Review and fix 2.1 docs

README.md

@@ -9,16 +9,18 @@ Welcome to the Defguard documentation. Here, you’ll learn how to explore the f
 * [Getting started](getting-started/one-line-install.md)\
   Lets you quickly set up your own Defguard instance to explore its features an user interface.
 * [Features and configuration](features/overview.md)\
-  Helps you, as a future Defguard administrator, get familiar with all of Defguard’s features and how to configure them to suit your needs.
+  Helps you, as a future Defguard administrator, get familiar with all of Defguard’s features and how to configure them to suit your needs, including integrations such as the REST API and webhooks.
 * [Deployment strategies](deployment-strategies/overview.md)\
   Walks you through the most common deployment strategies to help you set up your Defguard instance as a production-grade solution.
-* [License](https://app.gitbook.com/s/tIboBQe0Rz5YT3cHdNlh/enterprise)\
+* [License](enterprise/license.md)\
   Outlines the scope, limits, and purchasing process for the Defguard Enterprise license.
 * [Using Defguard (for end users)](using-defguard-for-end-users/overwiew.md)\
   Helps you, as a Defguard end user, get familiar with the client applications and their features so you can quickly connect to your Defguard instance.
+* [Support](support.md)\
+  Shows you where to get help, how to report an issue, and where to find the troubleshooting guides for every component.
+* [Compliance](compliance/defguard-compliance.md)\
+  Describes how Defguard helps you meet the requirements of common security standards and regulations.
 * [In depth](in-depth/architecture-decision-records/)\
   In-depth information about the platform and its development, reflecting our commitment to transparency.
 * [For developers](for-developers/contributing.md)\
   All the information you need to become a Defguard contributor — join us in building a better solution.
-* [Resources](support-1/troubleshooting/)\
-  A collection of essential resources, including troubleshooting guides, API documentation, and more.

SUMMARY.md

@@ -15,6 +15,7 @@
 ## Features
 
 * [Overview](features/overview.md)
+* [User management](features/user-management.md)
 * [Zero-Trust VPN with 2FA/MFA](features/wireguard/README.md)
   * [Create/Manage VPN Location](features/wireguard/create-your-vpn-network/README.md)
     * [Split Tunnel Configuration](features/wireguard/create-your-vpn-network/split-tunnel-configuration.md)
@@ -68,7 +69,6 @@
 * [Integrations](features/integrations/README.md)
   * [Webhooks](features/integrations/webhooks.md)
   * [REST API](features/integrations/api-tokens.md)
-* [OPNSense Configuration](features/gateway.md)
 * [SSH Authentication](features/ssh-authentication.md)
 * [Forward auth](features/forward-auth.md)
 * [User SNAT bindings](features/user-snat-bindings.md)
@@ -215,6 +215,7 @@
   * [Security concepts](in-depth/architecture/security-concepts.md)
   * [MFA Architecture](in-depth/architecture/architecture.md)
 * [Architecture Decision Records](in-depth/architecture-decision-records/README.md)
+  * [2.1](in-depth/architecture-decision-records/2.1.md)
   * [2.0](in-depth/architecture-decision-records/2.0.md)
   * [1.6](in-depth/architecture-decision-records/1.6.md)
   * [1.5](in-depth/architecture-decision-records/1.5.md)

about/about-defguard.md

@@ -16,7 +16,7 @@ Defguard helps organizations:
 * Automate device enrollment.
 * Simplify network segmentation and access control using policies.
 
-For a detailed list of features go to the [Features overview](https://github.com/DefGuard/docs/blob/v1.6/about/broken-reference/README.md) section.
+For a detailed list of features go to the [Features overview](features-overview.md) section.
 
 ## Why choose Defguard?
 
@@ -60,7 +60,7 @@ End users enjoy one-click VPN access via the Defguard apps, while admins gain gr
 
 #### 🧩 Modular and Scalable
 
-Each component (Core, Gateway, Proxy) can be deployed independently, allowing flexible scaling - from a single office setup to multi-region enterprise deployments.
+Each component (Core, Gateway, Edge) can be deployed independently, allowing flexible scaling - from a single office setup to multi-region enterprise deployments.
 
