From 0f570a6fd73d7d917144842a2024f374d23cd9ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20W=C3=B3jcik?= <maciej@defguard.net>
Date: Fri, 24 Jul 2026 14:09:12 +0200
Subject: [PATCH] add disable_tunnels field to InstanceInfo

---
 common/client_types.proto | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/common/client_types.proto b/common/client_types.proto
index 16f20ca..c2870f9 100644
--- a/common/client_types.proto
+++ b/common/client_types.proto
@@ -151,6 +151,11 @@ message InstanceInfo {
   bool disable_all_traffic = 7 [deprecated = true];
   optional string openid_display_name = 8;
   optional ClientTrafficPolicy client_traffic_policy = 9;
+  // Added for 2.1
+  // When ANY enrolled instance has this true, the desktop
+  // client and CLI hide, block, and disconnect bare WireGuard tunnels
+  // (OR-across-instances semantics).
+  optional bool disable_tunnels = 10;
 }
 
 message DeviceConfigResponse {