handle WireGuard tunnels being disabled in core settings

.github/workflows/build-macos.yaml

@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - uses: pnpm/action-setup@v6
         with:

.github/workflows/e2e.yaml

@@ -47,7 +47,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
@@ -133,7 +133,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6

.github/workflows/lint.yaml

@@ -30,7 +30,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - uses: pnpm/action-setup@v6
         with:

.github/workflows/release-macos.yaml

@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - uses: pnpm/action-setup@v6
         with:

.github/workflows/release.yaml

@@ -64,7 +64,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - name: Install pnpm
         uses: pnpm/action-setup@v6
@@ -181,7 +181,7 @@ jobs:
           echo "DEFGUARD_CLIENT_BUILD_VERSION=${GITHUB_REF_NAME#v}" >> ${GITHUB_ENV}
       - uses: actions/setup-node@v6
         with:
-          node-version: 26
+          node-version-file: new-ui/.nvmrc
 
       - uses: pnpm/action-setup@v6
         with:

new-ui/.nvmrc

@@ -1 +1 @@
-v25
+26

new-ui/src/pages/compact/CompactLocationsPage/components/InstanceSwitcher.tsx

@@ -9,6 +9,7 @@ import { useAppData } from '../../../../shared/providers/AppDataContext';
 import {
   getInstancesQueryOptions,
   getTunnelsQueryOptions,
+  tunnelsDisabled,
 } from '../../../../shared/rust-api/query';
 import type { OverviewViewSelection } from '../../../../shared/rust-api/types';
 import { isPresent } from '../../../../shared/utils/isPresent';
@@ -35,17 +36,22 @@ export const InstanceSwitcher = () => {
       })),
     };
 
-    const tunnelGroup: SelectOptionGroup<OverviewViewSelection> = {
-      key: 'tunnels',
-      label: 'Tunnels',
-      options: tunnels.map((tunnel) => ({
-        key: `tunnel-${tunnel.id ?? tunnel.name}`,
-        label: tunnel.name,
-        value: { kind: 'tunnel', id: tunnel.id },
-      })),
-    };
+    const tunnelGroup: SelectOptionGroup<OverviewViewSelection> | undefined =
+      !tunnelsDisabled(instances ?? []) && tunnels.length > 0
+        ? {
+            key: 'tunnels',
+            label: 'Tunnels',
+            options: tunnels.map((tunnel) => ({
+              key: `tunnel-${tunnel.id ?? tunnel.name}`,
+              label: tunnel.name,
+              value: { kind: 'tunnel', id: tunnel.id },
+            })),
+          }
+        : undefined;
 
-    return [instanceGroup, tunnelGroup];
+    const result: SelectOptionGroup<OverviewViewSelection>[] = [instanceGroup];
+    if (tunnelGroup) result.push(tunnelGroup);
+    return result;
   }, [instances, tunnels]);
 
   const totalOptions = useMemo(

new-ui/src/pages/full/AddPage/AddPage.tsx

@@ -1,12 +1,18 @@
 import './style.scss';
+import { useQuery } from '@tanstack/react-query';
 import { useNavigate } from '@tanstack/react-router';
 import { FullPageTitle } from '../../../shared/components/FullPageTitle/FullPageTitle';
 import { FullPage } from '../../../shared/layouts/FullPage/FullPage';
+import {
+  getInstancesQueryOptions,
+  tunnelsDisabled,
+} from '../../../shared/rust-api/query';
 import { ThemeSpacing } from '../../../shared/types';
 import { AddCard } from './components/AddCard/AddCard';
 
 export const AddPage = () => {
   const navigate = useNavigate();
+  const { data: instances } = useQuery(getInstancesQueryOptions);
   return (
     <FullPage id="add-page-view">
       <FullPageTitle title="Add Defguard items" spacing={ThemeSpacing.Xl} />
@@ -22,17 +28,19 @@ export const AddPage = () => {
           actionText="Add instance"
           description={`Establish a secure connection to your Defguard instance effortlessly by configuring it with a single token—no manual setup.`}
         />
-        <AddCard
-          image="wireguard"
-          onClick={() => {
-            navigate({
-              to: '/full/add/tunnel',
-            });
-          }}
-          title="Add WireGuard Tunnel"
-          actionText="Add tunnel"
-          description={`Add and configure a WireGuard tunnel to securely route traffic through an encrypted connection using predefined configuration.`}
-        />
+        {!tunnelsDisabled(instances ?? []) && (
+          <AddCard
+            image="wireguard"
+            onClick={() => {
+              navigate({
+                to: '/full/add/tunnel',
+              });
+            }}
+            title="Add WireGuard Tunnel"
+            actionText="Add tunnel"
+            description={`Add and configure a WireGuard tunnel to securely route traffic through an encrypted connection using predefined configuration.`}
+          />
+        )}
       </div>
     </FullPage>
   );