 #### 🧱 Security Built into the Development Process
 

about/features-overview.md

@@ -30,6 +30,14 @@ _Defguard is not an official WireGuard project, and WireGuard is a registered tr
 * Allow or deny access based on users or groups
 * Changes are applied in **real time**
 
+### [Device posture verification](../features/device-posture-verification.md)
+
+* Check the security state of a device before it connects to a location
+* Minimum operating system, Linux kernel and Defguard client versions
+* Disk encryption, antivirus, Active Directory membership and device integrity conditions
+* Limits on the age of Windows security updates and Android security patches
+* Several checks can be assigned to one location, and a device has to satisfy all of them
+
 ### Identity Management:
 
 * [**OpenID Connect**](https://openid.net/developers/how-connect-works/) **based SSO**
@@ -47,8 +55,8 @@ _Defguard is not an official WireGuard project, and WireGuard is a registered tr
 
 ### Account Lifecycle Management:
 
-* Secure remote (over the internet) [user enrollment](https://defguard.gitbook.io/defguard/help/remote-user-enrollment)
-* User [onboarding after enrollment](https://defguard.gitbook.io/defguard/help/remote-user-enrollment/user-onboarding-after-enrollment)
+* Secure remote (over the internet) [user enrollment](../features/remote-user-enrollment/)
+* User [onboarding after enrollment](../features/remote-user-enrollment/user-onboarding-after-enrollment.md)
 * Self-service for password reset
 
 ### [Network devices](../features/network-devices.md)

deployment-strategies/amis-and-aws-cloudformation/README.md

@@ -17,7 +17,7 @@ The template consists of the following main components:
 * **Defguard Edge**
 * **PostgreSQL Database**
 
-We recommend reading the [Architecture documentation](https://docs.defguard.net/in-depth/architecture) to understand how these components interact.
+We recommend reading the [Architecture documentation](../../in-depth/architecture/) to understand how these components interact.
 
 <figure><img src="../../.gitbook/assets/aws_cloudformation_v2.png" alt=""><figcaption><p>Diagram showing how the components are deployed using the template</p></figcaption></figure>
 
@@ -88,7 +88,7 @@ Make sure to also check the rest of the pre-filled parameters, as you may want t
 
 #### Stack options
 
-Next, select the behavior on deployment failure:
+Next, select the behaviour on deployment failure:
 
 <figure><img src="../../.gitbook/assets/image (35).png" alt=""><figcaption></figcaption></figure>
 
@@ -130,7 +130,7 @@ Use the token displayed in the `AdminFirstDeviceToken` CloudFormation output to
 
 <figure><img src="../../.gitbook/assets/image (40).png" alt=""><figcaption></figcaption></figure>
 
-Check this [guide](https://docs.defguard.net/using-defguard-for-end-users/desktop-client/instance-configuration#adding-instance) on adding a new instance in the Desktop client, to learn more about the process. As the instance URL, use the URL you defined in your Defguard Edge instance configuration section of the CloudFormation template (`ProxyUrl`).
+Check this [guide](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#manually-adding-instance) on adding a new instance in the Desktop client, to learn more about the process. As the instance URL, use the URL you defined in your Defguard Edge instance configuration section of the CloudFormation template (`ProxyUrl`).
 
 #### Accessing the dashboard
 
@@ -176,7 +176,7 @@ To login, use the default `admin` username and the password defined in `CoreDefa
 #### Edge Instance
 
 * `ProxyGrpcPort` (optional): The gRPC port for the Edge, default is `50051`.
-* `ProxyHttpPort` (optional): The HTTP port for the Edge, default is `8000`. This is where the Defguard Edge web UI will be accessible. The proxy UI is used for user enrollment.
+* `ProxyHttpPort` (optional): The HTTP port for the Edge, default is `8000`. This is where the Defguard Edge web UI will be accessible. The Edge UI is used for user enrollment.
 * `ProxyInstanceType` (optional): The instance type for the Edge, default is `t3.micro`.
 * `ProxyLogLevel` (optional): The log level for the Edge, default is `info`. You can also set it to `error`, `debug` or `trace`.
 * `ProxyUrl` (required): The URL where the Defguard Edge will be accessible (e.g., `https://proxy.defguard.example.com`). This should be the URL that users will use to access the Defguard Edge web UI.

