HOME/.firezone/firezone` on the Docker host and set the
-`SAML_KEYFILE_PATH=/var/firezone/saml.key` and
-`SAML_CERTFILE_PATH=/var/firezone/saml.crt` environment variables for the Firezone
-container.
-
-
-
-
-## General setup instructions
-
-Once you've configured Firezone with an X.509 certificate and corresponding
-private key as shown above, you'll need a few more things to set up a generic
-SAML integration.
-
-### IdP metadata document
-
-You'll need to get the SAML Metadata XML document from your identity provider. In most
-cases this can be downloaded from your IdP's SAML App configuration dashboard.
-
-### ACS URL
-
-Firezone constructs the ACS URL based on the Base URL and Configuration ID entered
-in the Firezone SAML configuration, defaulting to: `EXTERNAL_URL/auth/saml/sp/consume/:config_id`,
-e.g. `https://firezone.company.com/auth/saml/sp/consume/okta`.
-
-### Entity ID
-
-The Firezone Entity ID can be configured with the `SAML_ENTITY_ID` environment variable
-and defaults to `urn:firezone.dev:firezone-app` if not set.
-
-See the [environment variable reference](/docs/reference/env-vars) for more information.
diff --git a/www/docs/authenticate/saml/google.mdx b/www/docs/authenticate/saml/google.mdx
deleted file mode 100644
index c40e9d352..000000000
--- a/www/docs/authenticate/saml/google.mdx
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Google Workspace
-sidebar_position: 2
-description:
- Enforce 2FA/MFA using Google Workspace for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Google Workspace
- for single sign-on using the SAML 2.0 connector.
----
-
-# Enable SSO with Google Workspace (SAML 2.0)
-
-Firezone supports Single Sign-On (SSO) using Google through the generic SAML 2.0
-connector. This guide will walk you through how to configure the integration.
-
-## Step 1: Create a SAML connector
-
-In the Google Workspace admin portal, create a new SAML app under
-the Application > Web and mobile apps tab. Use the following config values during setup:
-
-| Setting | Value |
-| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| App name | Firezone |
-| App icon | [save link as](https://user-images.githubusercontent.com/52545545/202567638-513dba14-ea8c-4da8-8f75-341310f1e456.png) |
-| ACS URL | This is your Firezone `EXTERNAL_URL/auth/saml/sp/consume/:config_id` (e.g., `https://firezone.company.com/auth/saml/sp/consume/google`). |
-| Entity ID | This should be the same as your Firezone `SAML_ENTITY_ID`, defaults to `urn:firezone.dev:firezone-app`. |
-| Signed response | Unchecked. |
-| Name ID format | Unspecified |
-| Name ID | Basic Information > Primary email |
-
-
-
-Once complete, save the changes and download the SAML metadata document. You'll need
-to copy-paste the contents of this document into the Firezone portal in the next step.
-
-## Step 2: Add SAML identity provider to Firezone
-
-In the Firezone portal, add a SAML identity provider under the Security tab
-by filling out the following information:
-
-| Setting | Value | Notes |
-| ------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Config ID | google | Firezone uses this value to construct endpoints required in the SAML authentication flow (e.g., receiving assertions, login requests). |
-| Label | Google | Appears on the sign in button for authentication. |
-| Metadata | see note | Paste the contents of the SAML metadata document you downloaded in the previous step from Google. |
-| Sign assertions | Checked. | |
-| Sign metadata | Checked. | |
-| Require signed assertions | Checked. | |
-| Require signed envelopes | **Unchecked.** | |
-| Auto create users | Default `false` | Enable this setting to automatically create users when signing in with this connector for the first time. Disable to manually create users. |
-
-
-
-After saving the SAML config, you should see a `Sign in with Google` button
-on your Firezone portal sign-in page.
diff --git a/www/docs/authenticate/saml/jumpcloud.mdx b/www/docs/authenticate/saml/jumpcloud.mdx
deleted file mode 100644
index db61c4d38..000000000
--- a/www/docs/authenticate/saml/jumpcloud.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: JumpCloud
-sidebar_position: 4
-description:
- Enforce 2FA/MFA using JumpCloud for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating JumpCloud
- for single sign-on using the SAML 2.0 connector.
----
-
-# Enable SSO with JumpCloud (SAML 2.0)
-
-:::note
-This guide assumes you have completed the prerequisite steps
-(e.g. generate self-signed X.509 certificates) outlined [here](/docs/authenticate/saml#prerequisites).
-:::
-
-Firezone supports Single Sign-On (SSO) using JumpCloud through the generic SAML 2.0 connector.
-This guide will walk you through how to configure the integration.
-
-## Step 1: Create a SAML connector
-
-In the JumpCloud admin portal, create a new App under
-the SSO tab. At the bottom of the popup window, click `Custom SAML App`.
-
-After entering your desired value for `Display Label`, click the `SSO` tab,
-then use the following configuration values:
-
-| Setting | Value |
-| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
-| IdP Entity ID | Any unique string will work, e.g. `firezone-jumpcloud`. |
-| SP Entity ID | This should be the same as your Firezone `SAML_ENTITY_ID`, defaults to `urn:firezone.dev:firezone-app`. |
-| ACS URL | This is your Firezone `EXTERNAL_URL/auth/saml/sp/consume/:config_id`, e.g. `https://firezone.company.com/auth/saml/sp/consume/jumpcloud`. |
-| SAMLSubject NameID | `email` |
-| SAMLSubject NameID Format | Leave at the default. |
-| Signature Algorithm | `RSA-SHA256` |
-| Sign Assertion | **Checked**. |
-| Login URL | This is your Firezone `EXTERNAL_URL/auth/saml/auth/signin/:config_id`, e.g. `https://firezone.company.com/auth/saml/auth/signin/jumpcloud` |
-
-Leave the rest of the settings unchanged, then click the `activate` button at the bottom-right.
-
-Your JumpCloud configuration should now resemble the following:
-
-
-
-Now, download the IdP Metadata document by selecting the App you just created
-and then clicking the `export metadata` button in the upper-right. You'll need
-to copy-paste the contents of this document into the Firezone portal in the next step.
-
-## Step 2: Add SAML identity provider to Firezone
-
-In the Firezone portal, add a SAML identity provider under the Security tab
-by filling out the following information:
-
-| Setting | Value | Notes |
-| ------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Config ID | `jumpcloud` | Firezone uses this value to construct endpoints required in the SAML authentication flow (e.g., receiving assertions, login requests). |
-| Label | `JumpCloud` | Appears on the sign in button for authentication. |
-| Base URL | Leave unchanged. | |
-| Metadata | see note | Copy-paste the contents of the SAML metadata document you downloaded in the previous step from JumpCloud. |
-| Sign assertions | Checked. | |
-| Sign metadata | Checked. | |
-| Require signed assertions | Checked. | |
-| Require signed envelopes | **Unchecked.** | |
-| Auto create users | Default `false` | Enable this setting to automatically create users when signing in with this connector for the first time. Disable to manually create users. |
-
-Your Firezone configuration should now resemble the following:
-
-
-
-After saving the SAML config, you should see a `Sign in with JumpCloud` button
-on your Firezone portal sign-in page.
diff --git a/www/docs/authenticate/saml/okta.mdx b/www/docs/authenticate/saml/okta.mdx
deleted file mode 100644
index f0b1ad8c8..000000000
--- a/www/docs/authenticate/saml/okta.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Okta
-sidebar_position: 1
-description: Enforce 2FA/MFA using Okta for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating Okta
- for single sign-on using the SAML 2.0 connector.
----
-
-# Enable SSO with Okta (SAML 2.0)
-
-:::note
-This guide assumes you have completed the prerequisite steps
-(e.g. generate self-signed X.509 certificates) outlined [here](/docs/authenticate/saml#prerequisites).
-:::
-
-Firezone supports Single Sign-On (SSO) using Okta through the generic SAML 2.0 connector. This guide will walk you through how to configure the integration.
-
-## Step 1: Create a SAML connector
-
-In the Okta admin portal, create a new app integration under
-the Application tab. Select `SAML 2.0` as the authentication method.
-Use the following config values during setup:
-
-| Setting | Value |
-| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- |
-| App name | Firezone |
-| App logo | [save link as](https://user-images.githubusercontent.com/52545545/155907625-a4f6c8c2-3952-488d-b244-3c37400846cf.png) |
-| Single sign on URL | This is your Firezone `EXTERNAL_URL/auth/saml/sp/consume/:config_id` (e.g., `https://firezone.company.com/auth/saml/sp/consume/okta`). |
-| Audience (EntityID) | This should be the same as your Firezone `SAML_ENTITY_ID`, defaults to `urn:firezone.dev:firezone-app`. |
-| Name ID format | EmailAddress |
-| Application username | Email |
-| Update application username on | Create and update |
-
-[Okta's documentation](https://help.okta.com/oie/en-us/Content/Topics/Apps/Apps_App_Integration_Wizard_SAML.htm)
-contains additional details on the purpose of each configuration setting.
-
-
-
-After creating the SAML connector, visit the `View SAML setup instructions` link in
-the Sign On tab to download the metadata document. You'll need
-to copy-paste the contents of this document into the Firezone portal in the next step.