new-ui/src/pages/full/OverviewPage/OverviewPage.tsx

@@ -8,7 +8,10 @@ import { ScrollContainer } from '../../../shared/components/ScrollContainer/Scro
 import { SizedBox } from '../../../shared/components/SizedBox/SizedBox';
 import { FullPage } from '../../../shared/layouts/FullPage/FullPage';
 import { useAppData } from '../../../shared/providers/AppDataContext';
-import { getLocationsQueryOptions } from '../../../shared/rust-api/query';
+import {
+  getLocationsQueryOptions,
+  tunnelsDisabled,
+} from '../../../shared/rust-api/query';
 import type { InstanceInfo } from '../../../shared/rust-api/types';
 import { ThemeSpacing } from '../../../shared/types';
 import { isPresent } from '../../../shared/utils/isPresent';
@@ -59,7 +62,10 @@ export const OverviewPage = () => {
     <Fragment>
       <FullPage id="overview-page" hideScrollContainer>
         <div className="page-grid">
-          <OverviewSelection instances={instances} tunnels={tunnels} />
+          <OverviewSelection
+            instances={instances}
+            tunnels={tunnelsDisabled(instances) ? [] : tunnels}
+          />
           <div
             className={clsx('overview-content', {
               windows: isWindows,
@@ -96,7 +102,7 @@ export const OverviewPage = () => {
         </div>
       </FullPage>
       <ConnectModal />
-      <UpdateTunnelModal />
+      {!tunnelsDisabled(instances) && <UpdateTunnelModal />}
       <UpdateInstanceModal />
     </Fragment>
   );

new-ui/src/routes/full/_default/add/tunnel.tsx

@@ -1,6 +1,16 @@
-import { createFileRoute } from '@tanstack/react-router';
+import { createFileRoute, redirect } from '@tanstack/react-router';
 import { AddTunnelPage } from '../../../../pages/full/AddTunnelPage/AddTunnelPage';
+import {
+  getInstancesQueryOptions,
+  tunnelsDisabled,
+} from '../../../../shared/rust-api/query';
 
 export const Route = createFileRoute('/full/_default/add/tunnel')({
+  beforeLoad: async ({ context }) => {
+    const instances = await context.queryClient.ensureQueryData(getInstancesQueryOptions);
+    if (tunnelsDisabled(instances)) {
+      throw redirect({ to: '/full/overview' });
+    }
+  },
   component: AddTunnelPage,
 });

new-ui/src/routes/full/tunnel-wizard.tsx

@@ -1,6 +1,13 @@
-import { createFileRoute } from '@tanstack/react-router';
+import { createFileRoute, redirect } from '@tanstack/react-router';
 import { TunnelWizardPage } from '../../pages/full/TunnelWizardPage/TunnelWizardPage';
+import { getInstancesQueryOptions, tunnelsDisabled } from '../../shared/rust-api/query';
 
 export const Route = createFileRoute('/full/tunnel-wizard')({
+  beforeLoad: async ({ context }) => {
+    const instances = await context.queryClient.ensureQueryData(getInstancesQueryOptions);
+    if (tunnelsDisabled(instances)) {
+      throw redirect({ to: '/full/overview' });
+    }
+  },
   component: TunnelWizardPage,
 });

new-ui/src/shared/components/LocationCard/components/LocationCardConnectButton.tsx

@@ -1,6 +1,6 @@
 import { useMutation } from '@tanstack/react-query';
 import { api } from '../../../rust-api/api';
-import { LocationMfaMode } from '../../../rust-api/types';
+import { shouldStartMfa } from '../../../utils/mfa';
 import { parseConnectError } from '../api/connectError';
 import { useLocationCardContext } from '../context/context';
 import { LocationCardViews } from '../context/types';
@@ -46,7 +46,7 @@ export const LocationCardConnectButton = () => {
         connectionType: location.connection_type,
         locationId: location.id,
       });
-    } else if (location.location_mfa_mode !== LocationMfaMode.Disabled) {
+    } else if (shouldStartMfa(location)) {
       startMfa();
     } else {
       connect({

new-ui/src/shared/components/OverviewLocationCard/OverviewLocationCard.tsx

@@ -12,9 +12,10 @@ import { useConnectModal } from '../../../pages/full/OverviewPage/components/Con
 import { api } from '../../rust-api/api';
 import { getAppConfigQueryOptions } from '../../rust-api/query';
 import type { InstanceInfo, LocationInfo } from '../../rust-api/types';
-import { LocationMfaMode, MfaMethod } from '../../rust-api/types';
+import { MfaMethod } from '../../rust-api/types';
 import { ThemeSpacing } from '../../types';
 import { isPresent } from '../../utils/isPresent';
+import { shouldStartMfa } from '../../utils/mfa';
 import { Divider } from '../Divider/Divider';
 import { parseConnectError } from '../LocationCard/api/connectError';
 import { ConnectButton } from '../LocationCard/components/ConnectButton/ConnectButton';
@@ -78,7 +79,7 @@ export const OverviewLocationCard = ({ location, instance }: Props) => {
       return;
     }
 
-    if (location.location_mfa_mode !== LocationMfaMode.Disabled) {
+    if (shouldStartMfa(location)) {
       useConnectModal.getState().open({
         view: mfaMethodToConnectModalView(location.mfa_method ?? MfaMethod.Totp),
         location,

new-ui/src/shared/providers/TauriEventProvider.tsx

@@ -17,6 +17,7 @@ import {
   type LocationInfo,
   MfaMethod,
   TauriEvent,
+  type TunnelsDisabledPayload,
 } from '../rust-api/types';
 import { useAppStore } from '../store/useAppStore';
 import { decideLocationMfaMethod } from '../utils/decideLocationMfaMethod';
@@ -162,6 +163,18 @@ export const TauriEventProvider = ({ children }: PropsWithChildren) => {
       listen(TauriEvent.SessionStateChanged, () => {
         void queryClient.invalidateQueries({ queryKey: ['session-state'] });
       }),
+
+      listen<TunnelsDisabledPayload>(TauriEvent.TunnelsDisabled, (event) => {
+        void debug(`UI Received event TunnelsDisabled: ${JSON.stringify(event.payload)}`);
+        void queryClient.invalidateQueries({ queryKey: ['instances'] });
+        void queryClient.invalidateQueries({ queryKey: ['tunnels'] });
+      }),
+
+      listen(TauriEvent.TunnelsEnabled, () => {
+        void debug('UI Received event TunnelsEnabled');
+        void queryClient.invalidateQueries({ queryKey: ['instances'] });
+        void queryClient.invalidateQueries({ queryKey: ['tunnels'] });
+      }),
     ]);
 
     return () => {

new-ui/src/shared/rust-api/query.ts

@@ -2,7 +2,19 @@ import { queryOptions, skipToken } from '@tanstack/react-query';
 
 import { isPresent } from '../utils/isPresent';
 import { api } from './api';
-import type { ConnectionArgs, LocationDetailsArgs, StatsArgs } from './types';
+import type {
+  ConnectionArgs,
+  InstanceInfo,
+  LocationDetailsArgs,
+  StatsArgs,
+} from './types';
+
+/**
+ * Single source of truth for the OR-across-instances "tunnels disabled" rule:
+ * tunnels are disabled when any enrolled instance has the flag set.
+ */
+export const tunnelsDisabled = (instances: InstanceInfo[]): boolean =>
+  instances.some((i) => i.disable_tunnels);
 
 export const getAllActiveConnectionQueryOptions = queryOptions({
   queryKey: ['alive-connections'] as const,

new-ui/src/shared/rust-api/types.ts

@@ -166,6 +166,8 @@ export const TauriEvent = {
   MfaOpenIdError: 'mfa-openid-error',
   MfaMobileComplete: 'mfa-mobile-complete',
   MfaMobileError: 'mfa-mobile-error',
+  TunnelsDisabled: 'tunnel-disabled-by-policy',
+  TunnelsEnabled: 'tunnel-enabled-by-policy',
 } as const;
 
 export type TauriEventValue = (typeof TauriEvent)[keyof typeof TauriEvent];
@@ -190,6 +192,11 @@ export type AddInstanceEventPayload = {
   url: string;
 };
 
+/** Payload for the `tunnel-disabled-by-policy` event. Mirrors `TunnelsDisabled` in events.rs. */
+export type TunnelsDisabledPayload = {
+  names: string[];
+};
+
 export type ActiveConnectionSummary = {
   id: number;
   name: string;
@@ -222,6 +229,7 @@ export type InstanceInfo = {
   pubkey: string;
   client_traffic_policy: ClientTrafficPolicy;
   enterprise_enabled: boolean;
+  disable_tunnels: boolean;
   openid_display_name: string | null;
 };