deployment-strategies/configuration.md

@@ -42,6 +42,8 @@ The following sections describe the supported deployment parameters for each Def
 * `--grpc-bind-address` / `DEFGUARD_GRPC_BIND_ADDRESS`: IP address the Core gRPC server binds to.
 * `--adopt-gateway` / `DEFGUARD_ADOPT_GATEWAY`: Gateway address used to launch the auto-adoption wizard.
 * `--adopt-edge` / `DEFGUARD_ADOPT_EDGE`: Edge address used to launch the auto-adoption wizard.
+* `--rate-limit-per-second` / `DEFGUARD_RATELIMIT_PERSECOND`: Maximum number of requests per second per client IP before rate limiting kicks in. Set to `0` to disable rate limiting (default: `0`).
+* `--rate-limit-burst` / `DEFGUARD_RATELIMIT_BURST`: Maximum burst size for the rate limiter (token bucket capacity per client IP). Set to `0` to disable rate limiting (default: `0`).
 
 #### Deprecated Core deployment parameters
 
@@ -69,35 +71,28 @@ Since Defguard 2.0, much of the configuration that was previously provided throu
 * `--http-port` / `DEFGUARD_PROXY_HTTP_PORT`: Port used by the Edge HTTP server.
 * `--grpc-port` / `DEFGUARD_PROXY_GRPC_PORT`: Port used by the Edge gRPC server.
 * `--log-level` / `DEFGUARD_PROXY_LOG_LEVEL`: Sets the Edge log verbosity.
-* `--ratelimit-persecond` / `DEFGUARD_PROXY_RATELIMIT_PERSECOND`: Sets the per-second request rate limit for the HTTP API.
-* `--ratelimit-burst` / `DEFGUARD_PROXY_RATELIMIT_BURST`: Sets the allowed burst size for rate limiting.
-* `--config:` Path `to` a TOML configuration file for Edge.
+* `--rate-limit-per-second` / `DEFGUARD_PROXY_RATELIMIT_PERSECOND`: Sets the per-second request rate limit for the HTTP API.
+* `--rate-limit-burst` / `DEFGUARD_PROXY_RATELIMIT_BURST`: Sets the allowed burst size for rate limiting.
+* `--config`: Path to a TOML configuration file for Edge.
 * `--http-bind-address` / `DEFGUARD_HTTP_BIND_ADDRESS`: IP address the Edge HTTP server binds to.
 * `--grpc-bind-address` / `DEFGUARD_GRPC_BIND_ADDRESS`: IP address the Edge gRPC server binds to.
 * `--cert-dir` / `DEFGUARD_PROXY_CERT_DIR`: Directory where Edge stores its certificate files.
 * `--https-port` / `DEFGUARD_PROXY_HTTPS_PORT`: Port used by the Edge HTTPS server when TLS certificates are installed.
 * `--acme-staging` / `DEFGUARD_PROXY_ACME_STAGING`: Enables the Let’s Encrypt staging environment for ACME certificate issuance.
-
-#### Deprecated Edge deployment parameters
-
-* \`--grpc-cert / DEFGUARD\_PROXY\_GRPC\_CERT: Deprecated. gRPC certificates are now automatically generated by the Core CA.
-* `--grpc-key` / `DEFGUARD_PROXY_GRPC_KEY`: Deprecated. gRPC certificates are now automatically generated by the Core CA.
-* `--url` / `DEFGUARD_PROXY_URL`: Deprecated. The public Edge URL is now generated by Core instead.
+* `--adoption-timeout` / `DEFGUARD_ADOPTION_TIMEOUT`: Time limit for the auto-adoption process, in minutes.
 