-
-## Step 2: Add SAML identity provider to Firezone
-
-In the Firezone portal, add a SAML identity provider under the Security tab
-by filling out the following information:
-
-| Setting | Value | Notes |
-| ------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Config ID | Okta | Used to construct endpoints required in the SAML authentication flow (e.g., receiving assertions, login requests). |
-| Label | Okta | Appears on the sign in button for authentication. |
-| Metadata | see note | Paste the contents of the SAML metadata document you downloaded in the previous step from Okta. |
-| Sign assertions | Checked. | |
-| Sign metadata | Checked. | |
-| Require signed assertions | Checked. | |
-| Require signed envelopes | Checked. | |
-| Auto create users | Default `false` | Enable this setting to automatically create users when signing in with this connector for the first time. Disable to manually create users. |
-
-
-
-After saving the SAML config, you should see a `Sign in with Okta` button
-on your Firezone portal sign-in page.
diff --git a/www/docs/authenticate/saml/onelogin.mdx b/www/docs/authenticate/saml/onelogin.mdx
deleted file mode 100644
index 73ac6372b..000000000
--- a/www/docs/authenticate/saml/onelogin.mdx
+++ /dev/null
@@ -1,67 +0,0 @@
----
-title: OneLogin
-sidebar_position: 3
-description:
- Enforce 2FA/MFA using Onelogin for users of Firezone's WireGuard®-based
- secure access platform. This guide walks through integrating OneLogin
- for single sign-on using the SAML 2.0 connector.
----
-
-# Enable SSO with OneLogin (SAML 2.0)
-
-:::note
-This guide assumes you have completed the prerequisite steps
-(e.g. generate self-signed X.509 certificates) outlined [here](/docs/authenticate/saml#prerequisites).
-:::
-
-Firezone supports Single Sign-On (SSO) using OneLogin through the generic SAML 2.0 connector.
-This guide will walk you through how to configure the integration.
-
-## Step 1: Create a SAML connector
-
-In the OneLogin admin portal, add an app under the application tab.
-Select `SAML Custom Connector (Advanced)` and provide the appropriate
-configuration settings under the under the configuration tab.
-
-The following fields should be filled out on this page:
-
-| Setting | Value |
-| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Audience (EntityID) | This should be the same as your Firezone `SAML_ENTITY_ID`, defaults to `urn:firezone.dev:firezone-app`. |
-| Recipient | This is your Firezone `EXTERNAL_URL/auth/saml/sp/consume/:config_id` (e.g., `https://firezone.company.com/auth/saml/sp/consume/onelogin`). |
-| ACS URL Validator | This field is regex to ensure OneLogin posts the response to the correct URL. For the sample URL below, we can use `^https:\/\/firezone\.company\.com\/auth\/saml\/sp\/consume\/onelogin` |
-| ACS URL | This is your Firezone `EXTERNAL_URL/auth/saml/sp/consume/:config_id` (e.g., `https://firezone.company.com/auth/saml/sp/consume/onelogin`). |
-| Login URL | This is your Firezone `EXTERNAL_URL/auth/saml/auth/signin/:config_id` (e.g., `https://firezone.company.com/auth/saml/sp/consume/onelogin`). |
-| SAML initiator | Service Provider |
-| SAML signature element | Both |
-| Encrypt Assertion | Checked. |
-
-[OneLogin's docs](https://onelogin.service-now.com/support?id=kb_article&sys_id=912bb23edbde7810fe39dde7489619de&kb_category=93e869b0db185340d5505eea4b961934)
-provide a good overview of each field's purpose.
-
-
-
-Once complete, save the changes and download the SAML metadata document
-found unde the `More Actions` dropdown. You'll need
-to copy-paste the contents of this document into the Firezone portal in the next step.
-
-## Step 2: Add SAML identity provider to Firezone
-
-In the Firezone portal, add a SAML identity provider under the Security tab
-by filling out the following information:
-
-| Setting | Value | Notes |
-| ------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| Config ID | `onelogin` | Used to construct endpoints required in the SAML authentication flow (e.g., receiving assertions, login requests). |
-| Label | `OneLogin` | Appears on the sign in button for authentication. |
-| Metadata | see note | Paste the contents of the SAML metadata document you downloaded in the previous step from OneLogin. |
-| Sign assertions | Checked. | |
-| Sign metadata | Checked. | |
-| Require signed assertions | Checked. | |
-| Require signed envelopes | Checked. | |
-| Auto create users | Default `false` | Enable this setting to automatically create users when signing in with this connector for the first time. Disable to manually create users. |
-
-
-
-After saving the SAML config, you should see a `Sign in with OneLogin` button
-on your Firezone portal sign-in page.
diff --git a/www/docs/deploy/README.mdx b/www/docs/deploy/README.mdx
deleted file mode 100644
index 136409fe8..000000000
--- a/www/docs/deploy/README.mdx
+++ /dev/null
@@ -1,90 +0,0 @@
----
-title: Deploy
-sidebar_position: 2
-description:
- Install Firezone's WireGuard®-based secure access platform on a support
- host using our Docker (recommended) or Omnibus deployment methods.
----
-
-# Deploy Firezone
-
-Firezone can be deployed on most Docker-supported platforms in a couple of minutes.
-Read more below to get started.
-
-## Step 1: Prepare to deploy
-
-Regardless of which deployment method you choose, you'll need to follow the
-preparation steps below before deploying Firezone to production.
-
-1. [Create a DNS record](#create-a-dns-record)
-1. [Set up SSL](#set-up-ssl)
-1. [Open required firewall ports](#open-required-firewall-ports)
-
-### Create a DNS record
-
-Firezone requires a fully-qualified domain name (e.g. `firezone.company.com`)
-for production use. You'll need to create the appropriate DNS record at your
-registrar to achieve this. Typically this is either an A, CNAME, or AAAA record
-depending on your requirements.
-
-### Set up SSL
-
-You'll need a valid SSL certificate to use Firezone in a production capacity.
-Firezone supports ACME for automatic provisioning of SSL certificates for both
-Docker-based and Omnibus-based installations. This is recommended in most cases.
-
-
-
-
-#### Setting up ACME for Docker-based deployments
-
-For Docker-based deployments, the simplest way to provision an SSL
-certificate is to use our Caddy service example in docker-compose.yml.
-Caddy uses ACME to automatically provision SSL certificates as long as
-it's available on port 80/tcp and the DNS record for the server is valid.
-
-See the [Docker deployment guide](docker) for more info.
-
-
-
-
-### Open required firewall ports
-
-By default, Firezone requires ports `443/tcp` and `51820/udp` to be
-accessible for HTTPS and WireGuard traffic respectively.
-These ports can change based on what you've configured in the configuration file.
-See the
-[configuration file reference](../reference/configuration-file)
-for details.
-
-### Resource requirements
-
-We recommend **starting with 1 vCPU and 1 GB of RAM and scaling up** as the
-number of users and devices grows.
-
-For Omnibus-based deployments on servers with less than 1GB of memory, we
-recommend turning on swap to prevent the Linux kernel from killing
-Firezone processes unexpectedly. When this happens, it's often difficult to
-debug and results in strange, unpredictable failure modes.
-
-For the VPN tunnels themselves, Firezone uses in-kernel WireGuard, so its
-performance should be very good. 1 vCPU should be more than enough to saturate
-a 1 Gbps link.
-
-## Step 2: Deploy
-
-You have two options for deploying Firezone:
-
-1. [Docker](docker) (recommended)
-1. [Omnibus](omnibus)
-
-Docker is the easiest way to install, manage, and upgrade Firezone and is the
-preferred method of deployment.
-
-:::warning
-Chef Infra Client, the configuration system Chef Omnibus relies on, has been
-[scheduled for End-of-Life in 2024](https://docs.chef.io/versions/). As such,
-support for Omnibus-based deployments will be removed starting with Firezone 0.8.
-To transition to Docker from Omnibus today, follow our [migration guide
-](../administer/migrate).
-:::
diff --git a/www/docs/deploy/advanced/README.mdx b/www/docs/deploy/advanced/README.mdx
deleted file mode 100644
index fad3678d9..000000000
--- a/www/docs/deploy/advanced/README.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Advanced
-sidebar_position: 8
----
-
-```mdx-code-block
-import DocCardList from '@theme/DocCardList';
-import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
-
-
-```
diff --git a/www/docs/deploy/advanced/build-from-source.mdx b/www/docs/deploy/advanced/build-from-source.mdx
deleted file mode 100644
index be6b789d4..000000000
--- a/www/docs/deploy/advanced/build-from-source.mdx
+++ /dev/null
@@ -1,91 +0,0 @@
----
-title: Build From Source
-sidebar_position: 1
----
-
-Building from source allows you to bring Firezone to unsupported platforms.
-
-:::warning
-You're entering unsupported territory. This is not for the faint of heart and
-will require being able to figure out snags you may hit on your own.
-
-If you're very comfortable with your environment of choice, then read on to
-learn how to build Firezone from source.