 ### Gateway deployment parameters
 
 * `--log-level` / `DEFGUARD_LOG_LEVEL`: Sets the Gateway log verbosity.
 * `--grpc-port` / `DEFGUARD_GRPC_PORT`: Port used by the Gateway gRPC server.
-* `--grpc-cert` / `DEFGUARD_GATEWAY_GRPC_CERT`: gRPC TLS certificate used by Gateway.
-* `--grpc-key` / `DEFGUARD_GATEWAY_GRPC_KEY`: gRPC TLS private key used by Gateway.
 * `--userspace` / `DEFGUARD_USERSPACE`: Enables a userspace WireGuard implementation.
 * `--stats-period` / `DEFGUARD_STATS_PERIOD`: Defines how often interface statistics are sent to Defguard Core.
 * `--ifname` / `DEFGUARD_IFNAME`: Sets the WireGuard interface name.
-* `--pidfile:` Writes `the` Gateway process ID to the specified file.
-* `--use-syslog:` Enables `logging` to syslog.
-* `--syslog-facility:` Sets `the` syslog facility.
-* `--syslog-socket:` Sets `the` syslog socket path.
-* `--config:` Path `to` a TOML configuration file for Gateway.
+* `--pidfile`: Writes the Gateway process ID to the specified file.
+* `--use-syslog`: Enables logging to syslog.
+* `--syslog-facility`: Sets the syslog facility.
+* `--syslog-socket`: Sets the syslog socket path.
+* `--config`: Path to a TOML configuration file for Gateway.
 
 {% hint style="danger" %}
 Defguard is built with highest security standards in mind, thus the pre/post options below **accept only a full path to one command and its arguments.**
@@ -116,11 +111,16 @@ To run multiple commands, create an appropriate shell script.
 * `--http-bind-address` / `DEFGUARD_HTTP_BIND_ADDRESS`: IP address used for the Gateway health endpoint bind.
 * `--cert-dir` / `DEFGUARD_GATEWAY_CERT_DIR`: Directory where Gateway stores its certificate files.
 * `--adoption-timeout` / `DEFGUARD_ADOPTION_TIMEOUT`: Time limit for the auto-adoption process, in minutes.
+* `--clean-on-quit` / `DEFGUARD_CLEAN_ON_QUIT`: On quit, removes the network interface and the VPN configuration.
 
 ### Config file
 
 Edge and Gateway can be configured not only through command-line options and environment variables, but also through a TOML configuration file. This is useful when you want to keep component configuration in a single file instead of passing all parameters at startup.
 
+{% hint style="warning" %}
+When a configuration file is passed with `--config`, it becomes the only source of configuration for that component: command-line options and environment variables are ignored, and every option not present in the file falls back to its default value. Either keep the whole component configuration in the file, or don't use the file at all.
+{% endhint %}
+
 When using a TOML file, the available keys correspond to the same configuration options exposed by the component through CLI arguments and environment variables. In the TOML file, these options should be written in snake\_case, matching the internal option names used by the component configuration. This makes the file-based configuration equivalent in scope to the startup parameters, while providing a more convenient format for managing persistent configuration. Example Edge configuration parameters:
 
 ```toml
@@ -132,13 +132,12 @@ grpc_port = 50051
 log_level = "info"
 rate_limit_per_second = 0
 rate_limit_burst = 0
-url = "http://localhost:8080"
 acme_staging = false
 ```
 
 ## Settings
 
-This section describes the configuration that is managed from within the Defguard web interface after the system has been deployed. Unlike deployment parameters, which control how individual services are started, Settings are used to manage operational behavior directly from Core and can be updated by administrators through the UI.
+This section describes the configuration that is managed from within the Defguard web interface after the system has been deployed. Unlike deployment parameters, which control how individual services are started, Settings are used to manage operational behaviour directly from Core and can be updated by administrators through the UI.
 