-:::
-
-:::info
-You will need to setup your own service management for Firezone (eg. `runit`,
-`systemd`, shell scripts). You will also need to install and configure your
-own database (eg. `postgres`) and reverse proxy (eg. `caddy`, `nginx`).
-
-Info about database configuration is [here](../external-database/#configure-firezone-to-connect),
-and info about configuring a reverse proxy is [here](../reverse-proxy/#proxy-requirements).
-:::
-
-# Prerequisites
-
-:::info
-Check the `.tool-versions` file [here](https://github.com/firezone/firezone/blob/master/.tool-versions)
-for the versions we use for Erlang, Elixir, and Node. If your system supports it,
-you can install these using [asdf-vm](https://asdf-vm.com/guide/getting-started.html)
-using a similar `.tool-versions` of your own to match versions. Your system's package
-manager may have them as well.
-:::
-
-**These must be available in the user's path that runs Firezone.**
-
-- [Erlang/OTP](https://www.erlang.org)
-- [Elixir](https://elixir-lang.org)
-- [NodeJS](https://nodejs.org)
-
-# Steps
-
-From your terminal, run these steps to build Firezone:
-
-```bash
-git clone https://github.com/firezone/firezone
-cd firezone
-mix local.rebar --force
-mix local.hex --force
-MIX_ENV=prod mix deps.get
-MIX_ENV=prod mix release
-```
-
-After the release build finishes, you should have a shiny new Firezone release artifact in
-`/_build/dev/rel/firezone`. In the `bin` folder, the `firezone` binary
-can be used to start up Firezone. If you run it without any arguments you should see
-a list of available commands like this:
-
-```bash
-Usage: firezone COMMAND [ARGS]
-
-The known commands are:
-
- start Starts the system
- start_iex Starts the system with IEx attached
- daemon Starts the system as a daemon
- daemon_iex Starts the system as a daemon with IEx attached
- eval "EXPR" Executes the given expression on a new, non-booted system
- rpc "EXPR" Executes the given expression remotely on the running system
- remote Connects to the running system via a remote shell
- restart Restarts the running system via a remote command
- stop Stops the running system via a remote command
- pid Prints the operating system PID of the running system via a remote command
- version Prints the release name and version to be booted
-```
-
-Most deployment-related configuration is handled with environment variables.
-You'll probably want to at least set variables related to your reverse proxy
-and database. See the [ENV var reference](/docs/reference/env-vars/) for an exhaustive list.
-
-Now all you need are the database and reverse proxy that you've previously set up.
-Once that's done, you can use `firezone start` to start Firezone and run
-`create-or-reset-admin` (in the same `bin` dir) to create the admin user and use
-it to log into Firezone from a web browser to start setting up your brand new
-custom instance that you built by hand with a little bit of elbow grease :)
-
-:::info
-As mentioned at the top, it's recommended to use some sort of service management
-to start and stop Firezone easily without having to manually do it using the
-`firezone` binary directly. But the choice is yours, since you're in control!
-:::
diff --git a/www/docs/deploy/advanced/external-database.mdx b/www/docs/deploy/advanced/external-database.mdx
deleted file mode 100644
index 867fddcb4..000000000
--- a/www/docs/deploy/advanced/external-database.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-title: Custom External Database
-sidebar_position: 2
----
-
-Firezone uses [Postgresql DB](https://postgresql.org) as its primary data store.
-
-## Compatibility
-
-Firezone should work fine on Postgres versions 12 and above, but we recommend
-using the latest stable version whenever possible. If you find an issue with
-your particular version of Postgres, [please open a GitHub issue
-](https://github.com/firezone/firezone/issues).
-
-In general, Firezone should also work fine using external Postgres-based
-database services like Amazon RDS. See the [configuration
-](#configure-firezone-to-connect) section below for more information configuring
-Firezone with an external DB.
-
-:::warning
-Configuring Firezone to use an external database can be complicated and
-error-prone. We recommend using the bundled Postgres for Omnibus-based
-deployments or the official Postgres Docker image for Docker-based deployments
-if possible.
-:::
-
-## Configure Firezone to Connect
-
-
-
-
-The Firezone Docker image uses the following environment
-variables to connect to the DB (fields in bold required):
-
-| Name | Description | Format | Default |
-| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | ------------------------------------ |
-| **`DATABASE_ENCRYPTION_KEY`** | The base64-encoded symmetric encryption key used to encrypt and decrypt sensitive fields. | base64-encoded String | None -- must be generated on install |
-| `DATABASE_HOST` | Database host | IP or hostname | `postgres` |
-| `DATABASE_PORT` | Database port | Integer | `5432` |
-| `DATABASE_NAME` | Name of database | String | `firezone` |
-| `DATABASE_USER` | User | String | `postgres` |
-| `DATABASE_PASSWORD` | Password | String | `postgres` |
-| `DATABASE_POOL` | Size of the Firezone connection pool | Integer | `10` |
-| `DATABASE_SSL` | Whether to connect to the database over SSL | Boolean | `false` |
-| `DATABASE_SSL_OPTS` | Map of options to send to the `:ssl_opts` option when connecting over SSL. See [Ecto.Adapters.Postgres documentation](https://hexdocs.pm/ecto_sql/Ecto.Adapters.Postgres.html#module-connection-options) | JSON-encoded String | `{}` |
-| `DATABASE_PARAMETERS` | Map of parameters to send to the `:parameters` option when connecting to the database. See [Ecto.Adapters.Postgres documentation](https://hexdocs.pm/ecto_sql/Ecto.Adapters.Postgres.html#module-connection-options). | JSON-encoded String | `{}` |
-
-For more information, see the [environment variable reference
-](/docs/reference/env-vars/).
-
-:::note
-The official `postgres` docker image can be configured by setting
-environment variables for the container. See the Postgres image
-[documentation](https://hub.docker.com/_/postgres) for more details.
-:::
-
-
-
diff --git a/www/docs/deploy/advanced/reverse-proxy.mdx b/www/docs/deploy/advanced/reverse-proxy.mdx
deleted file mode 100644
index 761a10d68..000000000
--- a/www/docs/deploy/advanced/reverse-proxy.mdx
+++ /dev/null
@@ -1,105 +0,0 @@
----
-title: Custom Reverse Proxy
-sidebar_position: 3
----
-
-:::warning
-Using a custom reverse proxy is an advanced configuration. The default bundled
-Nginx proxy (Omnibus-based deployments) and Caddy (Docker-based deployments) is
-suitable for the vast majority of use cases and is recommended for most users.
-There are important security risks if the reverse proxy is not set up correctly.
-:::
-
-## Introduction
-
-Firezone comes with bundled [Nginx](https://www.nginx.com/) (Omnibus-based
-deployments) or uses Caddy (Docker-based deployments) by default. However, in
-some cases you might want to deploy your own server such as when using
-your own load balancer.
-
-## Prerequisites
-
-Below you will find the requirements in order to setup Firezone with a custom
-reverse proxy.
-
-### Firezone configuration requirements
-
-- Disable the bundled Nginx by setting `default['firezone']['nginx']['enabled']`
- to `false` in the config file.
-- If you have any immediate proxies between your primary reverse proxy and the
- Firezone web app, add their IPs to
- `default['firezone']['phoenix']['external_trusted_proxies']`. Because of the
- way the [X-Forwarded-For header works](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For),
- this is needed to parse the actual client's IP address to prevent
- IP spoofing.
-
-:::note
-The `external_trusted_proxies` list automatically implicitly includes the
-following private CIDR ranges, even if they're not specified in the
-configuration file:
-
-- `127.0.0.0/8`
-- `10.0.0.0/8`
-- `172.16.0.0/12`
-- `192.168.0.0/16`
-- `::1/128`
-- `fc00::/7`
-
-This means any web requests originating from these IPs are automatically ignored
-from the `X-Forwarded-For` headers. If you're accessing Firezone from any IPs in
-this range (as seen by the Firezone web app), be sure to add them to the
-`default['firezone']['phoenix']['clients']` configuration option instead.
-:::
-
-Read more about the configuration options
-[here](/docs/reference/configuration-file/).
-
-### Proxy requirements
-
-- All your proxies need to configure the `X-Forwarded-For` header as explained
- [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For)
-- Your proxy should also set the `X-Forwarded-Proto` to `https`.
-- Your proxy (or another downstream proxy) **must** terminate SSL since we
- enforce [secure cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies).
-- Firezone requires the use of WebSockets to establish realtime connections. We
- recommend following your proxy's specific documentation for supporting
- WebSockets as each proxy varies. In general, your proxy needs to be able to
- proxy HTTP 1.1 connections, and the Firezone web app expects the following
- headers to be set:
- - `Connection: upgrade`
- - `Upgrade: websocket`
-
-## Security considerations
-
-In addition to the headers above, we recommend adding the following headers for
-security purposes:
-
-- `X-XSS-Protection: 1; mode=block`
-- `X-Content-Type-Options nosniff`
-- `Referrer-Policy no-referrer-when-downgrade`
-- `Content-Security-Policy: default-src 'self' ws: wss: http: https: data: blob:
-'unsafe-inline'; frame-ancestors 'self';`
-- `Permissions-Policy: interest-cohort=()`
-
-Since the upstream Firezone web app expects plain HTTP traffic, any requests the
-proxy forwards is sent over HTTP and thus is **not encrypted**. In most cases,
-the reverse proxy is installed in a trusted network, and this is not an issue.
-But the connection between your trusted proxy and the Firezone web app spans
-an untrusted network (such as the Internet), you may want to leave the bundled
-`nginx` proxy enabled for SSL termination, and set up your custom
-reverse proxy to proxy to that instead.
-
-## Example configurations
-
-- [Apache](/docs/reference/reverse-proxy-templates/apache/)
-- [Traefik](/docs/reference/reverse-proxy-templates/traefik/)
-- [HAProxy](/docs/reference/reverse-proxy-templates/haproxy/)
-
-These configurations are written to be as simple as possible. They're designed
-to function as a simple template which you can customize further to suit your
-needs.
-
-If you have a working configuration for a different reverse proxy or a different
-version of an existing one we appreciate any
-[contribution](https://github.com/firezone/firezone/) to expand the examples for
-the community.
diff --git a/www/docs/deploy/configure.mdx b/www/docs/deploy/configure.mdx
deleted file mode 100644
index 1788ebd35..000000000
--- a/www/docs/deploy/configure.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-title: Configure
-sidebar_position: 5
----
-
-# Configure Firezone
-
-There are two types of configuration in Firezone:
-
-- [Runtime configuration](#runtime-configuration): Application configuration
- related to day-to-day operation of Firezone.
-- [Deployment configuration](#deployment-configuration): Deployment or
- infrastructure-related configuration relevant to running Firezone on-prem.
-
-## Runtime configuration
-
-Most day-to-day configuration of Firezone can be done via the Web UI or
-[REST API](/docs/reference/rest-api/configurations).
-This type of configuration can be expected to be changed **with no downtime**
-in a production deployment.
-
-We're actively working to move more configuration variables to
-this type of configuration, so expect more ENV vars to transition to runtime
-configuration in the future.
-
-## Deployment configuration
-
-Deployment-related and infrastructure configuration require restarting Firezone
-services after change.
-
-
-
-
-Docker-based deployments are configured through environment
-variables passed to the `firezone` container. These can be
-specified either in a `.env` file in the current directory,
-the `docker-compose.yml` file, or passed to the `docker run`
-call directly. See the [env var reference](../../reference/env-vars)
-for a complete listing.
-
-See [Docker's documentation
-](https://docs.docker.com/compose/envvars-precedence/) for more information.
-
-
-
diff --git a/www/docs/deploy/docker/README.mdx b/www/docs/deploy/docker/README.mdx
deleted file mode 100644
index 322c76f2f..000000000
--- a/www/docs/deploy/docker/README.mdx
+++ /dev/null
@@ -1,180 +0,0 @@
----
-title: Docker
-sidebar_position: 2
-description: Install Firezone via Docker to manage secure remote
- access to private networks and resources.
----
-
-# Install Firezone with Docker
-
-As of 0.6.0, Docker is now the **preferred method** for
-deploying Firezone. Docker offers a number of benefits over the old
-[Omnibus method](../omnibus):
-
-- **Simpler, more robust upgrades**: In most cases, simply pull the latest `firezone/firezone`
- image and restart the container.
-- **Simpler configuration**: Most day-to-day configuration of Firezone can now
- be done in the web UI instead of the `/etc/firezone/firezone.rb` configuration
- file. All other configuration variables can be specified as ENV vars to the
- Firezone container.
-- **Smaller footprint**: The Firezone image weighs in at a couple dozen
- megabytes versus hundreds of megabytes for the Omnibus package.
-- **Portability**: Firezone now runs on any platform that supports Docker.
-- **Security**: Containerization providers better security isolation than
- simply running as an unprivileged local user.
-
-## Step 1: Prerequisites
-
-- Ensure you're on a [supported platform](supported-platforms) with [
- docker-compose](https://docs.docker.com/compose/install/) **version 2
- or higher** installed.
-- Ensure port forwarding is enabled on your firewall.
- The default Firezone configuration requires the following ports to be open:
- - `80/tcp` (optional): For automatically issuing SSL certificates.
- - `443/tcp`: To access the web UI.
- - `51820/udp`: VPN traffic listen port.
-
-:::caution
-Before deploying Firezone in **production**, you'll need a valid DNS record
-pointing to this instance. See [Prepare to Deploy](../#prepare-to-deploy)
-if you haven't done this already.
-:::
-
-## Step 2: Install server
-
-After prerequisites are satisfied, you're ready to install the Firezone Server.
-
-### Option 1: Automatic install
-
-The easiest way to deploy Firezone with Docker is the automatic install script:
-
-
-
-This will ask you a few questions regarding initial configuration, then proceed
-to download a sample docker-compose.yml file, configure it with your responses,
-and then print instructions for accessing the Web UI.
-
-Firezone files will be installed in `$HOME/.firezone` by default.
-
-### Option 2: Manual install
-
-If the automatic install fails, or you'd just like more control over the
-installation process, follow the steps below to install manually.
-
-1. Download the docker compose template to a local working directory:
- **For Linux**:
-
-```
-curl -fsSL https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.prod.yml -o docker-compose.yml
-```
-
-**For macOS, Windows (non-production only)**:
-
-```
-curl -fsSL https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.desktop.yml -o docker-compose.yml
-```
-
-1. Generate required secrets:
-
-```
-docker run --rm firezone/firezone bin/gen-env > .env
-```
-
-1. At a minimum, change the `DEFAULT_ADMIN_EMAIL` and `EXTERNAL_URL` variables.
- Optionally modify other secrets as needed.
-1. Migrate the database:
-
-```
-docker compose run --rm firezone bin/migrate
-```
-
-1. Create the first admin:
-
-```
-docker compose run --rm firezone bin/create-or-reset-admin
-```
-
-1. Bring the services up: `docker compose up -d`
-
-You should now be able to access the Firezone web portal at the `EXTERNAL_URL`
-variable you defined above.
-
-## Step 3 (optional): Enable on boot
-
-If you'd like Firezone to start automatically on boot, first ensure Docker is enabled at startup:
-
-```
-sudo systemctl enable docker
-```
-
-Then, make sure your Firezone services have the `restart: always` or `restart: unless-stopped` option
-specified in the `docker-compose.yml` file. This is the default used in the docker-compose.prod.yml
-production template file.
-
-## Step 4 (optional): Enable IPv6
-
-By default, Firezone ships with IPv6 connectivity enabled inside the tunnel but not routable
-to the public internet. To enable IPv6 support in Docker-deployed Firezone, follow the steps below.
-
-1. Enable IPv6 support within Docker by adding the following to `/etc/docker/daemon.json`:
-
-```json
-{
- "ipv6": true,
- "ip6tables": true,
- "experimental": true,
- "fixed-cidr-v6": "2001:db8:1::/64"
-}
-```
-
-This enables IPv6 NAT and configures IPv6 forwarding for Docker containers.
-
-1. Enable router advertisements on boot for your default egress interface:
-
-```
-egress=`ip route show default 0.0.0.0/0 | grep -oP '(?<=dev ).*' | cut -f1 -d' ' | tr -d '\n'`
-sudo bash -c "echo net.ipv6.conf.${egress}.accept_ra=2 >> /etc/sysctl.conf"
-```
-
-1. Reboot
-
-You should now be able to ping google from within a docker container:
-
-```
-docker run --rm -t busybox ping6 -c 4 google.com
-```
-
-You shouldn't need to manually add any `iptables` rules to enable IPv6 SNAT/masquerading for
-tunneled traffic; Firezone handles this for you by default on start.
-
-## Step 5: Install client apps
-
-:::note
-Firezone currently uses WireGuard's
-[open-source client apps](https://www.wireguard.com/install/).
-:::
-
-Once successfully deployed, users and devices can be added to
-connect to the VPN server:
-
-- [Add Users](../../user-guides/add-users):
- Add users to grant them access to your network.
-- [Client Instructions](../../user-guides/client-instructions):
- Instructions to establish a VPN session.
-
-import SupportOptions from "@site/src/partials/_support_options.mdx";
-;
-
-## Post Setup
-
-Congrats! You have completed the setup, but there's a lot more you can do with
-Firezone:
-
-- [Integrate your identity provider](../../authenticate/)
- for authenticating clients
-- Using Firezone as a NAT gateway to
- [establish a static IP for your team](../../user-guides/use-cases/nat-gateway)
-- Create tunnels between multiple peers with
- [reverse tunnels](../../user-guides/use-cases/reverse-tunnel)
-- Only route certain traffic through Firezone with
- [split tunneling](../../user-guides/use-cases/split-tunnel)
diff --git a/www/docs/deploy/docker/supported-platforms.mdx b/www/docs/deploy/docker/supported-platforms.mdx
deleted file mode 100644
index 5bcd05049..000000000
--- a/www/docs/deploy/docker/supported-platforms.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
----
-title: Supported Platforms
-sidebar_position: 1
----
-
-Firezone currently supports the following platforms for Docker-based
-deployments.
-
-| OS | Architecture(s) | Runtime | Status | Notes |
-| --- | --- | --- | --- | --- |
-| Linux | `amd64` `arm64` | Docker Server | **Fully-supported** | `wireguard` kernel module needed for kernels < `5.6`. |
-| Linux | `amd64` `arm64` | Docker Desktop | Works, but unsupported. | Not recommended for production deployments. See [caveats](#docker-desktop-caveats). |
-| macOS | `amd64` `arm64` | Docker Desktop | Works. but unsupported. | Not recommended for production deployments. See [caveats](#non-linux-platform-caveats). |
-| Windows | `amd64` `arm64` | Docker Desktop | **Untested** | Not recommended for production deployments. See [caveats](#non-linux-platform-caveats). |
-
-## Docker Desktop caveats
-
-Docker Desktop [rewrites the source address
-](https://www.docker.com/blog/how-docker-desktop-networking-works-under-the-hood/)
-for packets flowing out of container networks under some conditions. This can
-cause routing loops and other hard to debug connectivity issues with Firezone.
-We recommend **only** using Docker Server for Linux for production deployments.
-
-## Non-Linux platform caveats
-
-Only Docker for Linux supports the host networking mode, so macOS and Windows
-platforms will be able unable to properly attribute client source address
-for HTTP requests. This means any IP-based throttling or logging in your
-chosen proxy (`caddy` by default) will be ineffective, since the source
-IP will always be the Docker-side host IP (typically `172.X.0.1`).
-
-Egress rules operate on the tunneled client IP address and aren't affected
-by this limitation.
diff --git a/www/docs/deploy/security-considerations.mdx b/www/docs/deploy/security-considerations.mdx
deleted file mode 100644
index 60d974a32..000000000
--- a/www/docs/deploy/security-considerations.mdx
+++ /dev/null
@@ -1,57 +0,0 @@
----
-title: Security Considerations
-sidebar_position: 6
----
-
-# Security considerations
-
-**Disclaimer**: Firezone is still beta software. The codebase has not yet
-received a formal security audit. For highly sensitive and mission-critical
-production deployments, we recommend disabling local authentication as
-detailed [below](#production-deployments).
-
-## List of services and ports
-
-Shown below is a table of default ports used by Firezone services.
-
-
-
-
-| Service | Port | Listen address | Description |
-| ---------- | ----------- | -------------- | ----------------------------------------------------------------------------- |
-| Caddy | `443/tcp` | `all` | Public HTTPS port for administering Firezone and facilitating authentication. |
-| Caddy | `80/tcp` | `all` | Public HTTP port used for ACME. Disabled when ACME is disabled. |
-| WireGuard | `51820/udp` | `all` | Public WireGuard port used for VPN sessions. |
-| Postgresql | `5432/tcp` | `-` | Containerized port used for bundled Postgresql server. |
-| Phoenix | `13000/tcp` | `-` | Containerized port used by upstream elixir app server. |
-
-
-
-
-| Service | Port | Listen address | Description |
-| ---------- | ----------- | -------------- | ----------------------------------------------------------------------------- |
-| Nginx | `443/tcp` | `all` | Public HTTPS port for administering Firezone and facilitating authentication. |
-| Nginx | `80/tcp` | `all` | Public HTTP port used for ACME. Disabled when ACME is disabled. |
-| WireGuard | `51820/udp` | `all` | Public WireGuard port used for VPN sessions. |
-| Postgresql | `15432/tcp` | `127.0.0.1` | Local-only port used for bundled Postgresql server. |
-| Phoenix | `13000/tcp` | `127.0.0.1` | Local-only port used by upstream elixir app server. |
-
-
-
-
-## Production deployments
-
-For production deployments of Firezone, we recommend you disable local authentication
-altogether by setting `default['firezone']['authentication']['local']['enabled'] = false`
-(Omnibus-based deployments) or `LOCAL_AUTH_ENABLED=false` (Docker-based deployments).
-Local authentication can also be disabled on the `/settings/security` page.
-
-:::caution
-Ensure you've set up a working [OIDC](/docs/authenticate/oidc/) or [SAML](/docs/authenticate/saml/)-based
-authentication provider before disabling the local authentication method.
-:::
-
-## Reporting security issues
-
-To report any security-related bugs, see [our security bug reporting policy
-](https://github.com/firezone/firezone/blob/master/SECURITY.md).
diff --git a/www/docs/reference/README.mdx b/www/docs/reference/README.mdx
deleted file mode 100644
index 170fb3136..000000000
--- a/www/docs/reference/README.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-title: Reference
-sidebar_position: 6
----
-
-```mdx-code-block
-import DocCardList from '@theme/DocCardList';
-import {useCurrentSidebarCategory} from '@docusaurus/theme-common';
-
-
-```
diff --git a/www/docs/reference/_audit-logs.mdx b/www/docs/reference/_audit-logs.mdx
deleted file mode 100644
index 0c5785ab2..000000000
--- a/www/docs/reference/_audit-logs.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-title: Audit Logs
-sidebar_position: 2
----
-
-# Audit logs
-
-Firezone maintains two types of logs tied to user identity: configuration logs
-and network activity logs.
-
-Configuration logs track events related to the configuration of Firezone
-itself, either by admins or users. Network activity logs track connections to
-protected resources made by users of your network.
-
-Logged events are recorded as JSON objects and stored in the database. These
-are accessible via a REST API or the Firezone portal, and exportable to CSV
-format.
diff --git a/www/docs/reference/configuration-file.mdx b/www/docs/reference/configuration-file.mdx
deleted file mode 100644
index 9f8c9ec8f..000000000
--- a/www/docs/reference/configuration-file.mdx
+++ /dev/null
@@ -1,186 +0,0 @@
----
-title: Configuration File
-sidebar_position: 2
----
-
-# Omnibus configuration options
-
-:::warning
-This reference is written for Omnibus-based deployments of Firezone. For
-Docker-based deployments visit the [Environment Variables](../env-vars) page.
-:::
-
-To configure Omnibus-based deployments of Firezone:
-
-1. Edit `/etc/firezone/firezone.rb` with your changes.
-1. Run `sudo firezone-ctl reconfigure` to process the changes and restart affected services.
-
-Read more about configuring Firezone in the [configure guide](/docs/deploy/configure).
-
-## Configuration file reference
-
-Shown below is a complete listing of the configuration options available in
-`/etc/firezone/firezone.rb`.
-
-
-
-
-| Option | Description | Default Value |
-| -------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `default['firezone']['external_url']` | URL used to access the web portal of this Firezone instance. | "https://#{node['fqdn'] || node['hostname']}" |
-| `default['firezone']['config_directory']` | Top-level directory for Firezone configuration. | `'/etc/firezone'` |
-| `default['firezone']['install_directory']` | Top-level directory to install Firezone to. | `'/opt/firezone'` |
-| `default['firezone']['app_directory']` | Top-level directory to install the Firezone web application. | `"#{node['firezone']['install_directory']}/embedded/service/firezone"` |
-| `default['firezone']['log_directory']` | Top-level directory for Firezone logs. | `'/var/log/firezone'` |
-| `default['firezone']['var_directory']` | Top-level directory for Firezone runtime files. | `'/var/opt/firezone'` |
-| `default['firezone']['user']` | Name of unprivileged Linux user most services and files will belong to. | `'firezone'` |
-| `default['firezone']['group']` | Name of Linux group most services and files will belong to. | `'firezone'` |
-| `default['firezone']['admin_email']` | Email address for initial Firezone user. | `"firezone@localhost"` |
-| `default['firezone']['max_devices_per_user']` | Maximum number of devices a user can have. | `10` |
-| `default['firezone']['allow_unprivileged_device_management']` | Allows non-admin users to create and delete devices. | `true` |
-| `default['firezone']['allow_unprivileged_device_configuration']` | Allows non-admin users to modify device configurations. When disabled, prevents unprivileged users from changing all device fields except for `name` and `description`. | `true` |
-| `default['firezone']['egress_interface']` | Interface name where tunneled traffic will exit. If nil, the default route interface will be used. | `nil` |
-| `default['firezone']['fips_enabled']` | Enable or disable OpenSSL FIPs mode. | `nil` |
-| `default['firezone']['logging']['enabled']` | Enable or disable logging across Firezone. Set to `false` to disable logging entirely. | `true` |
-| `default['enterprise']['name']` | Name used by the Chef 'enterprise' cookbook. | `'firezone'` |
-| `default['firezone']['install_path']` | Install path used by Chef 'enterprise' cookbook. Should be set to the same as the `install_directory` above. | `node['firezone']['install_directory']` |
-| `default['firezone']['sysvinit_id']` | An identifier used in `/etc/inittab`. Must be a unique sequence of 1-4 characters. | `'SUP'` |
-| `default['firezone']['authentication']['local']['enabled']` | Enable or disable local email/password authentication. | `true` |
-| `default['firezone']['authentication']['disable_vpn_on_oidc_error']` | Disable a user's VPN if an error is detected trying to refresh their OIDC token. | `false` |
-| `default['firezone']['authentication']['oidc']` | OpenID Connect config, in the format of `{"provider" => [config...]}` - See [OpenIDConnect documentation](https://hexdocs.pm/openid_connect/readme.html) for config examples. | `{}` |
-| `default['firezone']['nginx']['enabled']` | Enable or disable the bundled nginx server. | `true` |
-| `default['firezone']['nginx']['ssl_port']` | HTTPS listen port. | `443` |
-| `default['firezone']['nginx']['directory']` | Directory to store Firezone-related nginx virtual host configuration. | `"#{node['firezone']['var_directory']}/nginx/etc"` |
-| `default['firezone']['nginx']['log_directory']` | Directory to store Firezone-related nginx log files. | `"#{node['firezone']['log_directory']}/nginx"` |
-| `default['firezone']['nginx']['log_rotation']['file_maxbytes']` | File size at which to rotate Nginx log files. | `104857600` |
-| `default['firezone']['nginx']['log_rotation']['num_to_keep']` | Number of Firezone nginx log files to keep before discarding. | `10` |
-| `default['firezone']['nginx']['log_x_forwarded_for']` | Whether to log Firezone nginx `x-forwarded-for` header. | `true` |
-| `default['firezone']['nginx']['hsts_header']['enabled']` | Enable or disable [HSTS](https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/). | `true` |
-| `default['firezone']['nginx']['hsts_header']['include_subdomains']` | Enable or disable `includeSubDomains` for the HSTS header. | `true` |
-| `default['firezone']['nginx']['hsts_header']['max_age']` | Max age for the HSTS header. | `31536000` |
-| `default['firezone']['nginx']['redirect_to_canonical']` | Whether to redirect URLs to the canonical FQDN specified above | `false` |
-| `default['firezone']['nginx']['cache']['enabled']` | Enable or disable the Firezone nginx cache. | `false` |
-| `default['firezone']['nginx']['cache']['directory']` | Directory for Firezone nginx cache. | `"#{node['firezone']['var_directory']}/nginx/cache"` |
-| `default['firezone']['nginx']['user']` | Firezone nginx user. | `node['firezone']['user']` |
-| `default['firezone']['nginx']['group']` | Firezone nginx group. | `node['firezone']['group']` |
-| `default['firezone']['nginx']['dir']` | Top-level nginx configuration directory. | `node['firezone']['nginx']['directory']` |
-| `default['firezone']['nginx']['log_dir']` | Top-level nginx log directory. | `node['firezone']['nginx']['log_directory']` |
-| `default['firezone']['nginx']['pid']` | Location for nginx pid file. | `"#{node['firezone']['nginx']['directory']}/nginx.pid"` |
-| `default['firezone']['nginx']['daemon_disable']` | Disable nginx daemon mode so we can monitor it instead. | `true` |
-| `default['firezone']['nginx']['gzip']` | Turn nginx gzip compression on or off. | `'on'` |
-| `default['firezone']['nginx']['gzip_static']` | Turn nginx gzip compression on or off for static files. | `'off'` |
-| `default['firezone']['nginx']['gzip_http_version']` | HTTP version to use for serving static files. | `'1.0'` |
-| `default['firezone']['nginx']['gzip_comp_level']` | nginx gzip compression level. | `'2'` |
-| `default['firezone']['nginx']['gzip_proxied']` | Enables or disables gzipping of responses for proxied requests depending on the request and response. | `'any'` |
-| `default['firezone']['nginx']['gzip_vary']` | Enables or disables inserting the “Vary: Accept-Encoding” response header. | `'off'` |
-| `default['firezone']['nginx']['gzip_buffers']` | Sets the number and size of buffers used to compress a response. If `nil`, nginx default is used. | `nil` |
-| `default['firezone']['nginx']['gzip_types']` | MIME types to enable gzip compression for. | `['text/plain', 'text/css','application/x-javascript', 'text/xml', 'application/xml', 'application/rss+xml', 'application/atom+xml', 'text/javascript', 'application/javascript', 'application/json']` |
-| `default['firezone']['nginx']['gzip_min_length']` | Minimum file length to enable file gzip compression for. | `1000` |
-| `default['firezone']['nginx']['gzip_disable']` | User-agent matcher to disable gzip compression for. | `'MSIE [1-6]\.'` |
-| `default['firezone']['nginx']['keepalive']` | Activates cache for connection to upstream servers. | `'on'` |
-| `default['firezone']['nginx']['keepalive_timeout']` | Timeout in seconds for keepalive connection to upstream servers. | `65` |
-| `default['firezone']['nginx']['worker_processes']` | Number of nginx worker processes. | `node['cpu'] && node['cpu']['total'] ? node['cpu']['total'] : 1` |
-| `default['firezone']['nginx']['worker_connections']` | Max number of simultaneous connections that can be opened by a worker process. | `1024` |
-| `default['firezone']['nginx']['worker_rlimit_nofile']` | Changes the limit on the maximum number of open files for worker processes. Uses nginx default if nil. | `nil` |
-| `default['firezone']['nginx']['multi_accept']` | Whether workers should accept one connection at a time or multiple. | `true` |
-| `default['firezone']['nginx']['event']` | Specifies the connection processing method to use inside nginx events context. | `'epoll'` |
-| `default['firezone']['nginx']['server_tokens']` | Enables or disables emitting nginx version on error pages and in the “Server” response header field. | `nil` |
-| `default['firezone']['nginx']['server_names_hash_bucket_size']` | Sets the bucket size for the server names hash tables. | `64` |
-| `default['firezone']['nginx']['sendfile']` | Enables or disables the use of nginx's `sendfile()`. | `'on'` |
-| `default['firezone']['nginx']['access_log_options']` | Sets nginx access log options. | `nil` |
-| `default['firezone']['nginx']['error_log_options']` | Sets nginx error log options. | `nil` |
-| `default['firezone']['nginx']['disable_access_log']` | Disables nginx access log. | `false` |
-| `default['firezone']['nginx']['types_hash_max_size']` | nginx types hash max size. | `2048` |
-| `default['firezone']['nginx']['types_hash_bucket_size']` | nginx types hash bucket size. | `64` |
-| `default['firezone']['nginx']['proxy_read_timeout']` | nginx proxy read timeout. Set to `nil` to use nginx default. | `nil` |
-| `default['firezone']['nginx']['client_body_buffer_size']` | nginx client body buffer size. Set to `nil` to use nginx default. | `nil` |
-| `default['firezone']['nginx']['client_max_body_size']` | nginx client max body size. | `'250m'` |
-| `default['firezone']['nginx']['default']['modules']` | Specify additional nginx modules. | `[]` |
-| `default['firezone']['nginx']['enable_rate_limiting']` | Enable or disable nginx rate limiting. | `true` |
-| `default['firezone']['nginx']['rate_limiting_zone_name']` | Nginx rate limiting zone name. | `'firezone'` |
-| `default['firezone']['nginx']['rate_limiting_backoff']` | Nginx rate limiting backoff. | `'10m'` |
-| `default['firezone']['nginx']['rate_limit']` | Nginx rate limit. | `'10r/s'` |
-| `default['firezone']['nginx']['ipv6']` | Allow nginx to listen for HTTP requests for IPv6 in addition to IPv4. | `true` |
-| `default['firezone']['postgresql']['enabled']` | Enable or disable bundled Postgresql. Set to `false` and fill in the `database` options below to use your own Postgresql instance. | `true` |
-| `default['firezone']['postgresql']['username']` | Username for Postgresql. | `node['firezone']['user']` |
-| `default['firezone']['postgresql']['data_directory']` | Postgresql data directory. | `"#{node['firezone']['var_directory']}/postgresql/13.3/data"` |
-| `default['firezone']['postgresql']['log_directory']` | Postgresql log directory. | `"#{node['firezone']['log_directory']}/postgresql"` |
-| `default['firezone']['postgresql']['log_rotation']['file_maxbytes']` | Postgresql log file maximum size before it's rotated. | `104857600` |
-| `default['firezone']['postgresql']['log_rotation']['num_to_keep']` | Number of Postgresql log files to keep. | `10` |
-| `default['firezone']['postgresql']['checkpoint_completion_target']` | Postgresql checkpoint completion target. | `0.5` |
-| `default['firezone']['postgresql']['checkpoint_segments']` | Number of Postgresql checkpoint segments. | `3` |
-| `default['firezone']['postgresql']['checkpoint_timeout']` | Postgresql checkpoint timeout. | `'5min'` |
-| `default['firezone']['postgresql']['checkpoint_warning']` | Postgresql checkpoint warning time in seconds. | `'30s'` |
-| `default['firezone']['postgresql']['effective_cache_size']` | Postgresql effective cache size. | `'128MB'` |
-| `default['firezone']['postgresql']['listen_address']` | Postgresql listen address. | `'127.0.0.1'` |
-| `default['firezone']['postgresql']['max_connections']` | Postgresql max connections. | `350` |
-| `default['firezone']['postgresql']['md5_auth_cidr_addresses']` | Postgresql CIDRs to allow for md5 auth. | `['127.0.0.1/32', '::1/128']` |
-| `default['firezone']['postgresql']['port']` | Postgresql listen port. | `15432` |
-| `default['firezone']['postgresql']['shared_buffers']` | Postgresql shared buffers size. | `"#{(node['memory']['total'].to_i / 4) / 1024}MB"` |
-| `default['firezone']['postgresql']['shmmax']` | Postgresql shmmax in bytes. | `17179869184` |
-| `default['firezone']['postgresql']['shmall']` | Postgresql shmall in bytes. | `4194304` |
-| `default['firezone']['postgresql']['work_mem']` | Postgresql working memory size. | `'8MB'` |
-| `default['firezone']['database']['user']` | Specifies the username Firezone will use to connect to the DB. | `node['firezone']['postgresql']['username']` |
-| `default['firezone']['database']['password']` | If using an external DB, specifies the password Firezone will use to connect to the DB. | `'change_me'` |
-| `default['firezone']['database']['name']` | Database that Firezone will use. Will be created if it doesn't exist. | `'firezone'` |
-| `default['firezone']['database']['host']` | Database host that Firezone will connect to. | `node['firezone']['postgresql']['listen_address']` |
-| `default['firezone']['database']['port']` | Database port that Firezone will connect to. | `node['firezone']['postgresql']['port']` |
-| `default['firezone']['database']['pool']` | Database pool size Firezone will use. | `[10, Etc.nprocessors].max` |
-| `default['firezone']['database']['ssl']` | Whether to connect to the database over SSL. | `false` |
-| `default['firezone']['database']['ssl_opts']` | Hash of options to send to the `:ssl_opts` option when connecting over SSL. See [Ecto.Adapters.Postgres documentation](https://hexdocs.pm/ecto_sql/Ecto.Adapters.Postgres.html#module-connection-options). | `{}` |
-| `default['firezone']['database']['parameters']` | Hash of parameters to send to the `:parameters` option when connecting to the database. See [Ecto.Adapters.Postgres documentation](https://hexdocs.pm/ecto_sql/Ecto.Adapters.Postgres.html#module-connection-options). | `{}` |
-| `default['firezone']['database']['extensions']` | Database extensions to enable. | `{ 'plpgsql' => true, 'pg_trgm' => true }` |
-| `default['firezone']['phoenix']['enabled']` | Enable or disable the Firezone web application. | `true` |
-| `default['firezone']['phoenix']['listen_address']` | Firezone web application listen address. This will be the upstream listen address that nginx proxies. | `'127.0.0.1'` |
-| `default['firezone']['phoenix']['port']` | Firezone web application listen port. This will be the upstream port that nginx proxies. | `13000` |
-| `default['firezone']['phoenix']['log_directory']` | Firezone web application log directory. | `"#{node['firezone']['log_directory']}/phoenix"` |
-| `default['firezone']['phoenix']['log_rotation']['file_maxbytes']` | Firezone web application log file size. | `104857600` |
-| `default['firezone']['phoenix']['log_rotation']['num_to_keep']` | Number of Firezone web application log files to keep. | `10` |
-| `default['firezone']['phoenix']['crash_detection']['enabled']` | Enable or disable bringing down the Firezone web application when a crash is detected. | `true` |
-| `default['firezone']['phoenix']['external_trusted_proxies']` | List of trusted reverse proxies formatted as an Array of IPs and/or CIDRs. | `[]` |
-| `default['firezone']['phoenix']['private_clients']` | List of private network HTTP clients, formatted an Array of IPs and/or CIDRs. | `[]` |
-| `default['firezone']['wireguard']['enabled']` | Enable or disable bundled WireGuard management. | `true` |
-| `default['firezone']['wireguard']['log_directory']` | Log directory for bundled WireGuard management. | `"#{node['firezone']['log_directory']}/wireguard"` |
-| `default['firezone']['wireguard']['log_rotation']['file_maxbytes']` | WireGuard log file max size. | `104857600` |
-| `default['firezone']['wireguard']['log_rotation']['num_to_keep']` | Number of WireGuard log files to keep. | `10` |
-| `default['firezone']['wireguard']['interface_name']` | WireGuard interface name. **Changing this parameter may cause a temporary loss in VPN connectivity**. | `'wg-firezone'` |
-| `default['firezone']['wireguard']['port']` | WireGuard listen port. | `51820` |
-| `default['firezone']['wireguard']['persistent_keepalive']` | Default PersistentKeepalive setting for generated device configurations. A value of 0 disables. | `0` |
-| `default['firezone']['wireguard']['ipv4']['enabled']` | Enable or disable IPv4 for WireGuard network. | `true` |
-| `default['firezone']['wireguard']['ipv4']['masquerade']` | Enable or disable masquerade for packets leaving the IPv4 tunnel. | `true` |
-| `default['firezone']['wireguard']['ipv4']['network']` | WireGuard network IPv4 address pool. | `'10.3.2.0/24'` |
-| `default['firezone']['wireguard']['ipv4']['address']` | WireGuard interface IPv4 address. Must be within WireGuard address pool. | `'10.3.2.1'` |
-| `default['firezone']['wireguard']['ipv6']['enabled']` | Enable or disable IPv6 for WireGuard network. | `true` |
-| `default['firezone']['wireguard']['ipv6']['masquerade']` | Enable or disable masquerade for packets leaving the IPv6 tunnel. | `true` |
-| `default['firezone']['wireguard']['ipv6']['network']` | WireGuard network IPv6 address pool. | `'fd00::3:2:0/120'` |
-| `default['firezone']['wireguard']['ipv6']['address']` | WireGuard interface IPv6 address. Must be within IPv6 address pool. | `'fd00::3:2:1'` |
-| `default['firezone']['runit']['svlogd_bin']` | Runit svlogd bin location. | `"#{node['firezone']['install_directory']}/embedded/bin/svlogd"` |
-| `default['firezone']['ssl']['directory']` | SSL directory for storing generated certs. | `'/var/opt/firezone/ssl'` |
-| `default['firezone']['ssl']['email_address']` | Email address to use for self-signed certs and ACME protocol renewal notices. | `'you@example.com'` |
-| `default['firezone']['ssl']['acme']['enabled']` | Enable ACME for automatic SSL cert provisioning. | `false` |
-| `default['firezone']['ssl']['acme']['server']` | ACME server to use for certificate issuance/renewal. Can be any [valid acme.sh server](https://github.com/acmesh-official/acme.sh/wiki/Server) | `letsencrypt` |
-| `default['firezone']['ssl']['acme']['keylength']` | Specify the key type and length for SSL certificates. See [here](https://github.com/acmesh-official/acme.sh#10-issue-ecc-certificates) | `ec-256` |
-| `default['firezone']['ssl']['certificate']` | Path to the certificate file for your FQDN. Overrides ACME setting above if specified. If both ACME and this are `nil` a self-signed cert will be generated. | `nil` |
-| `default['firezone']['ssl']['certificate_key']` | Path to the certificate file. | `nil` |
-| `default['firezone']['ssl']['ssl_dhparam']` | nginx ssl dh_param. | `nil` |
-| `default['firezone']['ssl']['country_name']` | Country name for self-signed cert. | `'US'` |
-| `default['firezone']['ssl']['state_name']` | State name for self-signed cert. | `'CA'` |
-| `default['firezone']['ssl']['locality_name']` | Locality name for self-signed cert. | `'San Francisco'` |
-| `default['firezone']['ssl']['company_name']` | Company name self-signed cert. | `'My Company'` |
-| `default['firezone']['ssl']['organizational_unit_name']` | Organizational unit name for self-signed cert. | `'Operations'` |
-| `default['firezone']['ssl']['ciphers']` | SSL ciphers for nginx to use. | `'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'` |
-| `default['firezone']['ssl']['fips_ciphers']` | SSL ciphers for FIPs mode. | `'FIPS@STRENGTH:!aNULL:!eNULL'` |
-| `default['firezone']['ssl']['protocols']` | TLS protocols to use. | `'TLSv1 TLSv1.1 TLSv1.2'` |
-| `default['firezone']['ssl']['session_cache']` | SSL session cache. | `'shared:SSL:4m'` |
-| `default['firezone']['ssl']['session_timeout']` | SSL session timeout. | `'5m'` |
-| `default['firezone']['robots_allow']` | nginx robots allow. | `'/'` |
-| `default['firezone']['robots_disallow']` | nginx robots disallow. | `nil` |
-| `default['firezone']['outbound_email']['from']` | Outbound email from address. | `nil` |
-| `default['firezone']['outbound_email']['provider']` | Outbound email service provider. | `nil` |
-| `default['firezone']['outbound_email']['configs']` | Outbound email provider configs. | see `omnibus/cookbooks/firezone/attributes/default.rb` |
-| `default['firezone']['telemetry']['enabled']` | Enable or disable anonymized product telemetry. | `true` |
-| `default['firezone']['connectivity_checks']['enabled']` | Enable or disable the Firezone connectivity checks service. | `true` |
-| `default['firezone']['connectivity_checks']['interval']` | Interval between connectivity checks in seconds. | `3_600` |
-
-
-
diff --git a/www/docs/reference/env-vars.mdx b/www/docs/reference/env-vars.mdx
deleted file mode 100644
index 981e0debb..000000000
--- a/www/docs/reference/env-vars.mdx
+++ /dev/null
@@ -1,147 +0,0 @@
----
-title: Environment Variables
-sidebar_position: 1
----
-
-Most day-to-day config of Firezone can be done via the Firezone Web UI,
-but for zero-touch deployments we allow to override most of configuration options
-using environment variables.
-
-Read more about configuring Firezone in our [configure guide](/docs/deploy/configure).
-
-## Errors
-
-Firezone will not boot if the configuration is invalid, providing a detailed error message
-and a link to the documentation for the configuration key with samples how to set it.
-
-## Naming
-
-If environment variables are used, the configuration key must be in uppercase.
-The database variables are the same as the configuration keys.
-
-## Precedence
-
-The configuration precedence is as follows:
-
-1. Environment variables
-2. Database values
-3. Default values
-
-It means that if environment variable is set, it will be used, regardless of the database value,
-and UI to edit database value will be disabled.
-
-## Environment Variable Listing
-
-We recommend setting these in your Docker ENV file (`$HOME/.firezone/.env` by
-default). Required fields in **bold**.
-
-### WebServer
-
-| Env Key | Description | Format | Default |
-| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------- |
-| **EXTERNAL_URL** | The external URL the web UI will be accessible at.
Must be a valid and public FQDN for ACME SSL issuance to function.
You can add a path suffix if you want to serve firezone from a non-root path, eg: `https://firezone.mycorp.com/vpn/`. | string | |
-| PHOENIX_SECURE_COOKIES | Enable or disable requiring secure cookies. Required for HTTPS. | boolean | true |
-| PHOENIX_HTTP_PORT | Internal port to listen on for the Phoenix web server. | integer | 13000 |
-| PHOENIX_HTTP_PROTOCOL_OPTIONS | Allows to override Cowboy HTTP server options.
Keep in mind though changing those limits can pose a security risk. Other times, browsers and proxies along the way may have equally strict limits, which means the request will still fail or the URL will be pruned.
You can see all supported options at https://ninenines.eu/docs/en/cowboy/2.5/manual/cowboy_http/. | JSON-encoded map | `{}` |
-| PHOENIX_EXTERNAL_TRUSTED_PROXIES | List of trusted reverse proxies.
This is used to determine the correct IP address of the client when the application is behind a reverse proxy by skipping a trusted proxy IP from a list of possible source IPs. | JSON-encoded list | `"[]"` |
-| PHOENIX_PRIVATE_CLIENTS | List of trusted clients.
This is used to determine the correct IP address of the client when the application is behind a reverse proxy by picking a trusted client IP from a list of possible source IPs. | JSON-encoded list | `"[]"` |
-
-### Database
-
-| Env Key | Description | Format | Default |
-| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | --------- |
-| DATABASE_HOST | PostgreSQL host. | string | postgres |
-| DATABASE_PORT | PostgreSQL port. | integer | 5432 |
-| DATABASE_NAME | Name of the PostgreSQL database. | string | firezone |
-| DATABASE_USER | User that will be used to access the PostgreSQL database. | string | postgres |
-| DATABASE_PASSWORD | Password that will be used to access the PostgreSQL database. | string | |
-| DATABASE_POOL_SIZE | Size of the connection pool to the PostgreSQL database. | integer | generated |
-| DATABASE_SSL_ENABLED | Whether to connect to the database over SSL.
If this field is set to `true`, the `database_ssl_opts` config must be set too with at least `cacertfile` option present. | boolean | false |
-| DATABASE_SSL_OPTS | SSL options for connecting to the PostgreSQL database.
Typically, to enabled SSL you want following options: - `cacertfile` - path to the CA certificate file; - `verify` - set to `verify_peer` to verify the server certificate; - `fail_if_no_peer_cert` - set to `true` to require the server to present a certificate; - `server_name_indication` - specify the hostname to be used in TLS Server Name Indication extension.
See [Ecto.Adapters.Postgres documentation](https://hexdocs.pm/ecto_sql/Ecto.Adapters.Postgres.html#module-connection-options). For list of all supported options, see the [`ssl`](http://erlang.org/doc/man/ssl.html#type-tls_client_option) module documentation. | JSON-encoded map | `{}` |
-
-### Admin Setup
-
-Options responsible for initial admin provisioning and resetting the admin password.
-
-For more details see [troubleshooting guide](/docs/administer/troubleshoot/#admin-login-isnt-working).
-
-| Env Key | Description | Format | Default |
-| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------- |
-| RESET_ADMIN_ON_BOOT | Set this variable to `true` to create or reset the admin password every time Firezone starts. By default, the admin password is only set when Firezone is installed.
Note: This **will not** change the status of local authentication. | boolean | false |
-| DEFAULT_ADMIN_EMAIL | Primary administrator email. | string | |
-| DEFAULT_ADMIN_PASSWORD | Default password that will be used for creating or resetting the primary administrator account. | string | |
-
-### Secrets and Encryption
-
-Your secrets should be generated during installation automatically and persisted to `.env` file.
-
-All secrets should be a **base64-encoded string**.
-
-| Env Key | Description | Format | Default |
-| --------------------------- | ------------------------------------------------------------------ | ------ | ------- |
-| **GUARDIAN_SECRET_KEY** | Secret key used for signing JWTs. | string | |
-| **DATABASE_ENCRYPTION_KEY** | Secret key used for encrypting sensitive data in the database. | string | |
-| **SECRET_KEY_BASE** | Primary secret key base for the Phoenix application. | string | |
-| **LIVE_VIEW_SIGNING_SALT** | Signing salt for Phoenix LiveView connection tokens. | string | |
-| **COOKIE_SIGNING_SALT** | Signing salt for cookies issued by the Phoenix web application. | string | |
-| **COOKIE_ENCRYPTION_SALT** | Encryption salt for cookies issued by the Phoenix web application. | string | |
-
-### Devices
-
-| Env Key | Description | Format | Default |
-| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ----------------- |
-| ALLOW_UNPRIVILEGED_DEVICE_MANAGEMENT | Enable or disable management of devices on unprivileged accounts. | boolean | true |
-| ALLOW_UNPRIVILEGED_DEVICE_CONFIGURATION | Enable or disable configuration of device network settings for unprivileged users. | boolean | true |
-| VPN_SESSION_DURATION | Optionally require users to periodically authenticate to the Firezone web UI in order to keep their VPN sessions active. | integer | 0 |
-| DEFAULT_CLIENT_PERSISTENT_KEEPALIVE | Interval for WireGuard [persistent keepalive](https://www.wireguard.com/quickstart/#nat-and-firewall-traversal-persistence).
If you experience NAT or firewall traversal problems, you can enable this to send a keepalive packet every 25 seconds. Otherwise, keep it disabled with a 0 default value. | integer | 25 |
-| DEFAULT_CLIENT_MTU | WireGuard interface MTU for devices. 1280 is a safe bet for most networks. Leave this blank to omit this field from generated configs. | integer | 1280 |
-| DEFAULT_CLIENT_ENDPOINT | IPv4, IPv6 address, or FQDN that devices will be configured to connect to. Defaults to this server's FQDN. | one of `IP with port`, `string` | generated |
-| DEFAULT_CLIENT_DNS | Comma-separated list of DNS servers to use for devices.
It can be either an IP address or a FQDN if you intend to use a DNS-over-TLS server.
Leave this blank to omit the `DNS` section from generated configs. | {:array, ",", {:one_of, [Domain.Types.IP, :string]}, [validate_unique: true]} | `[]` |
-| DEFAULT_CLIENT_ALLOWED_IPS | Configures the default AllowedIPs setting for devices.
AllowedIPs determines which destination IPs get routed through Firezone.
Specify a comma-separated list of IPs or CIDRs here to achieve split tunneling, or use `0.0.0.0/0, ::/0` to route all device traffic through this Firezone server. | {:array, ",", {:one_of, [Domain.Types.CIDR, Domain.Types.IP]}, [validate_unique: true]} | `0.0.0.0/0, ::/0` |
-
-### Authorization
-
-| Env Key | Description | Format | Default |
-| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ----------------------------- |
-| LOCAL_AUTH_ENABLED | Enable or disable the local authentication method for all users. | boolean | true |
-| DISABLE_VPN_ON_OIDC_ERROR | Enable or disable auto disabling VPN connection on OIDC refresh error. | boolean | false |
-| SAML_ENTITY_ID | Entity ID for SAML authentication. | string | urn:firezone.dev:firezone-app |
-| SAML_KEYFILE_PATH | Path to the SAML keyfile inside the container. Should be either a PEM or DER-encoded private key, with file extension `.pem` or `.key`. | string | /var/firezone/saml.key |
-| SAML_CERTFILE_PATH | Path to the SAML certificate file inside the container. Should be either a PEM or DER-encoded certificate, with file extension `.crt` or `.pem`. | string | /var/firezone/saml.crt |
-| OPENID_CONNECT_PROVIDERS | List of OpenID Connect identity providers configurations.
For more details see https://docs.firezone.dev/authenticate/oidc/. | JSON-encoded list | `"[]"` |
-| SAML_IDENTITY_PROVIDERS | List of SAML identity providers configurations.