 This includes:
 
@@ -151,7 +150,7 @@ This includes:
 * license and enterprise-related settings
 * SMTP and email delivery configuration
 * webhook configuration
-* statistics retention and purge behavior
+* statistics retention and purge behaviour
 * API tokens and integration-related settings
 * component adoption and setup workflows where managed through the UI
 
@@ -162,8 +161,8 @@ Settings page is accessible only for admin users. It can be accessed with a navi
 The page is split into tabs that group related settings:
 
 * General: contains the main instance-level administration pages.
-  * Instance settings: configures the Core URL, instance name, public Edge URL, authentication period, statistics retention and purge behavior, and password reset timeouts.
-  * Client behavior: configures client-side permissions and policy controls, including device management, self-service client activation, and client traffic-routing policy.
+  * Instance settings: configures the Core URL, instance name, public Edge URL, authentication period, statistics retention and purge behaviour, and password reset timeouts.
+  * Client behaviour: configures client-side permissions and policy controls, including device management, self-service client activation, and client traffic-routing policy.
 * Notifications: contains outbound notification settings.
   * SMTP: configures the mail server connection used by Defguard, including server address, port, credentials, sender address, and encryption mode.
   * Gateway notifications: configures gateway disconnect and reconnect email notifications, including the inactivity threshold.
@@ -214,6 +213,6 @@ The selected syslog socket may be wrong. See the `syslog_socket` configuration o
 
 `Cookie “defguard_session” has been rejected for invalid domain.` (browser console error)
 
-This issue most often takes the form of not being able to login without any obvious cause. The login button doesn't redirect and no relevant error message is displayed in the Defguard Core logs. In this case we recommend checking the browser logs (usually right click > inspect should open the developer tools along with the browser console). If you can see the above error, this means that your `DEFGUARD_URL` configuration option doesn't match the URL you use to access the dashboard at the moment.
+This issue most often takes the form of not being able to login without any obvious cause. The login button doesn't redirect and no relevant error message is displayed in the Defguard Core logs. In this case we recommend checking the browser logs (usually right click > inspect should open the developer tools along with the browser console). If you can see the above error, this means that the Core URL configured in Defguard (**Settings → General → Instance settings**) doesn't match the URL you use to access the dashboard at the moment.
 
-For example, if your login screen is at `http://my.domain.com:8000/auth/login` set `DEFGUARD_URL` to `` http://my.domain.com:8000` `` .
+For example, if your login screen is at `http://my.domain.com:8000/auth/login` set the Core URL to `http://my.domain.com:8000`.

deployment-strategies/deploying-to-production.md

@@ -39,7 +39,7 @@ Follow our [guide](production-deployment-verification-guide.md) to test if your
 {% step %}
 **Configure features**
 
-Follow detailed descriptions of [Defguard’s features](https://github.com/DefGuard/docs/blob/v1.6/deployment-strategies/broken-reference/README.md). As you follow along, you can adjust the configuration directly within your instance.
+Follow detailed descriptions of [Defguard’s features](../features/overview.md). As you follow along, you can adjust the configuration directly within your instance.
 
 For a detailed list of all configurable things through environmental variables, options or configuration files follow [this reference](configuration.md).
 {% endstep %}

deployment-strategies/docker-compose.md

@@ -75,7 +75,7 @@ docker compose up
 
 Depending on your infrastructure, you may choose to keep the setup simple and let Defguard handle SSL termination for you. Learn more about this functionality [here](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#configure-ssl-for-core). In that case skip stis step.
 
-Alternatively, you can place a reverse proxy in front of your Core service to manage SSL termination. 
+Alternatively, you can place a reverse proxy in front of your Core service to manage SSL termination.
 
 Here is an example [nginx](https://nginx.org/) configuration to provide SSL termination:
 
@@ -130,7 +130,7 @@ services:
 
 Depending on your infrastructure, you may choose to keep the setup simple and let Defguard handle SSL termination for you. Learn more about this functionality [here](../tutorials/initial-setup-wizard-setting-up-from-scratch.md#configure-ssl-for-edge). In that case skip stis step.
 
-Alternatively, you can place a reverse proxy in front of your Edge service to manage SSL termination. 
+Alternatively, you can place a reverse proxy in front of your Edge service to manage SSL termination.
 
 Here is an example [nginx](https://nginx.org/) configuration to provide SSL termination: