refactoring: still total mess

refactoring: build fixes
refactoring: separated api controllers
2026-07-03 14:07:39 +02:00 · 2025-08-10 21:22:40 +08:00 · 2025-08-09 20:45:06 +08:00 · 2025-08-08 21:58:52 +08:00 · 2025-08-08 14:16:01 +08:00 · 2025-08-04 16:10:31 +08:00
720 changed files with 30377 additions and 45546 deletions
@@ -2,7 +2,7 @@
 /client/3rd-prebuild
 /client/android
 /client/cmake
-/client/core/utils/serialization
+/client/core/serialization
 /client/daemon
 /client/fonts
 /client/images
@@ -0,0 +1,69 @@
+# Amnezia VPN Client - MVVM Refactoring Rules
+
+## Architecture Requirements
+
+### MVVM Pattern
+- Follow Model-View-ViewModel architecture strictly
+- Maintain clear separation of concerns between layers
+- UI controllers should only handle user input and delegate to core controllers
+- Core controllers contain all business logic and data manipulation
+
+### Dependencies Direction
+- UI layer depends on Core layer (unidirectional dependency)
+- UI controllers must not depend on each other
+- Core controllers must not depend on each other (exceptions: ServerController, VpnConfigurationsController, GatewayController can be created "on the fly")
+
+### Settings Usage
+- UI classes must NOT use Settings class directly
+- Create wrapper methods in core controllers for Settings operations
+
+### Server Controller Creation
+- ServerController creation must happen in Core controllers, never in UI
+- Remove direct instantiation: `new ServerController(m_settings)` from UI code
+
+## Code Organization
+
+### Folder Structure
+- Core controllers: `client/core/controllers/`
+- Core models: `client/core/models/`  
+- UI controllers: `client/ui/controllers/`
+- UI models: `client/ui/models/`
+- Common models and controllers in root of respective folders
+
+### Controller Management
+- All controllers must be instantiated in central `coreController`
+- Dependencies between core controllers resolved in `coreController`
+- UI controllers accept core controllers via constructor injection
+- UI controllers should be renamed with "UI" suffix (e.g., `exportUIController`)
+
+## Code Style
+
+### Comments
+- Do NOT include comments in code
+- Code should be self-documenting
+
+### Models Behavior
+- Models should only display data
+- Keep core models as pure data structures without business logic
+
+## Refactoring Process
+
+### UI Controller Refactoring
+- Remove all business logic from UI controllers
+- Replace direct method calls with delegation to core controllers
+- Maintain only UI-specific logic (signals, model updates)
+- Remove Settings dependencies
+
+### Core Controller Pattern
+- Create corresponding methods in core controllers for UI operations
+- Core controllers handle all complex logic, network operations, file I/O
+- Return structured results with error codes and data
+- Manage ServerController lifecycle internally
+
+## Git Workflow
+- Use `git mv` for renaming controllers to maintain history
+
+## Error Handling
+- Core controllers return structured error results
+- UI controllers only handle error presentation
+- Maintain consistent error propagation patterns 
@@ -10,14 +10,13 @@ env:

 jobs:
  Build-Linux-Ubuntu:
-    runs-on: android-runner
+    runs-on: ubuntu-22.04

    env:
-      QT_VERSION: 6.10.1
+      QT_VERSION: 6.6.2
      QIF_VERSION: 4.7
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -31,15 +30,13 @@ jobs:
        version: ${{ env.QT_VERSION }}
        host: 'linux'
        target: 'desktop'
-        arch: 'linux_gcc_64'
+        arch: 'gcc_64'
        modules: 'qtremoteobjects qt5compat qtshadertools'
        dir: ${{ runner.temp }}
        setup-python: 'true'
        tools: 'tools_ifw'
        set-env: 'true'
-        aqtversion: '==3.3.0'       
-        py7zrversion: '==0.22.*'  
-        extra: '--base ${{ env.QT_MIRROR }}' 
+        extra: '--external 7z --base ${{ env.QT_MIRROR }}'

    - name: 'Get sources'
      uses: actions/checkout@v4
@@ -47,31 +44,24 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

-    - name: 'Get version from CMakeLists.txt'
-      id: get_version
-      run: |
-        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
-        echo "VERSION=$VERSION" >> $GITHUB_ENV
-        echo "Version: $VERSION"
-
-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Build project'
      run: |
-        sudo apt-get install libxkbcommon-x11-0 libsecret-1-dev
+        sudo apt-get install libxkbcommon-x11-0
        export QT_BIN_DIR=${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64/bin
        export QIF_BIN_DIR=${{ runner.temp }}/Qt/Tools/QtInstallerFramework/${{ env.QIF_VERSION }}/bin
        bash deploy/build_linux.sh

    - name: 'Pack installer'
-      run: cd deploy && tar -cf AmneziaVPN_Linux_Installer.tar AmneziaVPN_Linux_Installer.bin && zip AmneziaVPN_${VERSION}_linux_x64.tar.zip AmneziaVPN_Linux_Installer.tar
+      run: cd deploy && tar -cf AmneziaVPN_Linux_Installer.tar AmneziaVPN_Linux_Installer.bin

    - name: 'Upload installer artifact'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_linux_x64.tar.zip
-        path: deploy/AmneziaVPN_${{ env.VERSION }}_linux_x64.tar.zip
+        name: AmneziaVPN_Linux_installer.tar
+        path: deploy/AmneziaVPN_Linux_Installer.tar
        retention-days: 7

    - name: 'Upload unpacked artifact'
@@ -94,12 +84,11 @@ jobs:
    runs-on: windows-latest

    env:
-      QT_VERSION: 6.10.1
+      QT_VERSION: 6.6.2
      QIF_VERSION: 4.7
      BUILD_ARCH: 64
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -113,16 +102,8 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

-    - name: 'Get version from CMakeLists.txt'
-      id: get_version
-      shell: bash
-      run: |
-        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
-        echo "VERSION=$VERSION" >> $GITHUB_ENV
-        echo "Version: $VERSION"
-
-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Install Qt'
      uses: jurplel/install-qt-action@v3
@@ -130,62 +111,32 @@ jobs:
        version: ${{ env.QT_VERSION }}
        host: 'windows'
        target: 'desktop'
-        arch: 'win64_msvc2022_64'
+        arch: 'win64_msvc2019_64'
        modules: 'qtremoteobjects qt5compat qtshadertools'
        dir: ${{ runner.temp }}
        setup-python: 'true'
        tools: 'tools_ifw'
        set-env: 'true'
-        aqtversion: '==3.3.0'       
-        py7zrversion: '==0.22.*'  
-        extra: '--base ${{ env.QT_MIRROR }}' 
+        extra: '--external 7z --base ${{ env.QT_MIRROR }}'

    - name: 'Setup mvsc'
      uses: ilammy/msvc-dev-cmd@v1
      with:
        arch: 'x64'

-    - name: 'Setup .NET SDK'
-      uses: actions/setup-dotnet@v4
-      with:
-        dotnet-version: '8.0.x'
-
-    - name: 'Install WiX Toolset'
-      shell: powershell
-      run: |
-        dotnet tool install --global wix --version 4.0.6
-        wix extension add -g WixToolset.UI.wixext/4.0.6
-        wix extension add -g WixToolset.Util.wixext/4.0.6
-        wix extension list -g
-        $wixBinDir = Join-Path $env:USERPROFILE ".dotnet\tools"
-        echo "WIX_BIN_DIR=$wixBinDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-
    - name: 'Build project'
      shell: cmd
      run: |
        set BUILD_ARCH=${{ env.BUILD_ARCH }}
-        set QT_BIN_DIR="${{ runner.temp }}\\Qt\\${{ env.QT_VERSION }}\\msvc2022_64\\bin"
+        set QT_BIN_DIR="${{ runner.temp }}\\Qt\\${{ env.QT_VERSION }}\\msvc2019_64\\bin"
        set QIF_BIN_DIR="${{ runner.temp }}\\Qt\\Tools\\QtInstallerFramework\\${{ env.QIF_VERSION }}\\bin"
-        set WIX_BIN_DIR=%USERPROFILE%\.dotnet\tools
        call deploy\\build_windows.bat

-    - name: 'Rename Windows installer'
-      shell: cmd
-      run: |
-        copy AmneziaVPN_x${{ env.BUILD_ARCH }}.exe AmneziaVPN_%VERSION%_x64.exe
-
    - name: 'Upload installer artifact'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_x64.exe
-        path: AmneziaVPN_${{ env.VERSION }}_x64.exe
-        retention-days: 7
-
-    - name: 'Upload MSI installer artifact'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN_Windows_MSI_installer
-        path: AmneziaVPN_x${{ env.BUILD_ARCH }}.msi
+        name: AmneziaVPN_Windows_installer
+        path: AmneziaVPN_x${{ env.BUILD_ARCH }}.exe
        retention-days: 7

    - name: 'Upload unpacked artifact'
@@ -198,15 +149,14 @@ jobs:
 # ------------------------------------------------------

  Build-iOS:
-    runs-on: macos-latest
+    runs-on: macos-13

    env:
-      QT_VERSION: 6.10.1
+      QT_VERSION: 6.6.2
      CC: cc
      CXX: c++
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -217,7 +167,7 @@ jobs:
    - name: 'Setup xcode'
      uses: maxim-lobanov/setup-xcode@v1
      with:
-        xcode-version: '26.1'
+        xcode-version: '15.2'

    - name: 'Install desktop Qt'
      uses: jurplel/install-qt-action@v3
@@ -261,8 +211,8 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Install dependencies'
      run: pip install jsonschema jinja2
@@ -321,7 +271,6 @@ jobs:

      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -354,8 +303,8 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Build project'
      run: |
@@ -382,7 +331,7 @@ jobs:
    runs-on: macos-latest

    env:
-      QT_VERSION: 6.10.1
+      QT_VERSION: 6.8.0

      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}

@@ -399,7 +348,6 @@ jobs:

      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -410,10 +358,10 @@ jobs:
    - name: 'Setup xcode'
      uses: maxim-lobanov/setup-xcode@v1
      with:
-        xcode-version: '16.2.0'
+        xcode-version: '15.4.0'

    - name: 'Install Qt'
-      uses: jurplel/install-qt-action@v4
+      uses: jurplel/install-qt-action@v3
      with:
        version: ${{ env.QT_VERSION }}
        host: 'mac'
@@ -423,9 +371,8 @@ jobs:
        dir: ${{ runner.temp }}
        setup-python: 'true'
        set-env: 'true'
-        aqtversion: '==3.3.0'       
-        py7zrversion: '==0.22.*'  
-        extra: '--base ${{ env.QT_MIRROR }}' 
+        extra: '--external 7z --base ${{ env.QT_MIRROR }}'
+

    - name: 'Get sources'
      uses: actions/checkout@v4
@@ -433,32 +380,19 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

-    - name: 'Get version from CMakeLists.txt'
-      id: get_version
-      run: |
-        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
-        echo "VERSION=$VERSION" >> $GITHUB_ENV
-        echo "Version: $VERSION"
-
-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Build project'
      run: |
        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
        bash deploy/build_macos.sh -n

-    - name: 'Pack macOS installer'
-      run: |
-        cd deploy/build/pkg
-        zip -r ../../AmneziaVPN_${VERSION}_macos.zip AmneziaVPN.pkg
-        cd ../../..
-
    - name: 'Upload installer artifact'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_macos.zip
-        path: deploy/AmneziaVPN_${{ env.VERSION }}_macos.zip
+        name: AmneziaVPN_MacOS_installer
+        path: deploy/build/pkg/AmneziaVPN.pkg
        retention-days: 7

    - name: 'Upload unpacked artifact'
@@ -468,90 +402,17 @@ jobs:
        path: deploy/build/client/AmneziaVPN.app
        retention-days: 7

-  Build-MacOS-NE:
-    runs-on: macos-latest
-
-    env:
-      QT_VERSION: 6.10.1
-
-      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
-
-      MAC_APP_CERT_CERT: ${{ secrets.MAC_APP_CERT_CERT }}
-      MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }}
-      MAC_APP_CERT_PW: ${{ secrets.MAC_APP_CERT_PW }}
-
-      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
-      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
-      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
-      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
-      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
-      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
-      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
-
-    steps:
-    - name: 'Setup xcode'
-      uses: maxim-lobanov/setup-xcode@v1
-      with:
-        xcode-version: '26.1'
-
-    - name: 'Install desktop Qt'
-      uses: jurplel/install-qt-action@v3
-      with:
-        version: ${{ env.QT_VERSION }}
-        host: 'mac'
-        target: 'desktop'
-        modules: 'qtremoteobjects qt5compat qtshadertools qtmultimedia'
-        arch: 'clang_64'
-        dir: ${{ runner.temp }}
-        set-env: 'true'
-        extra: '--base ${{ env.QT_MIRROR }}'
-
-    - name: 'Install go'
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.24'
-        cache: false
-
-    - name: 'Setup gomobile'
-      run: |
-          export PATH=$PATH:~/go/bin
-          go install golang.org/x/mobile/cmd/gomobile@latest
-          gomobile init
-
-    - name: 'Get sources'
-      uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-
-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
-
-    - name: 'Build project'
-      run: |
-        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
-        bash deploy/build_macos_ne.sh
-
-    - name: 'Upload unpacked artifact'
-      uses: actions/upload-artifact@v4
-      with:
-        name: AmneziaVPN_MacOS_unpacked
-        path: deploy/build/client/AmneziaVPN.app
-        retention-days: 7
-
 # ------------------------------------------------------

  Build-Android:
-    runs-on: android-runner
+    runs-on: ubuntu-latest

    env:
-      ANDROID_BUILD_PLATFORM: android-36
-      QT_VERSION: 6.10.1
+      ANDROID_BUILD_PLATFORM: android-34
+      QT_VERSION: 6.7.3
      QT_MODULES: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -629,22 +490,15 @@ jobs:
      with:
        submodules: 'true'

-    - name: 'Get version from CMakeLists.txt'
-      id: get_version
-      run: |
-        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
-        echo "VERSION=$VERSION" >> $GITHUB_ENV
-        echo "Version: $VERSION"
-
-    # - name: 'Setup ccache'
-    #   uses: hendrikmuhs/ccache-action@v1.2
+    - name: 'Setup ccache'
+      uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Setup Java'
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: '17'
-        # cache: 'gradle'
+        cache: 'gradle'

    - name: 'Setup Android NDK'
      id: setup-ndk
@@ -669,44 +523,35 @@ jobs:
      shell: bash
      run: ./deploy/build_android.sh --aab --apk all --build-platform ${{ env.ANDROID_BUILD_PLATFORM }}

-    - name: 'Rename Android APKs'
-      run: |
-        cd deploy/build
-        mv AmneziaVPN-x86_64-release.apk AmneziaVPN_${VERSION}_android9+_x86_64.apk
-        mv AmneziaVPN-x86-release.apk AmneziaVPN_${VERSION}_android9+_x86.apk
-        mv AmneziaVPN-arm64-v8a-release.apk AmneziaVPN_${VERSION}_android9+_arm64-v8a.apk
-        mv AmneziaVPN-armeabi-v7a-release.apk AmneziaVPN_${VERSION}_android9+_armeabi-v7a.apk
-        cd ../..
-
    - name: 'Upload x86_64 apk'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_android9+_x86_64.apk
-        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_x86_64.apk
+        name: AmneziaVPN-android-x86_64
+        path: deploy/build/AmneziaVPN-x86_64-release.apk
        compression-level: 0
        retention-days: 7

    - name: 'Upload x86 apk'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_android9+_x86.apk
-        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_x86.apk
+        name: AmneziaVPN-android-x86
+        path: deploy/build/AmneziaVPN-x86-release.apk
        compression-level: 0
        retention-days: 7

    - name: 'Upload arm64-v8a apk'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_android9+_arm64-v8a.apk
-        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_arm64-v8a.apk
+        name: AmneziaVPN-android-arm64-v8a
+        path: deploy/build/AmneziaVPN-arm64-v8a-release.apk
        compression-level: 0
        retention-days: 7

    - name: 'Upload armeabi-v7a apk'
      uses: actions/upload-artifact@v4
      with:
-        name: AmneziaVPN_${{ env.VERSION }}_android9+_armeabi-v7a.apk
-        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_armeabi-v7a.apk
+        name: AmneziaVPN-android-armeabi-v7a
+        path: deploy/build/AmneziaVPN-armeabi-v7a-release.apk
        compression-level: 0
        retention-days: 7

@@ -17,7 +17,6 @@ jobs:
      QIF_VERSION: 4.5
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -24,7 +24,7 @@ jobs:
      - name: Verify git tag
        run: |
          TAG_NAME=${{ inputs.RELEASE_VERSION }}
-          CMAKE_TAG=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*/\1/')
+          CMAKE_TAG=$(grep 'project.*VERSION' CMakeLists.txt | sed -E 's/.* ([0-9]+.[0-9]+.[0-9]+.[0-9]+)$/\1/')
          if [[ "$TAG_NAME" == "$CMAKE_TAG" ]]; then
            echo "Git tag ($TAG_NAME) matches CMakeLists.txt version ($CMAKE_TAG)."
          else
@@ -9,7 +9,6 @@ deploy/build_32/*
 deploy/build_64/*
 winbuild*.bat
 .cache/
-.vscode/


 # Qt-es
@@ -140,6 +139,3 @@ ios-ne-build.sh
 macos-ne-build.sh
 macos-signed-build.sh
 macos-with-sign-build.sh
-DeveloperIdApplicationCertificate.p12
-DeveloperIdInstallerCertificate.p12
-
@@ -14,7 +14,3 @@
 [submodule "client/3rd/QSimpleCrypto"]
 	path = client/3rd/QSimpleCrypto
 	url = https://github.com/amnezia-vpn/QSimpleCrypto.git
-[submodule "client/3rd/qtgamepad"]
-	path = client/3rd/qtgamepad
-	url = https://github.com/amnezia-vpn/qtgamepad.git
-	branch = 6.6
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)

 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.8.15.4)
+set(AMNEZIAVPN_VERSION 4.8.9.1)

 project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
        DESCRIPTION "AmneziaVPN"
@@ -12,7 +12,7 @@ string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")

 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2120)
+set(APP_ANDROID_VERSION_CODE 2091)

 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
    set(MZ_PLATFORM_NAME "linux")
@@ -29,59 +29,17 @@ elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Emscripten")
 endif()

 set(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
-set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)

-if(APPLE)
-    if(IOS)
-        set(CMAKE_OSX_ARCHITECTURES "arm64")
-    elseif(MACOS_NE)
-        set(CMAKE_OSX_ARCHITECTURES "arm64;x86_64")
-    else()
-        set(CMAKE_OSX_ARCHITECTURES "x86_64")
-    endif()
+if(APPLE AND NOT IOS)
+    set(CMAKE_OSX_ARCHITECTURES "x86_64")
 endif()

 add_subdirectory(client)

-if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+if(NOT IOS AND NOT ANDROID)
    add_subdirectory(service)

    include(${CMAKE_SOURCE_DIR}/deploy/installer/config.cmake)
 endif()
-
-set(AMNEZIA_STAGE_DIR "${CMAKE_BINARY_DIR}/stage")
-
-if(WIN32 AND NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
-    file(TO_CMAKE_PATH "${AMNEZIA_STAGE_DIR}" AMNEZIA_STAGE_DIR_CMAKE)
-
-    set(CPACK_GENERATOR "WIX")
-    set(CPACK_WIX_VERSION 4)
-    set(CPACK_PACKAGE_NAME "AmneziaVPN")
-    set(CPACK_PACKAGE_VENDOR "AmneziaVPN")
-    set(CPACK_PACKAGE_VERSION ${AMNEZIAVPN_VERSION})
-    set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "AmneziaVPN client")
-    set(AMNEZIA_LICENSE_TXT "${CMAKE_BINARY_DIR}/LICENSE.txt")
-    configure_file("${CMAKE_SOURCE_DIR}/LICENSE" "${AMNEZIA_LICENSE_TXT}" COPYONLY)
-    set(CPACK_RESOURCE_FILE_LICENSE "${AMNEZIA_LICENSE_TXT}")
-    set(CPACK_PACKAGE_INSTALL_DIRECTORY "AmneziaVPN")
-    set(CPACK_PACKAGE_DIRECTORY "${CMAKE_BINARY_DIR}")
-    set(CPACK_PACKAGE_EXECUTABLES "AmneziaVPN" "AmneziaVPN")
-    set(CPACK_WIX_UPGRADE_GUID "{2D55AC62-96D6-4692-8C05-0D85BBF95485}")
-    set(CPACK_WIX_PRODUCT_ICON "${CMAKE_SOURCE_DIR}/client/images/app.ico")
-
-    # WiX patches
-    set(_AMNEZIA_WIX_PATCH_SERVICE "${CMAKE_SOURCE_DIR}/deploy/installer/wix/service_install_patch.xml")
-    set(_AMNEZIA_WIX_PATCH_CLOSE_APP "${CMAKE_SOURCE_DIR}/deploy/installer/wix/close_client_patch.xml")
-    file(TO_CMAKE_PATH "${_AMNEZIA_WIX_PATCH_SERVICE}" _AMNEZIA_WIX_PATCH_SERVICE_CMAKE)
-    file(TO_CMAKE_PATH "${_AMNEZIA_WIX_PATCH_CLOSE_APP}" _AMNEZIA_WIX_PATCH_CLOSE_APP_CMAKE)
-    set(CPACK_WIX_PATCH_FILE "${_AMNEZIA_WIX_PATCH_SERVICE_CMAKE};${_AMNEZIA_WIX_PATCH_CLOSE_APP_CMAKE}")
-
-    # WiX v4 Util extension for CloseApplication + namespace for util
-    set(CPACK_WIX_EXTENSIONS "${CPACK_WIX_EXTENSIONS};WixToolset.Util.wixext")
-    set(CPACK_WIX_CUSTOM_XMLNS "util=http://wixtoolset.org/schemas/v4/wxs/util")
-
-    set(CPACK_INSTALLED_DIRECTORIES "${AMNEZIA_STAGE_DIR_CMAKE};/")
-
-    include(CPack)
-endif()
@@ -9,17 +9,17 @@
 ### [English]([https://github.com/amnezia-vpn/amnezia-client/blob/dev/README_RU.md](https://github.com/amnezia-vpn/amnezia-client/tree/dev?tab=readme-ov-file#)) | [Русский](https://github.com/amnezia-vpn/amnezia-client/blob/dev/README_RU.md)


-[Amnezia](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en) is an open-source VPN client, with a key feature that enables you to deploy your own VPN server on your server.
+[Amnezia](https://amnezia.org) is an open-source VPN client, with a key feature that enables you to deploy your own VPN server on your server.

 [![Image](https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/uipic4.png)](https://amnezia.org)

-### [Website](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en) | [Alt website link](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en-mirror) | [Documentation](https://docs.amnezia.org) | [Troubleshooting](https://docs.amnezia.org/troubleshooting)
+### [Website](https://amnezia.org) | [Alt website link](https://storage.googleapis.com/amnezia/amnezia.org) | [Documentation](https://docs.amnezia.org) | [Troubleshooting](https://docs.amnezia.org/troubleshooting)

 > [!TIP]
-> If the [Amnezia website](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en) is blocked in your region, you can use an [Alternative website link](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-en-mirror).
+> If the [Amnezia website](https://amnezia.org) is blocked in your region, you can use an [Alternative website link](https://storage.googleapis.com/amnezia/amnezia.org ).

-<a href="https://amnezia.org/en/downloads?utm_source=github&utm_campaign=amnezia_button-readme-en"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-website.svg" width="150" style="max-width: 100%; margin-right: 10px"></a>
-<a href="https://storage.googleapis.com/amnezia/amnezia.org?m-path=/en/downloads&utm_source=github&utm_campaign=amnezia_button-readme-en-mirrow"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-alt.svg" width="150" style="max-width: 100%;"></a>
+<a href="https://amnezia.org/downloads"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-website.svg" width="150" style="max-width: 100%; margin-right: 10px"></a>
+<a href="https://storage.googleapis.com/amnezia/q9p19109"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-alt.svg" width="150" style="max-width: 100%;"></a>

 [All releases](https://github.com/amnezia-vpn/amnezia-client/releases)

@@ -179,7 +179,7 @@ You may face compiling issues in QT Creator after you've worked in Android Studi

 ## License

-This project is licensed under the GNU General Public License v3.0 (see LICENSE) and also includes third-party components distributed under their own terms (see THIRD_PARTY_LICENSES.md).
+GPL v3.0

 ## Donate

@@ -6,16 +6,16 @@
 [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/amnezia-vpn/amnezia-client)

 ### [English](https://github.com/amnezia-vpn/amnezia-client/blob/dev/README.md) | Русский
-[AmneziaVPN](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru) — это open source VPN-клиент, ключевая особенность которого заключается в возможности развернуть собственный VPN на вашем сервере.
+[AmneziaVPN](https://amnezia.org) — это open source VPN-клиент, ключевая особенность которого заключается в возможности развернуть собственный VPN на вашем сервере.

 [![Image](https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/uipic4.png)](https://amnezia.org)

-### [Сайт](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru) | [Зеркало сайта](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru-mirror) | [Документация](https://docs.amnezia.org) | [Решение проблем](https://docs.amnezia.org/troubleshooting)
+### [Сайт](https://amnezia.org) | [Зеркало сайта](https://storage.googleapis.com/amnezia/amnezia.org) | [Документация](https://docs.amnezia.org) | [Решение проблем](https://docs.amnezia.org/troubleshooting)

 > [!TIP]
-> Если [сайт Amnezia](https://amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru) заблокирован в вашем регионе, вы можете воспользоваться [ссылкой на зеркало](https://storage.googleapis.com/amnezia/amnezia.org?utm_source=github&utm_campaign=amnezia_website-readme-ru-mirror).
+> Если [сайт Amnezia](https://amnezia.org) заблокирован в вашем регионе, вы можете воспользоваться [ссылкой на зеркало](https://storage.googleapis.com/amnezia/amnezia.org).

-<a href="https://storage.googleapis.com/amnezia/amnezia.org?m-path=/ru/downloads&utm_source=github&utm_campaign=amnezia_button-readme-ru-mirror"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-website-ru.svg" width="150" style="max-width: 100%; margin-right: 10px"></a>
+<a href="https://storage.googleapis.com/amnezia/q9p19109"><img src="https://github.com/amnezia-vpn/amnezia-client/blob/dev/metadata/img-readme/download-website-ru.svg" width="150" style="max-width: 100%; margin-right: 10px"></a>


 [Все релизы](https://github.com/amnezia-vpn/amnezia-client/releases)
@@ -1,149 +0,0 @@
-# Third-Party Licenses
-
-This project is licensed under the GNU General Public License v3.0.
-This file lists third-party software components used by this repository.
-Each component is distributed under its own license as linked below.
-
---
-
-## QtKeychain
-
- Source: https://github.com/frankosterfeld/qtkeychain
- License: BSD License
- License Text: https://www.gnu.org/licenses/license-list.html#ModifiedBSD
-
---
-
-## QSimpleCrypto
-
- Source: https://github.com/n1flh31mur/QSimpleCrypto
- License: Apache License 2.0
- License Text: https://github.com/n1flh31mur/QSimpleCrypto/blob/master/LICENSE
-
---
-
-## SortFilterProxyModel
-
- Source: https://github.com/oKcerG/SortFilterProxyModel
- License: MIT License
- License Text: https://github.com/oKcerG/SortFilterProxyModel/blob/master/LICENSE
-
---
-
-## QJsonStruct
-
- Source: https://github.com/Qv2ray/QJsonStruct
- License: MIT License
- License Text: https://github.com/Qv2ray/QJsonStruct/blob/master/LICENSE
-
---
-
-## QR Code Generator (qrcodegen)
-
- Source: https://github.com/nayuki/QR-Code-generator
- License: MIT License
- License Text: https://www.nayuki.io/page/qr-code-generator-library
-
---
-
-## Qt Gamepad
-
- Source: https://github.com/qt/qtgamepad
- License: GNU General Public License v3.0 (GPL-3.0)
- License Text: https://www.gnu.org/licenses/gpl-3.0.en.html
-
---
-
-## AmneziaWG Apple (WireGuard)
-
- Source: https://github.com/amnezia-vpn/amneziawg-apple
- License: MIT License
- License Text: https://github.com/amnezia-vpn/amneziawg-apple/blob/master/COPYING
-
---
-
-## AmneziaWG Android
-
- Source: https://github.com/amnezia-vpn/amneziawg-go
- License: MIT License
- License Text: https://github.com/amnezia-vpn/amneziawg-go/blob/master/LICENSE
-
---
-
-## Xray Core
-
- Source: https://github.com/XTLS/Xray-core
- License: Mozilla Public License 2.0 (MPL-2.0)
- License Text: https://github.com/XTLS/Xray-core/blob/main/LICENSE
-
---
-
-## Cloak
-
- Source: https://github.com/cbeuw/Cloak
- License: GNU General Public License v3.0 (GPL-3.0)
- License Text: https://github.com/cbeuw/Cloak/blob/master/LICENSE
-
---
-
-## Shadowsocks
-
- Source: https://github.com/shadowsocks/shadowsocks-libev
- License: GPL-3.0-or-later
- License Text: http://www.gnu.org/licenses/
-
---
-
-## OpenSSL
-
- Source: https://github.com/openssl/openssl
- License: Apache License 2.0
- License Text: https://www.openssl.org/source/license.html
-
---
-
-## libssh
-
- Source: https://www.libssh.org/
- License: GNU Lesser General Public License (LGPL)
- License Text: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
-
---
-
-## OpenVPNAdapter
-
- Source: https://github.com/ss-abramchuk/OpenVPNAdapter
- License: GNU Affero General Public License v3.0 (AGPL-3.0)
- License Text: https://github.com/ss-abramchuk/OpenVPNAdapter/blob/master/LICENSE
-
---
-
-## Wintun
-
- Source: https://www.wintun.net/
- License: Prebuilt Binaries License
- License Text: https://github.com/WireGuard/wintun/blob/master/prebuilt-binaries-license.txt
-
---
-
-## Mullvad Split Tunnel Driver
-
- Source: https://github.com/mullvad/win-split-tunnel
- License: GNU General Public License v3.0 (GPL-3.0) and Mozilla Public License Version 2.0
- License Text: https://github.com/mullvad/win-split-tunnel/blob/master/LICENSE-GPL.md https://github.com/mullvad/win-split-tunnel/blob/master/LICENSE-MPL.txt
-
---
-
-## tun2socks
-
- Source: https://github.com/eycorsican/go-tun2socks
- License: MIT License
- License Text: https://github.com/eycorsican/go-tun2socks/blob/master/LICENSE
-
---
-
-## TAP-Windows Driver
-
- Source: https://github.com/OpenVPN/tap-windows6
- License: tap-windows6 license
- License Text: https://github.com/OpenVPN/tap-windows6/blob/master/COPYING
@@ -3,6 +3,7 @@ cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)
 set(PROJECT AmneziaVPN)
 project(${PROJECT})

+
 set_property(GLOBAL PROPERTY USE_FOLDERS ON)
 set_property(GLOBAL PROPERTY AUTOGEN_TARGETS_FOLDER "Autogen")
 set_property(GLOBAL PROPERTY AUTOMOC_TARGETS_FOLDER "Autogen")
@@ -25,7 +26,6 @@ add_definitions(-DGIT_COMMIT_HASH="${GIT_COMMIT_HASH}")

 add_definitions(-DPROD_AGW_PUBLIC_KEY="$ENV{PROD_AGW_PUBLIC_KEY}")
 add_definitions(-DPROD_S3_ENDPOINT="$ENV{PROD_S3_ENDPOINT}")
-add_definitions(-DFALLBACK_S3_ENDPOINT="$ENV{FALLBACK_S3_ENDPOINT}")

 add_definitions(-DDEV_AGW_PUBLIC_KEY="$ENV{DEV_AGW_PUBLIC_KEY}")
 add_definitions(-DDEV_AGW_ENDPOINT="$ENV{DEV_AGW_ENDPOINT}")
@@ -53,21 +53,14 @@ endif()

 qt_standard_project_setup()
 qt_add_executable(${PROJECT} MANUAL_FINALIZATION)
-target_include_directories(${PROJECT} PUBLIC
-    $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>
-)

-if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
+if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_interface.rep)
    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_interface.rep)
+    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_tun2socks.rep)
 endif()

-qt6_add_resources(QRC ${QRC}
-    ${CMAKE_CURRENT_LIST_DIR}/images/images.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/images/flagKit.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/ui/qml/qml.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/server_scripts/serverScripts.qrc
-)
+qt6_add_resources(QRC ${QRC} ${CMAKE_CURRENT_LIST_DIR}/resources.qrc)

 # -- i18n begin
 set(CMAKE_AUTORCC ON)
@@ -84,7 +77,6 @@ set(AMNEZIAVPN_TS_FILES
 )

 file(GLOB_RECURSE AMNEZIAVPN_TS_SOURCES *.qrc *.cpp *.h *.ui)
-list(FILTER AMNEZIAVPN_TS_SOURCES EXCLUDE REGEX "qtgamepad/examples")

 qt_create_translation(AMNEZIAVPN_QM_FILES ${AMNEZIAVPN_TS_SOURCES} ${AMNEZIAVPN_TS_FILES})

@@ -118,15 +110,6 @@ include_directories(
    ${CMAKE_CURRENT_BINARY_DIR}
 )

-if(MACOS_NE)
-    message("MACOS_NE is ON")
-    add_definitions(-DQ_OS_MAC)
-    add_definitions(-DMACOS_NE)
-    message("Add macros for MacOS Network Extension")
-else()
-    message("MACOS_NE is OFF")
-endif()
-
 include_directories(mozilla)
 include_directories(mozilla/shared)
 include_directories(mozilla/models)
@@ -156,7 +139,7 @@ if(WIN32)
 endif()

 if(APPLE)
-    cmake_policy(SET CMP0099 NEW)
+    cmake_policy(SET CMP0099 OLD)
    cmake_policy(SET CMP0114 NEW)

    if(NOT BUILD_OSX_APP_IDENTIFIER)
@@ -175,6 +158,7 @@ if(APPLE)
    set(CMAKE_XCODE_GENERATE_SCHEME FALSE)
    set(CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM ${BUILD_VPN_DEVELOPMENT_TEAM})
    set(CMAKE_XCODE_ATTRIBUTE_GROUP_ID_IOS ${BUILD_IOS_GROUP_IDENTIFIER})
+
 endif()

 if(LINUX AND NOT ANDROID)
@@ -182,7 +166,8 @@ if(LINUX AND NOT ANDROID)
    link_directories(${CMAKE_CURRENT_LIST_DIR}/platforms/linux)
 endif()

-if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
+if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
+    message("Client desktop build")
    add_compile_definitions(AMNEZIA_DESKTOP)
 endif()

@@ -193,9 +178,7 @@ endif()
 if(IOS)
    include(cmake/ios.cmake)
    include(cmake/ios-arch-fixup.cmake)
-elseif(APPLE AND MACOS_NE)
-    include(cmake/macos_ne.cmake)
-elseif(APPLE)
+elseif(APPLE AND NOT IOS)
    include(cmake/osxtools.cmake)
    include(cmake/macos.cmake)
 endif()
@@ -216,7 +199,7 @@ elseif(APPLE AND NOT IOS)
    set(DEPLOY_PLATFORM_PATH "macos")
 endif()

-if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+if(NOT IOS AND NOT ANDROID)
    add_custom_command(
        TARGET ${PROJECT} POST_BUILD
        COMMAND ${CMAKE_COMMAND} -E $<IF:$<CONFIG:Debug>,copy_directory,true>
@@ -231,22 +214,8 @@ if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
        $<TARGET_FILE_DIR:${PROJECT}>
        COMMAND_EXPAND_LISTS
    )
-endif()

-if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
-    add_subdirectory(tests)
 endif()

-list(APPEND SOURCES ${CMAKE_CURRENT_LIST_DIR}/main.cpp)
-
 target_sources(${PROJECT} PRIVATE ${SOURCES} ${HEADERS} ${RESOURCES} ${QRC} ${I18NQRC})
-
-# Finalize the executable so Qt can gather/deploy QML modules and plugins correctly (Android needs this).
-if(COMMAND qt_import_qml_plugins)
-    qt_import_qml_plugins(${PROJECT})
-endif()
-if(COMMAND qt_finalize_executable)
-    qt_finalize_executable(${PROJECT})
-else()
-    qt_finalize_target(${PROJECT})
-endif()
+qt_finalize_target(${PROJECT})
@@ -1,4 +1,4 @@
-#include "amneziaApplication.h"
+#include "amnezia_application.h"

 #include <QClipboard>
 #include <QFontDatabase>
@@ -12,30 +12,18 @@
 #include <QTextDocument>
 #include <QTimer>
 #include <QTranslator>
-#include <QEvent>
-#include <QDir>
-#include <QSettings>
-#include <QtQuick/QQuickWindow>  
-#include <QWindow>     

-#include "core/protocols/qmlRegisterProtocols.h"
 #include "logger.h"
-#include "ui/controllers/qml/pageController.h"
+#include "ui/controllers/pageController.h"
 #include "ui/models/installedAppsModel.h"
 #include "version.h"

 #include "platforms/ios/QRCodeReaderBase.h"
-         

-bool AmneziaApplication::m_forceQuit = false;
+#include "protocols/qml_register_protocols.h"

-AmneziaApplication::AmneziaApplication(int &argc, char *argv[]) : AMNEZIA_BASE_CLASS(argc, argv),
-      m_optAutostart({QStringLiteral("a"), QStringLiteral("autostart")}, QStringLiteral("System autostart")),
-      m_optCleanup  ({QStringLiteral("c"), QStringLiteral("cleanup")}, QStringLiteral("Cleanup logs")),
-      m_optConnect  ({QStringLiteral("connect")}, QStringLiteral("Connect to server by index on startup"), QStringLiteral("index")),
-      m_optImport   ({QStringLiteral("import")}, QStringLiteral("Import configuration from data string"), QStringLiteral("data"))
+AmneziaApplication::AmneziaApplication(int &argc, char *argv[]) : AMNEZIA_BASE_CLASS(argc, argv)
 {
-    setDesktopFileName(QStringLiteral(APPLICATION_NAME));
    setQuitOnLastWindowClosed(false);

    // Fix config file permissions
@@ -54,107 +42,59 @@ AmneziaApplication::AmneziaApplication(int &argc, char *argv[]) : AMNEZIA_BASE_C
    QFile::setPermissions(configLoc2, QFileDevice::ReadOwner | QFileDevice::WriteOwner);
 #endif

-    m_settings = new SecureQSettings(ORGANIZATION_NAME, APPLICATION_NAME, this);
+    m_settings = std::shared_ptr<Settings>(new Settings);
    m_nam = new QNetworkAccessManager(this);
 }

 AmneziaApplication::~AmneziaApplication()
 {
-#ifdef AMNEZIA_DESKTOP
-    if (m_vpnConnection && m_vpnConnectionThread.isRunning()) {
-        QMetaObject::invokeMethod(m_vpnConnection.get(), "disconnectSlots", Qt::BlockingQueuedConnection);
-        
-        QMetaObject::invokeMethod(m_vpnConnection.get(), "disconnectFromVpn", Qt::BlockingQueuedConnection);
-    }
-#endif
-
-    m_vpnConnectionThread.requestInterruption();
    m_vpnConnectionThread.quit();
-
-    if (!m_vpnConnectionThread.wait(3000)) {
-        m_vpnConnectionThread.terminate();
-        m_vpnConnectionThread.wait(500);
-    }
+    m_vpnConnectionThread.wait(3000);

    if (m_engine) {
+        QObject::disconnect(m_engine, 0, 0, 0);
        delete m_engine;
    }
 }

-#ifdef Q_OS_ANDROID
-namespace {
-    static void clearQtCaches()
-    {
-        const QString cacheRoot = QStandardPaths::writableLocation(QStandardPaths::CacheLocation);
-        if (!cacheRoot.isEmpty()) {
-            QDir(cacheRoot + "/QtShaderCache").removeRecursively();
-            QDir(cacheRoot + "/qmlcache").removeRecursively();
-        }
-    }
-}
-#endif
-
 void AmneziaApplication::init()
 {
    m_engine = new QQmlApplicationEngine;

    const QUrl url(QStringLiteral("qrc:/ui/qml/main2.qml"));
    QObject::connect(
-        m_engine, &QQmlApplicationEngine::objectCreated, this,
-        [this, url](QObject *obj, const QUrl &objUrl) {
-            if (!obj && url == objUrl) {
-                QCoreApplication::exit(-1);
-                return;
-            }
-            // install filter on main window
-            if (auto win = qobject_cast<QQuickWindow*>(obj)) {
-                win->installEventFilter(this);
-#ifdef Q_OS_ANDROID
-                QObject::connect(win, &QQuickWindow::sceneGraphError,
-                    [](QQuickWindow::SceneGraphError, const QString &msg) {
-                        qWarning() << "Scene graph error (suppressed):" << msg;
-                    });
-                // Keep graphics context alive across hide/show cycles to avoid
-                // eglSwapBuffers/makeCurrent being called on a context Android has reclaimed.
-                win->setPersistentSceneGraph(true);
-                win->setPersistentGraphics(true);
-#endif
-                win->show();
-            }
-        },
-        Qt::QueuedConnection);
+            m_engine, &QQmlApplicationEngine::objectCreated, this,
+            [url](QObject *obj, const QUrl &objUrl) {
+                if (!obj && url == objUrl)
+                    QCoreApplication::exit(-1);
+            },
+            Qt::QueuedConnection);

    m_engine->rootContext()->setContextProperty("Debug", &Logger::Instance());

-#ifdef MACOS_NE
-    m_engine->rootContext()->setContextProperty("IsMacOsNeBuild", true);
-#else
-    m_engine->rootContext()->setContextProperty("IsMacOsNeBuild", false);
-#endif
-
-    m_vpnConnection.reset(new VpnConnection(nullptr, nullptr));
+    m_vpnConnection.reset(new VpnConnection(m_settings));
    m_vpnConnection->moveToThread(&m_vpnConnectionThread);
    m_vpnConnectionThread.start();

    m_coreController.reset(new CoreController(m_vpnConnection, m_settings, m_engine));

    m_engine->addImportPath("qrc:/ui/qml/Modules/");
-
-    if (m_parser.isSet(m_optImport)) {
-        const QString data = m_parser.value(m_optImport);
-        if (!data.isEmpty()) {
-            if (m_coreController) {
-                m_coreController->importConfigFromData(data);
-            }
-        }
-    }
-
    m_engine->load(url);

    m_coreController->setQmlRoot();

+    bool enabled = m_settings->isSaveLogs();
+#ifndef Q_OS_ANDROID
+    if (enabled) {
+        if (!Logger::init(false)) {
+            qWarning() << "Initialization of debug subsystem failed";
+        }
+    }
+#endif
+    Logger::setServiceLogsEnabled(enabled);
+
 #ifdef Q_OS_WIN //TODO
-    if (m_parser.isSet(m_optAutostart))
+    if (m_parser.isSet("a"))
        m_coreController->pageController()->showOnStartup();
    else
        emit m_coreController->pageController()->raiseMainWindow();
@@ -178,18 +118,6 @@ void AmneziaApplication::init()
        }
    });
 #endif
-
-    if (m_parser.isSet(m_optConnect)) {
-        bool ok = false;
-        int idx = m_parser.value(m_optConnect).toInt(&ok);
-        if (ok) {
-            QTimer::singleShot(0, this, [this, idx]() {
-                if (m_coreController) {
-                    m_coreController->openConnectionByIndex(idx);
-                }
-            });
-        }
-    }
 }

 void AmneziaApplication::registerTypes()
@@ -197,11 +125,13 @@ void AmneziaApplication::registerTypes()
    qRegisterMetaType<ServerCredentials>("ServerCredentials");

    qRegisterMetaType<DockerContainer>("DockerContainer");
-    using namespace amnezia::ProtocolEnumNS;
    qRegisterMetaType<TransportProto>("TransportProto");
    qRegisterMetaType<Proto>("Proto");
    qRegisterMetaType<ServiceType>("ServiceType");

+    declareQmlProtocolEnum();
+    declareQmlContainerEnum();
+
    qmlRegisterType<QRCodeReader>("QRCodeReader", 1, 0, "QRCodeReader");

    m_containerProps.reset(new ContainerProps());
@@ -215,7 +145,6 @@ void AmneziaApplication::registerTypes()

    qmlRegisterType<InstalledAppsModel>("InstalledAppsModel", 1, 0, "InstalledAppsModel");

-    amnezia::declareQmlProtocolEnum();
    Vpn::declareQmlVpnConnectionStateEnum();
    PageLoader::declareQmlPageEnum();
 }
@@ -233,14 +162,15 @@ bool AmneziaApplication::parseCommands()
    m_parser.addHelpOption();
    m_parser.addVersionOption();

-    m_parser.addOption(m_optAutostart);
-    m_parser.addOption(m_optCleanup);
-    m_parser.addOption(m_optConnect);
-    m_parser.addOption(m_optImport);
-    
+    QCommandLineOption c_autostart { { "a", "autostart" }, "System autostart" };
+    m_parser.addOption(c_autostart);
+
+    QCommandLineOption c_cleanup { { "c", "cleanup" }, "Cleanup logs" };
+    m_parser.addOption(c_cleanup);
+
    m_parser.process(*this);

-    if (m_parser.isSet(m_optCleanup)) {
+    if (m_parser.isSet(c_cleanup)) {
        Logger::cleanUp();
        QTimer::singleShot(100, this, [this] { quit(); });
        exec();
@@ -249,8 +179,9 @@ bool AmneziaApplication::parseCommands()
    return true;
 }

-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
-void AmneziaApplication::startLocalServer() {
+#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
+void AmneziaApplication::startLocalServer()
+{
    const QString serverName("AmneziaVPNInstance");
    QLocalServer::removeServer(serverName);

@@ -267,32 +198,6 @@ void AmneziaApplication::startLocalServer() {
 }
 #endif

-bool AmneziaApplication::eventFilter(QObject *watched, QEvent *event)
-{
-    if (event->type() == QEvent::Close) {
-#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
-        quit();
-#else
-        if (m_forceQuit) {
-            quit();
-        } else {
-            if (m_coreController && m_coreController->pageController()) {
-                m_coreController->pageController()->hideMainWindow();
-            }
-        }
-#endif
-        return true; // eat the close
-    }
-    // call base QObject::eventFilter
-    return QObject::eventFilter(watched, event);
-}
-
-void AmneziaApplication::forceQuit()
-{
-    m_forceQuit = true;
-    quit();
-}
-
 QQmlApplicationEngine *AmneziaApplication::qmlEngine() const
 {
    return m_engine;
@@ -7,24 +7,22 @@
 #include <QQmlContext>
 #include <QThread>
 #if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
-  #include <QGuiApplication>
+    #include <QGuiApplication>
 #else
-  #include <QApplication>
+    #include <QApplication>
 #endif
 #include <QClipboard>

 #include "core/controllers/coreController.h"
-#include "secureQSettings.h"
-#include "vpnConnection.h"
-#include "ui/models/containerProps.h"
-#include "ui/models/protocolProps.h"
+#include "settings.h"
+#include "vpnconnection.h"

 #define amnApp (static_cast<AmneziaApplication *>(QCoreApplication::instance()))

 #if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
-  #define AMNEZIA_BASE_CLASS QGuiApplication
+    #define AMNEZIA_BASE_CLASS QGuiApplication
 #else
-  #define AMNEZIA_BASE_CLASS QApplication
+    #define AMNEZIA_BASE_CLASS QApplication
 #endif

 class AmneziaApplication : public AMNEZIA_BASE_CLASS
@@ -39,7 +37,7 @@ public:
    void loadFonts();
    bool parseCommands();

-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
+#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
    void startLocalServer();
 #endif

@@ -47,13 +45,9 @@ public:
    QNetworkAccessManager *networkManager();
    QClipboard *getClipboard();

-public slots:
-    void forceQuit();
-
 private:
-    static bool m_forceQuit;
    QQmlApplicationEngine *m_engine {};
-    SecureQSettings* m_settings;
+    std::shared_ptr<Settings> m_settings;

    QScopedPointer<CoreController> m_coreController;

@@ -62,17 +56,10 @@ private:

    QCommandLineParser m_parser;

-    QCommandLineOption m_optAutostart;
-    QCommandLineOption m_optCleanup;
-    QCommandLineOption m_optConnect;
-    QCommandLineOption m_optImport;
-
    QSharedPointer<VpnConnection> m_vpnConnection;
    QThread m_vpnConnectionThread;

    QNetworkAccessManager *m_nam;
-protected:
-    bool eventFilter(QObject *watched, QEvent *event) override;
 };

 #endif // AMNEZIA_APPLICATION_H
@@ -45,8 +45,7 @@
            android:configChanges="uiMode|screenSize|smallestScreenSize|screenLayout|orientation|density
                |fontScale|layoutDirection|locale|keyboard|keyboardHidden|navigation|mcc|mnc"
            android:launchMode="singleInstance"
-            android:windowSoftInputMode="adjustResize|stateUnchanged"
-            android:enableOnBackInvokedCallback="false"
+            android:windowSoftInputMode="stateUnchanged|adjustResize"
            android:exported="true">

            <intent-filter>
@@ -215,4 +214,4 @@
            <meta-data android:name="android.support.FILE_PROVIDER_PATHS" android:resource="@xml/qtprovider_paths" />
        </provider>
    </application>
-</manifest>
+</manifest>
@@ -111,6 +111,7 @@ dependencies {
    implementation(project(":wireguard"))
    implementation(project(":awg"))
    implementation(project(":openvpn"))
+    implementation(project(":cloak"))
    implementation(project(":xray"))
    implementation(libs.androidx.core)
    implementation(libs.androidx.activity)
@@ -0,0 +1,18 @@
+plugins {
+    id(libs.plugins.android.library.get().pluginId)
+    id(libs.plugins.kotlin.android.get().pluginId)
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+android {
+    namespace = "org.amnezia.vpn.protocol.cloak"
+}
+
+dependencies {
+    compileOnly(project(":utils"))
+    compileOnly(project(":protocolApi"))
+    implementation(project(":openvpn"))
+}
@@ -0,0 +1,45 @@
+package org.amnezia.vpn.protocol.cloak
+
+import android.util.Base64
+import net.openvpn.ovpn3.ClientAPI_Config
+import org.amnezia.vpn.protocol.openvpn.OpenVpn
+import org.amnezia.vpn.util.LibraryLoader.loadSharedLibrary
+import org.json.JSONObject
+
+class Cloak : OpenVpn() {
+
+    override fun internalInit() {
+        super.internalInit()
+        if (!isInitialized) loadSharedLibrary(context, "ck-ovpn-plugin")
+    }
+
+    override fun parseConfig(config: JSONObject): ClientAPI_Config {
+        val openVpnConfig = ClientAPI_Config()
+
+        val openVpnConfigStr = config.getJSONObject("openvpn_config_data").getString("config")
+        val cloakConfigJson = checkCloakJson(config.getJSONObject("cloak_config_data"))
+        val cloakConfigStr = Base64.encodeToString(cloakConfigJson.toString().toByteArray(), Base64.DEFAULT)
+
+        val configStr = "$openVpnConfigStr\n<cloak>\n$cloakConfigStr\n</cloak>\n"
+
+        openVpnConfig.usePluggableTransports = true
+        openVpnConfig.content = configStr
+        return openVpnConfig
+    }
+
+    private fun checkCloakJson(cloakConfigJson: JSONObject): JSONObject {
+        cloakConfigJson.put("NumConn", 1)
+        cloakConfigJson.put("ProxyMethod", "openvpn")
+        if (cloakConfigJson.has("port")) {
+            val port = cloakConfigJson["port"]
+            cloakConfigJson.remove("port")
+            cloakConfigJson.put("RemotePort", port)
+        }
+        if (cloakConfigJson.has("remote")) {
+            val remote = cloakConfigJson["remote"]
+            cloakConfigJson.remove("remote")
+            cloakConfigJson.put("RemoteHost", remote)
+        }
+        return cloakConfigJson
+    }
+}
@@ -93,7 +93,7 @@ open class OpenVpn : Protocol() {
        openVpnClient = null
    }

-    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
+    override fun reconnectVpn(vpnBuilder: Builder) {
        openVpnClient?.let {
            it.establish = makeEstablish(vpnBuilder)
            it.reconnect(0)
@@ -42,7 +42,7 @@ abstract class Protocol {

    abstract fun stopVpn()

-    abstract fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean)
+    abstract fun reconnectVpn(vpnBuilder: Builder)

    protected fun ProtocolConfig.Builder.configSplitTunneling(config: JSONObject) {
        if (!allowSplitTunneling) {
@@ -6,9 +6,6 @@
        <item name="android:colorBackground">@color/black</item>
        <item name="android:windowActionBar">false</item>
        <item name="android:windowNoTitle">true</item>
-        <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
-        <item name="android:enforceNavigationBarContrast">false</item>
-        <item name="android:enforceStatusBarContrast">false</item>
    </style>
    <style name="Translucent" parent="NoActionBar">
        <item name="android:windowBackground">@android:color/transparent</item>
@@ -35,6 +35,7 @@ include(":protocolApi")
 include(":wireguard")
 include(":awg")
 include(":openvpn")
+include(":cloak")
 include(":xray")
 include(":xray:libXray")

@@ -26,8 +26,6 @@ import android.os.ParcelFileDescriptor
 import android.os.SystemClock
 import android.provider.OpenableColumns
 import android.provider.Settings
-import android.view.InputDevice
-import android.view.KeyEvent
 import android.view.MotionEvent
 import android.view.View
 import android.view.ViewGroup
@@ -37,11 +35,6 @@ import android.widget.Toast
 import androidx.annotation.MainThread
 import androidx.annotation.RequiresApi
 import androidx.core.content.ContextCompat
-import androidx.core.graphics.Insets
-import androidx.core.view.OnApplyWindowInsetsListener
-import androidx.core.view.ViewCompat
-import androidx.core.view.WindowInsetsCompat
-import androidx.core.view.WindowInsetsControllerCompat
 import java.io.IOException
 import kotlin.LazyThreadSafetyMode.NONE
 import kotlin.coroutines.CoroutineContext
@@ -75,8 +68,6 @@ private const val OPEN_FILE_ACTION_CODE = 3
 private const val CHECK_NOTIFICATION_PERMISSION_ACTION_CODE = 4

 private const val PREFS_NOTIFICATION_PERMISSION_ASKED = "NOTIFICATION_PERMISSION_ASKED"
-private const val OPEN_FILE_AFTER_RESUME_DELAY_MS = 400L
-private const val KEY_PENDING_OPEN_FILE_URI = "pending_open_file_uri"

 class AmneziaActivity : QtActivity() {

@@ -93,12 +84,6 @@ class AmneziaActivity : QtActivity() {
    private val actionResultHandlers = mutableMapOf<Int, ActivityResultHandler>()
    private val permissionRequestHandlers = mutableMapOf<Int, PermissionRequestHandler>()

-    private var isActivityResumed = false
-    private var hasWindowFocus = false
-    private val resumeHandler = Handler(Looper.getMainLooper())
-    private var pendingOpenFileUri: String? = null
-    private var openFileDeliveryScheduled = false
-
    private val vpnServiceEventHandler: Handler by lazy(NONE) {
        object : Handler(Looper.getMainLooper()) {
            override fun handleMessage(msg: Message) {
@@ -185,9 +170,10 @@ class AmneziaActivity : QtActivity() {
        super.onCreate(savedInstanceState)
        Log.d(TAG, "Create Amnezia activity")
        loadLibs()
-
-        // Configure window for edge-to-edge display
-        configureWindowForEdgeToEdge()
+        window.apply {
+            addFlags(LayoutParams.FLAG_DRAWS_SYSTEM_BAR_BACKGROUNDS)
+            statusBarColor = getColor(R.color.black)
+        }
        mainScope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
        val proto = mainScope.async(Dispatchers.IO) {
            VpnStateStore.getVpnState().vpnProto
@@ -200,18 +186,11 @@ class AmneziaActivity : QtActivity() {
                doBindService()
            }
        )
-        pendingOpenFileUri = savedInstanceState?.getString(KEY_PENDING_OPEN_FILE_URI)
-        openFileDeliveryScheduled = false
        registerBroadcastReceivers()
        intent?.let(::processIntent)
        runBlocking { vpnProto = proto.await() }
    }

-    override fun onSaveInstanceState(outState: Bundle) {
-        super.onSaveInstanceState(outState)
-        pendingOpenFileUri?.let { outState.putString(KEY_PENDING_OPEN_FILE_URI, it) }
-    }
-
    private fun loadLibs() {
        listOf(
            "rsapss",
@@ -277,11 +256,6 @@ class AmneziaActivity : QtActivity() {
    }

    override fun onStop() {
-        isActivityResumed = false
-        hasWindowFocus = false
-        // Cancel all pending operations when activity stops
-        resumeHandler.removeCallbacksAndMessages(null)
-        openFileDeliveryScheduled = false
        Log.d(TAG, "Stop Amnezia activity")
        doUnbindService()
        mainScope.launch {
@@ -291,197 +265,7 @@ class AmneziaActivity : QtActivity() {
        super.onStop()
    }

-    override fun onWindowFocusChanged(hasFocus: Boolean) {
-        super.onWindowFocusChanged(hasFocus)
-        hasWindowFocus = hasFocus
-        Log.d(TAG, "Window focus changed: hasFocus=$hasFocus")
-
-        if (!hasFocus) {
-            // Cancel pending operations if window loses focus
-            resumeHandler.removeCallbacksAndMessages(null)
-        } else if (isActivityResumed && Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            window.decorView.apply {
-                invalidate()
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(1f, 1f)
-                    }
-                }, 50)
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(2f, 2f)
-                        requestLayout()
-                        invalidate()
-                    }
-                }, 150)
-            }
-        }
-    }
-
-    override fun dispatchKeyEvent(event: KeyEvent): Boolean {
-        val keyCode = event.keyCode
-        val pressed = event.action == KeyEvent.ACTION_DOWN
-
-        when (keyCode) {
-            KeyEvent.KEYCODE_BUTTON_A,
-            KeyEvent.KEYCODE_BUTTON_B,
-            KeyEvent.KEYCODE_BUTTON_X,
-            KeyEvent.KEYCODE_BUTTON_Y,
-            KeyEvent.KEYCODE_BUTTON_START,
-            KeyEvent.KEYCODE_BUTTON_SELECT -> {
-                    nativeGamepadKeyEvent(0, keyCode, pressed)
-                    return true
-            }
-            KeyEvent.KEYCODE_DPAD_CENTER,
-            KeyEvent.KEYCODE_DPAD_UP,
-            KeyEvent.KEYCODE_DPAD_DOWN,
-            KeyEvent.KEYCODE_DPAD_LEFT,
-            KeyEvent.KEYCODE_DPAD_RIGHT -> {
-                    val syntheticKeyCode = if (keyCode == KeyEvent.KEYCODE_DPAD_CENTER) KeyEvent.KEYCODE_ENTER else keyCode
-                    val synthetic = KeyEvent(
-                        event.downTime, event.eventTime, event.action, syntheticKeyCode,
-                        event.repeatCount, event.metaState, -1, event.scanCode,
-                        event.flags, InputDevice.SOURCE_KEYBOARD
-                    )
-                    return super.dispatchKeyEvent(synthetic)
-            }
-        }
-
-        return super.dispatchKeyEvent(event)
-    }
-
-    private external fun nativeGamepadKeyEvent(deviceId: Int, keyCode: Int, pressed: Boolean)
-
-    override fun onPause() {
-        // Notify Qt to stop rendering BEFORE super.onPause() destroys the EGL surface.
-        // Using a coroutine here would be too late — the surface is gone by the time
-        // the coroutine runs. A direct synchronous call gives Qt's render thread the
-        // best chance to process visible=false before surface destruction.
-        if (qtInitialized.isCompleted) {
-            QtAndroidController.onActivityPaused()
-        }
-        super.onPause()
-        isActivityResumed = false
-        // Cancel all pending operations when activity pauses
-        resumeHandler.removeCallbacksAndMessages(null)
-        openFileDeliveryScheduled = false
-        Log.d(TAG, "Pause Amnezia activity")
-    }
-
-    override fun onResume() {
-        super.onResume()
-        isActivityResumed = true
-        Log.d(TAG, "Resume Amnezia activity")
-        if (qtInitialized.isCompleted) {
-            QtAndroidController.onActivityResumed()
-        }
-
-        if (pendingOpenFileUri != null && !openFileDeliveryScheduled) {
-            val uri = pendingOpenFileUri!!
-            openFileDeliveryScheduled = true
-            resumeHandler.postDelayed({
-                if (!isFinishing && !isDestroyed) {
-                    pendingOpenFileUri = null
-                    openFileDeliveryScheduled = false
-                    mainScope.launch {
-                        qtInitialized.await()
-                        QtAndroidController.onFileOpened(uri)
-                    }
-                }
-            }, OPEN_FILE_AFTER_RESUME_DELAY_MS)
-        }
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            window.decorView.apply {
-                invalidate()
-
-                resumeHandler.postDelayed({
-                    // Check if activity is still resumed and has focus before executing
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(1f, 1f)
-                    }
-                }, 100)
-
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(2f, 2f)
-                    }
-                }, 200)
-
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        requestLayout()
-                        invalidate()
-                    }
-                }, 250)
-            }
-        }
-    }
-
-    private fun configureWindowForEdgeToEdge() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            window.apply {
-                addFlags(LayoutParams.FLAG_DRAWS_SYSTEM_BAR_BACKGROUNDS)
-                addFlags(LayoutParams.FLAG_LAYOUT_NO_LIMITS)
-                statusBarColor = android.graphics.Color.TRANSPARENT
-                navigationBarColor = android.graphics.Color.TRANSPARENT
-            }
-
-            WindowInsetsControllerCompat(window, window.decorView).apply {
-                isAppearanceLightStatusBars = false
-                isAppearanceLightNavigationBars = false
-            }
-
-            // Workaround for Android 14 (API 34+) IME adjustResize bug
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-                setupImeInsetsListener()
-            }
-        } else {
-            window.apply {
-                addFlags(LayoutParams.FLAG_DRAWS_SYSTEM_BAR_BACKGROUNDS)
-                statusBarColor = getColor(R.color.black)
-            }
-
-            WindowInsetsControllerCompat(window, window.decorView).apply {
-                isAppearanceLightStatusBars = false
-                isAppearanceLightNavigationBars = false
-            }
-        }
-    }
-
-    private fun setupImeInsetsListener() {
-        ViewCompat.setOnApplyWindowInsetsListener(window.decorView) { view, windowInsets ->
-            val imeInsets = windowInsets.getInsets(WindowInsetsCompat.Type.ime())
-            val imeVisible = windowInsets.isVisible(WindowInsetsCompat.Type.ime())
-
-            val imeHeight = if (imeVisible) imeInsets.bottom else 0
-
-            val density = resources.displayMetrics.density
-            val imeHeightDp = (imeHeight / density).toInt()
-
-            // Also track system bars (navigation bar, status bar) changes
-            val systemBarsInsets = windowInsets.getInsets(WindowInsetsCompat.Type.systemBars())
-            val navBarHeight = systemBarsInsets.bottom
-            val navBarHeightDp = (navBarHeight / density).toInt()
-            val statusBarHeight = systemBarsInsets.top
-            val statusBarHeightDp = (statusBarHeight / density).toInt()
-
-            mainScope.launch {
-                qtInitialized.await()
-                QtAndroidController.onImeInsetsChanged(imeHeightDp)
-                QtAndroidController.onSystemBarsInsetsChanged(navBarHeightDp, statusBarHeightDp)
-            }
-
-            // Return windowInsets instead of CONSUMED to allow proper handling
-            windowInsets
-        }
-    }
-
    override fun onDestroy() {
-        isActivityResumed = false
-        hasWindowFocus = false
-        // Cancel all pending operations when activity is destroyed
-        resumeHandler.removeCallbacksAndMessages(null)
        Log.d(TAG, "Destroy Amnezia activity")
        unregisterBroadcastReceiver(notificationStateReceiver)
        notificationStateReceiver = null
@@ -807,13 +591,9 @@ class AmneziaActivity : QtActivity() {
                            grantUriPermission(packageName, this, Intent.FLAG_GRANT_READ_URI_PERMISSION)
                        }?.toString() ?: ""
                        Log.v(TAG, "Open file: $uri")
-                        if (uri.isNotEmpty()) {
-                            pendingOpenFileUri = uri
-                        } else {
-                            mainScope.launch {
-                                qtInitialized.await()
-                                QtAndroidController.onFileOpened(uri)
-                            }
+                        mainScope.launch {
+                            qtInitialized.await()
+                            QtAndroidController.onFileOpened(uri)
                        }
                    }
                ))
@@ -842,7 +622,7 @@ class AmneziaActivity : QtActivity() {
    @Suppress("unused")
    fun getFd(fileName: String): Int {
        Log.v(TAG, "Get fd for $fileName")
-        return blockingCall(Dispatchers.IO) {
+        return blockingCall {
            try {
                pfd = contentResolver.openFileDescriptor(Uri.parse(fileName), "r")
                pfd?.fd ?: -1
@@ -886,43 +666,6 @@ class AmneziaActivity : QtActivity() {
    @Suppress("unused")
    fun isOnTv(): Boolean = applicationContext.packageManager.hasSystemFeature(PackageManager.FEATURE_LEANBACK)

-    @Suppress("unused")
-    fun isEdgeToEdgeEnabled(): Boolean = Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE
-
-    @Suppress("unused")
-    fun getStatusBarHeight(): Int {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) return 0
-
-        val resourceId = resources.getIdentifier("status_bar_height", "dimen", "android")
-        val heightPx = if (resourceId > 0) {
-            resources.getDimensionPixelSize(resourceId)
-        } else {
-            0
-        }
-
-        // Convert physical pixels to device-independent pixels for QML
-        val density = resources.displayMetrics.density
-        val heightDp = (heightPx / density).toInt()
-        return heightDp
-    }
-
-    @Suppress("unused")
-    fun getNavigationBarHeight(): Int {
-        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) return 0
-
-        val resourceId = resources.getIdentifier("navigation_bar_height", "dimen", "android")
-        val heightPx = if (resourceId > 0) {
-            resources.getDimensionPixelSize(resourceId)
-        } else {
-            0
-        }
-
-        // Convert physical pixels to device-independent pixels for QML
-        val density = resources.displayMetrics.density
-        val heightDp = (heightPx / density).toInt()
-        return heightDp
-    }
-
    @Suppress("unused")
    fun startQrCodeReader() {
        Log.v(TAG, "Start camera")
@@ -565,7 +565,7 @@ open class AmneziaVpnService : VpnService() {
        protocolState.value = RECONNECTING

        connectionJob = connectionScope.launch {
-            vpnProto?.protocol?.reconnectVpn(Builder(), ::protect)
+            vpnProto?.protocol?.reconnectVpn(Builder())
        }
    }

@@ -38,15 +38,15 @@ object AppListProvider {
    }
 }

-private class App(pi: PackageInfo, pm: PackageManager, ai: ApplicationInfo? = pi.applicationInfo) : Comparable<App> {
+private class App(pi: PackageInfo, pm: PackageManager, ai: ApplicationInfo = pi.applicationInfo) : Comparable<App> {
    val name: String?
    val packageName: String = pi.packageName
-    val icon: Boolean = (ai?.icon ?: 0) != 0
+    val icon: Boolean = ai.icon != 0
    val isLaunchable: Boolean = pm.getLaunchIntentForPackage(packageName) != null

    init {
-        val name = ai?.loadLabel(pm)?.toString()
-        this.name = name?.takeIf { it != packageName }
+        val name = ai.loadLabel(pm).toString()
+        this.name = if (name != packageName) name else null
    }

    override fun compareTo(other: App): Int {
@@ -1,10 +1,7 @@
 package org.amnezia.vpn

 import android.content.ActivityNotFoundException
-import android.content.Context
 import android.content.Intent
-import android.content.pm.PackageManager
-import android.os.Build
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.result.contract.ActivityResultContracts
@@ -14,29 +11,8 @@ private const val TAG = "TvFilePicker"

 class TvFilePicker : ComponentActivity() {

-    private val fileChooseResultLauncher = registerForActivityResult(object : ActivityResultContracts.OpenDocument() {
-        override fun createIntent(context: Context, input: Array<String>): Intent {
-            val intent = super.createIntent(context, input)
-
-            val activitiesToResolveIntent = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-                context.packageManager.queryIntentActivities(intent, PackageManager.ResolveInfoFlags.of(PackageManager.MATCH_DEFAULT_ONLY.toLong()))
-            } else {
-                @Suppress("DEPRECATION")
-                context.packageManager.queryIntentActivities(intent, PackageManager.MATCH_DEFAULT_ONLY)
-            }
-            if (activitiesToResolveIntent.all {
-                    val name = it.activityInfo.packageName
-                    name.startsWith("com.google.android.tv.frameworkpackagestubs") || name.startsWith("com.android.tv.frameworkpackagestubs")
-                }) {
-                throw ActivityNotFoundException()
-            }
-            return intent
-        }
-    }) {
-        setResult(RESULT_OK, Intent().apply {
-            data = it
-            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-        })
+    private val fileChooseResultLauncher = registerForActivityResult(ActivityResultContracts.GetContent()) {
+        setResult(RESULT_OK, Intent().apply { data = it })
        finish()
    }

@@ -55,7 +31,7 @@ class TvFilePicker : ComponentActivity() {
    private fun getFile() {
        try {
            Log.v(TAG, "getFile")
-            fileChooseResultLauncher.launch(arrayOf("*/*"))
+            fileChooseResultLauncher.launch("*/*")
        } catch (_: ActivityNotFoundException) {
            Log.w(TAG, "Activity not found")
            setResult(RESULT_CANCELED, Intent().apply { putExtra("activityNotFound", true) })
@@ -2,6 +2,7 @@ package org.amnezia.vpn

 import org.amnezia.vpn.protocol.Protocol
 import org.amnezia.vpn.protocol.awg.Awg
+import org.amnezia.vpn.protocol.cloak.Cloak
 import org.amnezia.vpn.protocol.openvpn.OpenVpn
 import org.amnezia.vpn.protocol.wireguard.Wireguard
 import org.amnezia.vpn.protocol.xray.Xray
@@ -35,6 +36,14 @@ enum class VpnProto(
        override fun createProtocol(): Protocol = OpenVpn()
    },

+    CLOAK(
+        "Cloak",
+        "org.amnezia.vpn:amneziaOpenVpnService",
+        OpenVpnService::class.java
+    ) {
+        override fun createProtocol(): Protocol = Cloak()
+    },
+
    XRAY(
        "XRay",
        "org.amnezia.vpn:amneziaXrayService",
@@ -63,4 +72,4 @@ enum class VpnProto(
    companion object {
        fun get(protocolName: String): VpnProto = VpnProto.valueOf(protocolName.uppercase())
    }
-}
+}
@@ -28,10 +28,4 @@ object QtAndroidController {
    external fun onAuthResult(result: Boolean)

    external fun decodeQrCode(data: String): Boolean
-
-    external fun onImeInsetsChanged(heightDp: Int)
-    external fun onSystemBarsInsetsChanged(navBarHeightDp: Int, statusBarHeightDp: Int)
-
-    external fun onActivityPaused()
-    external fun onActivityResumed()
 }
@@ -10,8 +10,6 @@ import java.nio.channels.FileChannel
 import java.nio.channels.FileLock
 import java.time.LocalDateTime
 import java.time.format.DateTimeFormatter
-import java.time.ZonedDateTime
-import java.time.ZoneOffset
 import java.util.concurrent.locks.ReentrantLock
 import org.amnezia.vpn.util.Log.Priority.D
 import org.amnezia.vpn.util.Log.Priority.E
@@ -137,8 +135,8 @@ object Log {
    }

    private fun formatLogMsg(tag: String, msg: String, priority: Priority): String {
-        val utcDate = ZonedDateTime.now(ZoneOffset.UTC).format(dateTimeFormat)
-        return "${utcDate}Z ${Process.myPid()} ${Process.myTid()} $priority [${Thread.currentThread().name}] " +
+        val date = LocalDateTime.now().format(dateTimeFormat)
+        return "$date ${Process.myPid()} ${Process.myTid()} $priority [${Thread.currentThread().name}] " +
            "$tag: $msg\n"
    }

@@ -12,7 +12,6 @@ import org.amnezia.vpn.protocol.Protocol
 import org.amnezia.vpn.protocol.ProtocolState.CONNECTED
 import org.amnezia.vpn.protocol.ProtocolState.DISCONNECTED
 import org.amnezia.vpn.protocol.Statistics
-import org.amnezia.vpn.protocol.VpnException
 import org.amnezia.vpn.protocol.VpnStartException
 import org.amnezia.vpn.util.LibraryLoader.loadSharedLibrary
 import org.amnezia.vpn.util.Log
@@ -28,7 +27,6 @@ private const val TAG = "Wireguard"
 open class Wireguard : Protocol() {

    private var tunnelHandle: Int = -1
-    private var config: WireguardConfig? = null // save config for reconnect
    protected open val ifName: String = "amn0"
    private lateinit var scope: CoroutineScope
    private var statusJob: Job? = null
@@ -63,7 +61,6 @@ open class Wireguard : Protocol() {
    override suspend fun startVpn(config: JSONObject, vpnBuilder: Builder, protect: (Int) -> Boolean) {
        val wireguardConfig = parseConfig(config)
        start(wireguardConfig, vpnBuilder, protect)
-        this.config = wireguardConfig
    }

    protected open fun parseConfig(config: JSONObject): WireguardConfig {
@@ -125,24 +122,23 @@ open class Wireguard : Protocol() {
        configData.optStringOrNull("S2")?.let { setS2(it.toInt()) }
        configData.optStringOrNull("S3")?.let { setS3(it.toInt()) }
        configData.optStringOrNull("S4")?.let { setS4(it.toInt()) }
-        configData.optStringOrNull("H1")?.trim()?.let { if (it.isNotEmpty()) setH1(it) }
-        configData.optStringOrNull("H2")?.trim()?.let { if (it.isNotEmpty()) setH2(it) }
-        configData.optStringOrNull("H3")?.trim()?.let { if (it.isNotEmpty()) setH3(it) }
-        configData.optStringOrNull("H4")?.trim()?.let { if (it.isNotEmpty()) setH4(it) }
+        configData.optStringOrNull("H1")?.let { setH1(it.toLong()) }
+        configData.optStringOrNull("H2")?.let { setH2(it.toLong()) }
+        configData.optStringOrNull("H3")?.let { setH3(it.toLong()) }
+        configData.optStringOrNull("H4")?.let { setH4(it.toLong()) }
        configData.optStringOrNull("I1")?.let { setI1(it) }
        configData.optStringOrNull("I2")?.let { setI2(it) }
        configData.optStringOrNull("I3")?.let { setI3(it) }
        configData.optStringOrNull("I4")?.let { setI4(it) }
        configData.optStringOrNull("I5")?.let { setI5(it) }
+        configData.optStringOrNull("J1")?.let { setJ1(it) }
+        configData.optStringOrNull("J2")?.let { setJ2(it) }
+        configData.optStringOrNull("J3")?.let { setJ3(it) }
+        configData.optStringOrNull("Itime")?.let { setItime(it.toInt()) }
    }

-    private fun start(
-        config: WireguardConfig,
-        vpnBuilder: Builder,
-        protect: (Int) -> Boolean,
-        stopExistingVpn: Boolean = false
-    ) {
-        if (!stopExistingVpn && tunnelHandle != -1) {
+    private fun start(config: WireguardConfig, vpnBuilder: Builder, protect: (Int) -> Boolean) {
+        if (tunnelHandle != -1) {
            Log.w(TAG, "Tunnel already up")
            return
        }
@@ -150,9 +146,6 @@ open class Wireguard : Protocol() {
        buildVpnInterface(config, vpnBuilder)

        vpnBuilder.establish().use { tunFd ->
-            if (stopExistingVpn && tunnelHandle != -1) {
-                turnOffVpn()
-            }
            if (tunFd == null) {
                throw VpnStartException("Create VPN interface: permission not granted or revoked")
            }
@@ -209,25 +202,20 @@ open class Wireguard : Protocol() {
        return lastHandshake
    }

-    private fun turnOffVpn() {
-        statusJob?.cancel()
-        statusJob = null
-        val handleToClose = tunnelHandle
-        tunnelHandle = -1
-        GoBackend.awgTurnOff(handleToClose)
-    }
-
    override fun stopVpn() {
        if (tunnelHandle == -1) {
            Log.w(TAG, "Tunnel already down")
            return
        }
-        turnOffVpn()
+        statusJob?.cancel()
+        statusJob = null
+        val handleToClose = tunnelHandle
+        tunnelHandle = -1
+        GoBackend.awgTurnOff(handleToClose)
        state.value = DISCONNECTED
    }

-    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
-        val config = this.config ?: throw VpnException("Reconnect config is empty")
-        start(config, vpnBuilder, protect, true)
+    override fun reconnectVpn(vpnBuilder: Builder) {
+        state.value = CONNECTED
    }
 }
@@ -22,15 +22,19 @@ open class WireguardConfig protected constructor(
    val s2: Int?,
    val s3: Int?,
    val s4: Int?,
-    val h1: String?,
-    val h2: String?,
-    val h3: String?,
-    val h4: String?,
+    val h1: Long?,
+    val h2: Long?,
+    val h3: Long?,
+    val h4: Long?,
    var i1: String?,
    var i2: String?,
    var i3: String?,
    var i4: String?,
    var i5: String?,
+    var j1: String?,
+    var j2: String?,
+    var j3: String?,
+    var itime: Int?
 ) : ProtocolConfig(protocolConfigBuilder) {

    protected constructor(builder: Builder) : this(
@@ -57,6 +61,10 @@ open class WireguardConfig protected constructor(
        builder.i3,
        builder.i4,
        builder.i5,
+        builder.j1,
+        builder.j2,
+        builder.j3,
+        builder.itime
    )

    fun toWgUserspaceString(): String = with(StringBuilder()) {
@@ -86,6 +94,10 @@ open class WireguardConfig protected constructor(
            i3?.let { appendLine("i3=$it") }
            i4?.let { appendLine("i4=$it") }
            i5?.let { appendLine("i5=$it") }
+            j1?.let { appendLine("j1=$it") }
+            j2?.let { appendLine("j2=$it") }
+            j3?.let { appendLine("j3=$it") }
+            itime?.let { appendLine("itime=$it") }
        }
    }

@@ -140,15 +152,19 @@ open class WireguardConfig protected constructor(
        internal var s2: Int? = null
        internal var s3: Int? = null
        internal var s4: Int? = null
-        internal var h1: String? = null
-        internal var h2: String? = null
-        internal var h3: String? = null
-        internal var h4: String? = null
+        internal var h1: Long? = null
+        internal var h2: Long? = null
+        internal var h3: Long? = null
+        internal var h4: Long? = null
        internal var i1: String? = null
        internal var i2: String? = null
        internal var i3: String? = null
        internal var i4: String? = null
        internal var i5: String? = null
+        internal var j1: String? = null
+        internal var j2: String? = null
+        internal var j3: String? = null
+        internal var itime: Int? = null

        fun setEndpoint(endpoint: InetEndpoint) = apply { this.endpoint = endpoint }

@@ -169,15 +185,19 @@ open class WireguardConfig protected constructor(
        fun setS2(s2: Int) = apply { this.s2 = s2 }
        fun setS3(s3: Int) = apply { this.s3 = s3 }
        fun setS4(s4: Int) = apply { this.s4 = s4 }
-        fun setH1(h1: String) = apply { this.h1 = h1 }
-        fun setH2(h2: String) = apply { this.h2 = h2 }
-        fun setH3(h3: String) = apply { this.h3 = h3 }
-        fun setH4(h4: String) = apply { this.h4 = h4 }
+        fun setH1(h1: Long) = apply { this.h1 = h1 }
+        fun setH2(h2: Long) = apply { this.h2 = h2 }
+        fun setH3(h3: Long) = apply { this.h3 = h3 }
+        fun setH4(h4: Long) = apply { this.h4 = h4 }
        fun setI1(i1: String) = apply { this.i1 = i1 }
        fun setI2(i2: String) = apply { this.i2 = i2 }
        fun setI3(i3: String) = apply { this.i3 = i3 }
        fun setI4(i4: String) = apply { this.i4 = i4 }
        fun setI5(i5: String) = apply { this.i5 = i5 }
+        fun setJ1(j1: String) = apply { this.j1 = j1 }
+        fun setJ2(j2: String) = apply { this.j2 = j2 }
+        fun setJ3(j3: String) = apply { this.j3 = j3 }
+        fun setItime(itime: Int) = apply { this.itime = itime }

        override fun build(): WireguardConfig = configBuild().run { WireguardConfig(this@Builder) }
    }
@@ -4,9 +4,6 @@ import android.content.Context
 import android.net.VpnService.Builder
 import java.io.File
 import java.io.IOException
-import java.net.InetAddress
-import java.net.ServerSocket
-import java.util.UUID
 import go.Seq
 import org.amnezia.vpn.protocol.BadConfigException
 import org.amnezia.vpn.protocol.Protocol
@@ -22,32 +19,11 @@ import org.amnezia.vpn.util.Log
 import org.amnezia.vpn.util.net.InetNetwork
 import org.amnezia.vpn.util.net.ip
 import org.amnezia.vpn.util.net.parseInetAddress
-import org.json.JSONArray
 import org.json.JSONObject

 private const val TAG = "Xray"
 private const val LIBXRAY_TAG = "libXray"

-private fun findSocksInboundIndex(inbounds: JSONArray): Int {
-    for (i in 0 until inbounds.length()) {
-        val o = inbounds.optJSONObject(i) ?: continue
-        if (o.optString("protocol").equals("socks", ignoreCase = true)) {
-            return i
-        }
-    }
-    return -1
-}
-
-private fun acquireFreeLocalPort(): Int {
-    try {
-        ServerSocket(0, 1, InetAddress.getByName("127.0.0.1")).use { return it.localPort }
-    } catch (e: Exception) {
-        throw VpnStartException(
-            "Failed to acquire free TCP port on 127.0.0.1 for SOCKS inbound: ${e.message}"
-        )
-    }
-}
-
 class Xray : Protocol() {

    private var isRunning: Boolean = false
@@ -77,13 +53,9 @@ class Xray : Protocol() {
            return
        }

-        val xrayConfigData = config.optJSONObject("xray_config_data")
+        val xrayJsonConfig = config.optJSONObject("xray_config_data")
            ?: config.optJSONObject("ssxray_config_data")
            ?: throw BadConfigException("config_data not found")
-        val xrayJsonConfig = JSONObject(xrayConfigData.optString("config"))
-
-        // Inject SOCKS5 auth before starting xray. Re-uses existing credentials if present.
-        ensureInboundAuth(xrayJsonConfig)
        val xrayConfig = parseConfig(config, xrayJsonConfig)

        (xrayJsonConfig.optJSONObject("log") ?: JSONObject().also { xrayJsonConfig.put("log", it) })
@@ -125,22 +97,9 @@ class Xray : Protocol() {
                if (it.isNotBlank()) setMtu(it.toInt())
            }

-            val inbounds = xrayJsonConfig.getJSONArray("inbounds")
-            val socksIdx = findSocksInboundIndex(inbounds)
-            if (socksIdx < 0) {
-                throw BadConfigException("socks inbound not found")
-            }
-            val socksConfig = inbounds.getJSONObject(socksIdx)
+            val socksConfig = xrayJsonConfig.getJSONArray("inbounds")[0] as JSONObject
            socksConfig.getInt("port").let { setSocksPort(it) }

-            val socksSettings = socksConfig.optJSONObject("settings")
-            val accounts = socksSettings?.optJSONArray("accounts")
-            if (accounts != null && accounts.length() > 0) {
-                val account = accounts.getJSONObject(0)
-                setSocksUser(account.optString("user"))
-                setSocksPass(account.optString("pass"))
-            }
-
            configSplitTunneling(config)
            configAppSplitTunneling(config)
        }
@@ -198,54 +157,22 @@ class Xray : Protocol() {
        state.value = DISCONNECTED
    }

-    override fun reconnectVpn(vpnBuilder: Builder, protect: (Int) -> Boolean) {
+    override fun reconnectVpn(vpnBuilder: Builder) {
        state.value = CONNECTED
    }

    private fun runTun2Socks(config: XrayConfig, fd: Int) {
-        val proxyUrl = "socks5://${config.socksUser}:${config.socksPass}@127.0.0.1:${config.socksPort}"
        val tun2SocksConfig = Tun2SocksConfig().apply {
            mtu = config.mtu.toLong()
-            proxy = proxyUrl
+            proxy = "socks5://127.0.0.1:${config.socksPort}"
            device = "fd://$fd"
-            logLevel = "warn"
+            logLevel = "warning"
        }
        LibXray.startTun2Socks(tun2SocksConfig, fd.toLong()).isNotNullOrBlank { err ->
            throw VpnStartException("Failed to start tun2socks: $err")
        }
    }

-    // Ensures SOCKS5 auth is present on the socks inbound settings.
-    // Re-uses existing credentials if already configured; otherwise generates random ones.
-    private fun ensureInboundAuth(xrayConfig: JSONObject) {
-        val inbounds = xrayConfig.optJSONArray("inbounds") ?: return
-        val socksIdx = findSocksInboundIndex(inbounds)
-        if (socksIdx < 0) return
-
-        val inbound = inbounds.getJSONObject(socksIdx)
-        inbound.put("port", acquireFreeLocalPort())
-        val settings = inbound.optJSONObject("settings") ?: JSONObject().also { inbound.put("settings", it) }
-        val accounts = settings.optJSONArray("accounts")
-        if (accounts != null && accounts.length() > 0) {
-            val account = accounts.getJSONObject(0)
-            if (account.optString("user").isNotEmpty() && account.optString("pass").isNotEmpty()) {
-                // Ensure auth mode is enforced even for imported configs that had accounts
-                // but auth: "noauth" (or no auth field).
-                settings.put("auth", "password")
-                inbound.put("settings", settings)
-                inbounds.put(socksIdx, inbound)
-                return
-            }
-        }
-
-        val user = UUID.randomUUID().toString().replace("-", "").substring(0, 16)
-        val pass = UUID.randomUUID().toString().replace("-", "")
-        settings.put("auth", "password")
-        settings.put("accounts", JSONArray().put(JSONObject().put("user", user).put("pass", pass)))
-        inbound.put("settings", settings)
-        inbounds.put(socksIdx, inbound)
-    }
-
    companion object {
        val instance: Xray by lazy { Xray() }
    }
@@ -9,16 +9,12 @@ private const val XRAY_DEFAULT_MAX_MEMORY: Long = 50 shl 20 // 50 MB
 class XrayConfig protected constructor(
    protocolConfigBuilder: ProtocolConfig.Builder,
    val socksPort: Int,
-    val socksUser: String,
-    val socksPass: String,
    val maxMemory: Long,
 ) : ProtocolConfig(protocolConfigBuilder) {

    protected constructor(builder: Builder) : this(
        builder,
        builder.socksPort,
-        builder.socksUser,
-        builder.socksPass,
        builder.maxMemory
    )

@@ -26,12 +22,6 @@ class XrayConfig protected constructor(
        internal var socksPort: Int = 0
            private set

-        internal var socksUser: String = ""
-            private set
-
-        internal var socksPass: String = ""
-            private set
-
        internal var maxMemory: Long = XRAY_DEFAULT_MAX_MEMORY
            private set

@@ -39,10 +29,6 @@ class XrayConfig protected constructor(

        fun setSocksPort(port: Int) = apply { socksPort = port }

-        fun setSocksUser(user: String) = apply { socksUser = user }
-
-        fun setSocksPass(pass: String) = apply { socksPass = pass }
-
        fun setMaxMemory(maxMemory: Long) = apply { this.maxMemory = maxMemory }

        override fun build(): XrayConfig = configBuild().run { XrayConfig(this@Builder) }
@@ -27,18 +27,12 @@ if(WIN32)
        set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/windows/win32/libcrypto.lib")
    endif()
 elseif(APPLE AND NOT IOS)
-    if(MACOS_NE)
-        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/universal2/libssh.a")
-        set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/universal2/libz.a")
-        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/universal2")
-    else()
-        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libssh.a")
-        set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libz.a")
-        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/x86_64")
-    endif()
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libssh.a")
+    set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libz.a")
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/x86_64")
    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/macos/include")
    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libssl.a")
-    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libcrypto.a")    
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libcrypto.a")
 elseif(IOS)
    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/ios/arm64")
    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/ios/arm64/libssh.a")
@@ -62,7 +56,7 @@ elseif(LINUX)
    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")
    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")
 endif()
-
+    
 file(COPY ${OPENSSL_LIB_SSL_PATH} ${OPENSSL_LIB_CRYPTO_PATH}
        DESTINATION ${OPENSSL_LIBRARIES_DIR})

@@ -83,26 +77,6 @@ add_compile_definitions(_WINSOCKAPI_)
 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
 add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain)
-
-if(ANDROID)
-    # Use qtgamepad from amnezia-vpn/qtgamepad repository
-    # Only if Qt6CorePrivate is available (required by qtgamepad)
-    find_package(Qt6CorePrivate CONFIG QUIET)
-    if(Qt6CorePrivate_FOUND)
-        add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtgamepad)
-        # Link both the C++ module and QML plugin
-        if(TARGET GamepadLegacy)
-            target_link_libraries(${PROJECT} PRIVATE GamepadLegacy)
-        endif()
-        if(TARGET GamepadLegacyQuickPrivate)
-            target_link_libraries(${PROJECT} PRIVATE GamepadLegacyQuickPrivate)
-        endif()
-        message(STATUS "Gamepad support enabled for Android")
-    else()
-        message(STATUS "Qt6CorePrivate not found. Gamepad support disabled for Android.")
-    endif()
-endif()
-
 set(LIBS ${LIBS} qt6keychain)

 include_directories(
@@ -1,6 +1,6 @@
 message("Client android ${CMAKE_ANDROID_ARCH_ABI} build")

-set(APP_ANDROID_MIN_SDK 28)
+set(APP_ANDROID_MIN_SDK 26)
 set(ANDROID_PLATFORM "android-${APP_ANDROID_MIN_SDK}" CACHE STRING
    "The minimum API level supported by the application or library" FORCE)

@@ -11,8 +11,8 @@ set_target_properties(${PROJECT} PROPERTIES
    QT_ANDROID_VERSION_NAME ${CMAKE_PROJECT_VERSION}
    QT_ANDROID_VERSION_CODE ${APP_ANDROID_VERSION_CODE}
    QT_ANDROID_MIN_SDK_VERSION ${APP_ANDROID_MIN_SDK}
-    QT_ANDROID_TARGET_SDK_VERSION 36
-    QT_ANDROID_SDK_BUILD_TOOLS_REVISION 36.0.0
+    QT_ANDROID_TARGET_SDK_VERSION 34
+    QT_ANDROID_SDK_BUILD_TOOLS_REVISION 34.0.0
    QT_ANDROID_PACKAGE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/android
 )

@@ -20,26 +20,22 @@ set(QT_ANDROID_MULTI_ABI_FORWARD_VARS "QT_NO_GLOBAL_APK_TARGET_PART_OF_ALL;CMAKE

 # We need to include qtprivate api's
 # As QAndroidBinder is not yet implemented with a public api
-# Check if Qt6::CorePrivate is available (may not be in all Qt versions/configurations)
-if(TARGET Qt6::CorePrivate)
-    set(LIBS ${LIBS} Qt6::CorePrivate)
-endif()
-set(LIBS ${LIBS} -ljnigraphics)
+set(LIBS ${LIBS} Qt6::CorePrivate -ljnigraphics)

 link_directories(${CMAKE_CURRENT_SOURCE_DIR}/platforms/android)

 set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_controller.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_utils.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/protocols/androidVpnProtocol.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/protocols/android_vpnprotocol.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/core/installedAppsImageProvider.h
 )

 set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_controller.cpp
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_utils.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/protocols/androidVpnProtocol.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/protocols/android_vpnprotocol.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/core/installedAppsImageProvider.cpp
 )

 foreach(abi IN ITEMS ${QT_ANDROID_ABIS})
@@ -34,7 +34,6 @@ set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate-C-Interface.h
 )
 set_source_files_properties(${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.h PROPERTIES OBJECTIVE_CPP_HEADER TRUE)
@@ -47,8 +46,6 @@ set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/AmneziaSceneDelegateHooks.mm
 )


@@ -121,7 +118,6 @@ target_sources(${PROJECT} PRIVATE
    ${CLIENT_ROOT_DIR}/platforms/ios/LogRecord.swift
    ${CLIENT_ROOT_DIR}/platforms/ios/ScreenProtection.swift
    ${CLIENT_ROOT_DIR}/platforms/ios/VPNCController.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
 )

 target_sources(${PROJECT} PRIVATE
@@ -14,7 +14,7 @@ set(LIBS ${LIBS}
    ${FW_SECURITY}
    ${FW_COREWLAN}
    ${FW_NETWORK}
-    ${FW_USER_NOTIFICATIONS}
+    ${FW_USERNOTIFICATIONS}
    ${FW_NETWORK_EXTENSION}
 )

@@ -28,15 +28,13 @@ set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)


 set(HEADERS ${HEADERS}
-    ${CMAKE_CURRENT_SOURCE_DIR}/ui/utils/macosUtil.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/ui/macos_util.h
 )

 set(SOURCES ${SOURCES}
-    ${CMAKE_CURRENT_SOURCE_DIR}/ui/utils/macosUtil.mm
+    ${CMAKE_CURRENT_SOURCE_DIR}/ui/macos_util.mm
 )

-
-
 set(ICON_FILE ${CMAKE_CURRENT_SOURCE_DIR}/images/app.icns)
 set(MACOSX_BUNDLE_ICON_FILE app.icns)
 set_source_files_properties(${ICON_FILE} PROPERTIES MACOSX_PACKAGE_LOCATION Resources)
@@ -55,3 +53,4 @@ execute_process(
 )
 message("OSX_SDK_PATH is: ${OSX_SDK_PATH}")

+
@@ -1,171 +0,0 @@
-message("Client ==> MacOS NE build")
-
-set_target_properties(${PROJECT} PROPERTIES MACOSX_BUNDLE TRUE)
-set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)
-
-set(APPLE_PROJECT_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-
-enable_language(OBJC)
-enable_language(Swift)
-
-find_package(Qt6 REQUIRED COMPONENTS ShaderTools Widgets)
-# Link Qt Widgets for QWidget, QMenu, QAction etc.
-set(LIBS ${LIBS} Qt6::ShaderTools Qt6::Widgets)
-
-find_library(FW_AUTHENTICATIONSERVICES AuthenticationServices)
-find_library(FW_AVFOUNDATION AVFoundation)
-find_library(FW_FOUNDATION Foundation)
-find_library(FW_STOREKIT StoreKit)
-find_library(FW_SERVICEMGMT ServiceManagement)
-find_library(FW_USERNOTIFICATIONS UserNotifications)
-find_library(FW_NETWORKEXTENSION NetworkExtension)
-
-set(LIBS ${LIBS}
-    ${FW_AUTHENTICATIONSERVICES}
-    ${FW_AVFOUNDATION}
-    ${FW_FOUNDATION}
-    ${FW_STOREKIT}
-    ${FW_SERVICEMGMT}
-    ${FW_USERNOTIFICATIONS}
-    ${FW_NETWORKEXTENSION}
-)
-
-
-set(HEADERS ${HEADERS}
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate-C-Interface.h
-)
-set_source_files_properties(${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.h PROPERTIES OBJECTIVE_CPP_HEADER TRUE)
-
-
-set(SOURCES ${SOURCES}
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
-)
-
-set(ICON_FILE ${CMAKE_CURRENT_SOURCE_DIR}/images/app.icns)
-set(MACOSX_BUNDLE_ICON_FILE app.icns)
-set_source_files_properties(${ICON_FILE} PROPERTIES MACOSX_PACKAGE_LOCATION Resources)
-set(SOURCES ${SOURCES} ${ICON_FILE})
-
-
-target_include_directories(${PROJECT} PRIVATE
-    ${Qt6Gui_PRIVATE_INCLUDE_DIRS}
-    ${Qt6Widgets_PRIVATE_INCLUDE_DIRS}
-)
-
-
-set_target_properties(${PROJECT} PROPERTIES
-    XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
-    MACOSX_BUNDLE_INFO_PLIST ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Info.plist.in
-    MACOSX_BUNDLE_ICON_FILE "AppIcon"
-    MACOSX_BUNDLE_INFO_STRING "AmneziaVPN"
-    MACOSX_BUNDLE_BUNDLE_NAME "AmneziaVPN"
-    MACOSX_BUNDLE_BUNDLE_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
-    MACOSX_BUNDLE_LONG_VERSION_STRING "${APPLE_PROJECT_VERSION}-${CMAKE_PROJECT_VERSION_TWEAK}"
-    MACOSX_BUNDLE_SHORT_VERSION_STRING "${APPLE_PROJECT_VERSION}"
-    XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER "${BUILD_IOS_APP_IDENTIFIER}"
-    XCODE_ATTRIBUTE_CODE_SIGN_ENTITLEMENTS "${CMAKE_CURRENT_SOURCE_DIR}/macos/app/app.entitlements"
-    XCODE_ATTRIBUTE_MARKETING_VERSION "${APPLE_PROJECT_VERSION}"
-    XCODE_ATTRIBUTE_CURRENT_PROJECT_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
-    XCODE_ATTRIBUTE_PRODUCT_NAME "AmneziaVPN"
-    XCODE_ATTRIBUTE_BUNDLE_INFO_STRING "AmneziaVPN"
-    XCODE_GENERATE_SCHEME TRUE
-    XCODE_ATTRIBUTE_ENABLE_BITCODE "NO"
-    XCODE_ATTRIBUTE_ASSETCATALOG_COMPILER_APPICON_NAME "AppIcon"
-    XCODE_ATTRIBUTE_TARGETED_DEVICE_FAMILY "1,2"
-    XCODE_EMBED_FRAMEWORKS_CODE_SIGN_ON_COPY "NO"
-    XCODE_EMBED_FRAMEWORKS_REMOVE_HEADERS_ON_COPY "YES"
-    XCODE_ATTRIBUTE_MACOSX_DEPLOYMENT_TARGET "11.0"
-
-    XCODE_LINK_BUILD_PHASE_MODE KNOWN_LOCATION
-    XCODE_ATTRIBUTE_LD_RUNPATH_SEARCH_PATHS "@executable_path/../Frameworks"
-    XCODE_EMBED_APP_EXTENSIONS AmneziaVPNNetworkExtension
-)
-
-if(DEPLOY)
-    set_target_properties(${PROJECT} PROPERTIES
-        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY "Apple Distribution"
-        XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY[variant=Debug] "Apple Development"
-        XCODE_ATTRIBUTE_CODE_SIGN_STYLE Manual
-        XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER "distr macos.org.amnezia.AmneziaVPN"
-        XCODE_ATTRIBUTE_PROVISIONING_PROFILE_SPECIFIER[variant=Debug] "dev macos.org.amnezia.AmneziaVPN"
-    )
-else()
-    set_target_properties(${PROJECT} PROPERTIES
-        XCODE_ATTRIBUTE_CODE_SIGN_STYLE Automatic
-    )
-endif()
-
-set_target_properties(${PROJECT} PROPERTIES
-    XCODE_ATTRIBUTE_SWIFT_VERSION "5.0"
-    XCODE_ATTRIBUTE_CLANG_ENABLE_MODULES "YES"
-    XCODE_ATTRIBUTE_SWIFT_PRECOMPILE_BRIDGING_HEADER "NO"
-    XCODE_ATTRIBUTE_SWIFT_OBJC_INTERFACE_HEADER_NAME "AmneziaVPN-Swift.h"
-    XCODE_ATTRIBUTE_SWIFT_OBJC_INTEROP_MODE "objcxx"
-)
-set_target_properties(${PROJECT} PROPERTIES
-    XCODE_ATTRIBUTE_DEVELOPMENT_TEAM "X7UJ388FXK"
-)
-target_include_directories(${PROJECT} PRIVATE ${CMAKE_CURRENT_LIST_DIR})
-target_compile_options(${PROJECT} PRIVATE
-    -DGROUP_ID=\"${BUILD_IOS_GROUP_IDENTIFIER}\"
-    -DVPN_NE_BUNDLEID=\"${BUILD_IOS_APP_IDENTIFIER}.network-extension\"
-)
-
-set(WG_APPLE_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR}/3rd/amneziawg-apple/Sources)
-
-target_sources(${PROJECT} PRIVATE
-    ${WG_APPLE_SOURCE_DIR}/WireGuardKitC/x25519.c
-    ${CLIENT_ROOT_DIR}/platforms/ios/LogController.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/Log.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/LogRecord.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/ScreenProtection.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/VPNCController.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
-)
-
-target_sources(${PROJECT} PRIVATE
-    ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Images.xcassets
-    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
-)
-
-set_property(TARGET ${PROJECT} APPEND PROPERTY RESOURCE
-    ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Images.xcassets
-    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
-)
-
-add_subdirectory(macos/networkextension)
-add_dependencies(${PROJECT} AmneziaVPNNetworkExtension)
-
-get_target_property(QtCore_location Qt6::Core LOCATION)
-message("QtCore_location")
-message(${QtCore_location})
-
-get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)
-
-set_property(TARGET ${PROJECT} PROPERTY XCODE_EMBED_FRAMEWORKS
-    "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos/OpenVPNAdapter.framework"
-)
-
-set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos)
-target_link_libraries("AmneziaVPNNetworkExtension" PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos/OpenVPNAdapter.framework")
-
-add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${CMAKE_COMMAND} -E make_directory
-            $<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks
-    COMMAND /usr/bin/find "$<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks/OpenVPNAdapter.framework" -name "*.sha256" -delete
-    COMMAND /usr/bin/codesign --force --sign "Apple Distribution: Privacy Technologies OU"
-            "$<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks/OpenVPNAdapter.framework/Versions/Current/OpenVPNAdapter"
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR}
-    COMMENT "Signing OpenVPNAdapter framework"
-)
@@ -1,68 +1,44 @@
 set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)

 set(HEADERS ${HEADERS}
-    ${CLIENT_ROOT_DIR}/core/utils/migrations.h
+    ${CLIENT_ROOT_DIR}/migrations.h
    ${CLIENT_ROOT_DIR}/../ipc/ipc.h
-    ${CLIENT_ROOT_DIR}/amneziaApplication.h
-    ${CLIENT_ROOT_DIR}/core/utils/errorCodes.h
-    ${CLIENT_ROOT_DIR}/core/utils/routeModes.h
-    ${CLIENT_ROOT_DIR}/core/utils/commonStructs.h
-    ${CLIENT_ROOT_DIR}/core/utils/containerEnum.h
-    ${CLIENT_ROOT_DIR}/core/utils/protocolEnum.h
-    ${CLIENT_ROOT_DIR}/core/utils/containers/containerUtils.h
-    ${CLIENT_ROOT_DIR}/core/protocols/protocolUtils.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/configKeys.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/protocolConstants.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/apiKeys.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/apiConstants.h
-    ${CLIENT_ROOT_DIR}/core/utils/api/apiEnums.h
-    ${CLIENT_ROOT_DIR}/core/utils/errorStrings.h
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/scriptsRegistry.h
-    ${CLIENT_ROOT_DIR}/core/utils/qrCodeUtils.h
+    ${CLIENT_ROOT_DIR}/amnezia_application.h
+    ${CLIENT_ROOT_DIR}/core/models/containers/containers_defs.h
+    ${CLIENT_ROOT_DIR}/core/defs.h
+    ${CLIENT_ROOT_DIR}/core/errorstrings.h
+    ${CLIENT_ROOT_DIR}/core/scripts_registry.h
+    ${CLIENT_ROOT_DIR}/core/server_defs.h
+    ${CLIENT_ROOT_DIR}/core/api/apiDefs.h
+    ${CLIENT_ROOT_DIR}/core/qrCodeUtils.h
    ${CLIENT_ROOT_DIR}/core/controllers/coreController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/coreSignalHandlers.h
-    ${CLIENT_ROOT_DIR}/core/controllers/gatewayController.h
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshSession.h
-    ${CLIENT_ROOT_DIR}/core/controllers/serversController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/usersController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/installController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/importController.h
-    ${CLIENT_ROOT_DIR}/core/installers/installerBase.h
-    ${CLIENT_ROOT_DIR}/core/installers/awgInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/wireguardInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/openvpnInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/xrayInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/torInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/sftpInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/socks5Installer.h
-    ${CLIENT_ROOT_DIR}/core/controllers/appSplitTunnelingController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/ipSplitTunnelingController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/allowedDnsController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/connectionController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/api/gatewayController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/api/apiConfigController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/api/apiSettingsController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/api/apiPremV1MigrationController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/serverController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/selfhostedConfigController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/clientManagementController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/configController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/dnsController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/splitTunnelingController.h
    ${CLIENT_ROOT_DIR}/core/controllers/settingsController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/servicesCatalogController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/subscriptionController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/newsController.h
-    ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.h
-    ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.h
-    ${CLIENT_ROOT_DIR}/core/protocols/qmlRegisterProtocols.h
-    ${CLIENT_ROOT_DIR}/ui/utils/pages.h
-    ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.h
-    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.h
+    ${CLIENT_ROOT_DIR}/core/controllers/connectionController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/vpnConfigurationController.h
+    ${CLIENT_ROOT_DIR}/protocols/protocols_defs.h
+    ${CLIENT_ROOT_DIR}/protocols/qml_register_protocols.h
+    ${CLIENT_ROOT_DIR}/ui/pages.h
+    ${CLIENT_ROOT_DIR}/ui/qautostart.h
+    ${CLIENT_ROOT_DIR}/protocols/vpnprotocol.h
    ${CMAKE_CURRENT_BINARY_DIR}/version.h
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.h
-    ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/serialization.h
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/transfer.h
+    ${CLIENT_ROOT_DIR}/core/sshclient.h
+    ${CLIENT_ROOT_DIR}/core/networkUtilities.h
+    ${CLIENT_ROOT_DIR}/core/serialization/serialization.h
+    ${CLIENT_ROOT_DIR}/core/serialization/transfer.h
    ${CLIENT_ROOT_DIR}/../common/logger/logger.h
-    ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.h
-    ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.h
-    ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.h
-    ${CLIENT_ROOT_DIR}/core/utils/utilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/managementServer.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants.h
+    ${CLIENT_ROOT_DIR}/utils/qmlUtils.h
+    ${CLIENT_ROOT_DIR}/core/api/apiUtils.h
+    ${CLIENT_ROOT_DIR}/core/utils/fileUtils.h
 )

 # Mozilla headres
@@ -71,9 +47,10 @@ set(HEADERS ${HEADERS}
    ${CLIENT_ROOT_DIR}/mozilla/shared/ipaddress.h
    ${CLIENT_ROOT_DIR}/mozilla/shared/leakdetector.h
    ${CLIENT_ROOT_DIR}/mozilla/controllerimpl.h
+    ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.h
 )

-if(NOT IOS AND NOT MACOS_NE)
+if(NOT IOS)
    set(HEADERS ${HEADERS}
        ${CLIENT_ROOT_DIR}/platforms/ios/QRCodeReaderBase.h
    )
@@ -81,64 +58,49 @@ endif()

 if(NOT ANDROID)
    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/ui/utils/notificationHandler.h
+        ${CLIENT_ROOT_DIR}/ui/notificationhandler.h
    )
 endif()

 set(SOURCES ${SOURCES}
-    ${CLIENT_ROOT_DIR}/core/utils/migrations.cpp
-    ${CLIENT_ROOT_DIR}/amneziaApplication.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/errorStrings.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/containers/containerUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/protocols/protocolUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/scriptsRegistry.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/qrCodeUtils.cpp
+    ${CLIENT_ROOT_DIR}/migrations.cpp
+    ${CLIENT_ROOT_DIR}/amnezia_application.cpp
+    ${CLIENT_ROOT_DIR}/core/models/containers/containers_defs.cpp
+    ${CLIENT_ROOT_DIR}/core/errorstrings.cpp
+    ${CLIENT_ROOT_DIR}/core/scripts_registry.cpp
+    ${CLIENT_ROOT_DIR}/core/server_defs.cpp
+    ${CLIENT_ROOT_DIR}/core/qrCodeUtils.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/coreController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/coreSignalHandlers.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/gatewayController.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshSession.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/serversController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/usersController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/installController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/importController.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/installerBase.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/awgInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/wireguardInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/openvpnInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/xrayInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/torInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/sftpInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/socks5Installer.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/appSplitTunnelingController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/ipSplitTunnelingController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/allowedDnsController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/connectionController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/api/gatewayController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/api/apiConfigController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/api/apiSettingsController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/api/apiPremV1MigrationController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/serverController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/selfhostedConfigController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/clientManagementController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/configController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/dnsController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/splitTunnelingController.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/settingsController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/servicesCatalogController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/subscriptionController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/newsController.cpp
-    ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.cpp
-    ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.cpp
-    ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.cpp
-    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/outbound.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/inbound.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/ss.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/ssd.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/vless.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/trojan.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess_new.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/connectionController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/vpnConfigurationController.cpp
+    ${CLIENT_ROOT_DIR}/protocols/protocols_defs.cpp
+    ${CLIENT_ROOT_DIR}/ui/qautostart.cpp
+    ${CLIENT_ROOT_DIR}/protocols/vpnprotocol.cpp
+    ${CLIENT_ROOT_DIR}/core/sshclient.cpp
+    ${CLIENT_ROOT_DIR}/core/networkUtilities.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/outbound.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/inbound.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/ss.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/ssd.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/vless.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/trojan.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/vmess.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/vmess_new.cpp
    ${CLIENT_ROOT_DIR}/../common/logger/logger.cpp
-    ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/utilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/managementServer.cpp
+    ${CLIENT_ROOT_DIR}/utils/qmlUtils.cpp
+    ${CLIENT_ROOT_DIR}/core/api/apiUtils.cpp
+    ${CLIENT_ROOT_DIR}/core/utils/fileUtils.cpp
 )

 # Mozilla sources
@@ -146,105 +108,96 @@ set(SOURCES ${SOURCES}
    ${CLIENT_ROOT_DIR}/mozilla/models/server.cpp
    ${CLIENT_ROOT_DIR}/mozilla/shared/ipaddress.cpp
    ${CLIENT_ROOT_DIR}/mozilla/shared/leakdetector.cpp
+    ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.cpp
 )

-if(NOT IOS AND NOT MACOS_NE)
+if(NOT IOS)
    set(SOURCES ${SOURCES}
        ${CLIENT_ROOT_DIR}/platforms/ios/QRCodeReaderBase.cpp
    )
 endif()

-# Include native macOS platform helpers (dock/status-item)
-if(APPLE AND NOT IOS)
-    list(APPEND HEADERS
-        ${CLIENT_ROOT_DIR}/platforms/macos/macosutils.h
-        ${CLIENT_ROOT_DIR}/platforms/macos/macosstatusicon.h
-        ${CLIENT_ROOT_DIR}/ui/utils/macosUtil.h
-    )
-    list(APPEND SOURCES
-        ${CLIENT_ROOT_DIR}/platforms/macos/macosutils.mm
-        ${CLIENT_ROOT_DIR}/platforms/macos/macosstatusicon.mm
-        ${CLIENT_ROOT_DIR}/ui/utils/macosUtil.mm
-    )
-endif()
-
 if(NOT ANDROID)
    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/ui/utils/notificationHandler.cpp
+        ${CLIENT_ROOT_DIR}/ui/notificationhandler.cpp
    )
 endif()

-set(COMMON_FILES_H
-    ${CLIENT_ROOT_DIR}/amneziaApplication.h
-    ${CLIENT_ROOT_DIR}/secureQSettings.h
-    ${CLIENT_ROOT_DIR}/vpnConnection.h
-)
-
-set(COMMON_FILES_CPP
-    ${CLIENT_ROOT_DIR}/amneziaApplication.cpp
-    ${CLIENT_ROOT_DIR}/secureQSettings.cpp
-    ${CLIENT_ROOT_DIR}/vpnConnection.cpp
-)
+file(GLOB COMMON_FILES_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/*.h)
+file(GLOB COMMON_FILES_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/*.cpp)

 file(GLOB_RECURSE PAGE_LOGIC_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/ui/pages_logic/*.h)
 file(GLOB_RECURSE PAGE_LOGIC_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/ui/pages_logic/*.cpp)

-file(GLOB CONFIGURATORS_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/configurators/*.h)
-file(GLOB CONFIGURATORS_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/configurators/*.cpp)
-
-file(GLOB_RECURSE CORE_MODELS_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/models/*.h)
-file(GLOB_RECURSE CORE_MODELS_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/models/*.cpp)
+file(GLOB CONFIGURATORS_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/configurators/*.h)
+file(GLOB CONFIGURATORS_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/configurators/*.cpp)

 file(GLOB UI_MODELS_H CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/models/*.h
    ${CLIENT_ROOT_DIR}/ui/models/protocols/*.h
    ${CLIENT_ROOT_DIR}/ui/models/services/*.h
    ${CLIENT_ROOT_DIR}/ui/models/api/*.h
+    ${CLIENT_ROOT_DIR}/ui/models/selfhosted/*.h
 )
+
 file(GLOB UI_MODELS_CPP CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/models/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/protocols/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/services/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/api/*.cpp
+    ${CLIENT_ROOT_DIR}/ui/models/selfhosted/*.cpp
 )

 file(GLOB UI_CONTROLLERS_H CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/controllers/*.h
    ${CLIENT_ROOT_DIR}/ui/controllers/api/*.h
-    ${CLIENT_ROOT_DIR}/ui/controllers/qml/*.h
    ${CLIENT_ROOT_DIR}/ui/controllers/selfhosted/*.h
 )
+
 file(GLOB UI_CONTROLLERS_CPP CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/controllers/*.cpp
    ${CLIENT_ROOT_DIR}/ui/controllers/api/*.cpp
-    ${CLIENT_ROOT_DIR}/ui/controllers/qml/*.cpp
    ${CLIENT_ROOT_DIR}/ui/controllers/selfhosted/*.cpp
 )

+file(GLOB CORE_MODELS_H CONFIGURE_DEPENDS
+    ${CLIENT_ROOT_DIR}/core/models/*.h
+    ${CLIENT_ROOT_DIR}/core/models/containers/*.h
+    ${CLIENT_ROOT_DIR}/core/models/protocols/*.h
+    ${CLIENT_ROOT_DIR}/core/models/servers/*.h
+)
+
+file(GLOB CORE_MODELS_CPP CONFIGURE_DEPENDS
+    ${CLIENT_ROOT_DIR}/core/models/*.cpp
+    ${CLIENT_ROOT_DIR}/core/models/containers/*.cpp
+    ${CLIENT_ROOT_DIR}/core/models/protocols/*.cpp
+    ${CLIENT_ROOT_DIR}/core/models/servers/*.cpp
+)
+
 set(HEADERS ${HEADERS}
    ${COMMON_FILES_H}
    ${PAGE_LOGIC_H}
    ${CONFIGURATORS_H}
-    ${CORE_MODELS_H}
    ${UI_MODELS_H}
    ${UI_CONTROLLERS_H}
+    ${CORE_MODELS_H}
 )
 set(SOURCES ${SOURCES}
    ${COMMON_FILES_CPP}
    ${PAGE_LOGIC_CPP}
    ${CONFIGURATORS_CPP}
-    ${CORE_MODELS_CPP}
    ${UI_MODELS_CPP}
    ${UI_CONTROLLERS_CPP}
+    ${CORE_MODELS_CPP}
 )

 if(WIN32)
    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/core/protocols/ikev2VpnProtocolWindows.h
+        ${CLIENT_ROOT_DIR}/protocols/ikev2_vpn_protocol_windows.h
    )

    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/core/protocols/ikev2VpnProtocolWindows.cpp
+        ${CLIENT_ROOT_DIR}/protocols/ikev2_vpn_protocol_windows.cpp
    )

    set(RESOURCES ${RESOURCES}
@@ -252,38 +205,31 @@ if(WIN32)
    )
 endif()

-if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
+if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
    message("Client desktop build")
    add_compile_definitions(AMNEZIA_DESKTOP)

    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/core/utils/ipcClient.h
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.h
-        ${CLIENT_ROOT_DIR}/core/protocols/openVpnProtocol.h
-        ${CLIENT_ROOT_DIR}/core/protocols/wireGuardProtocol.h
-        ${CLIENT_ROOT_DIR}/core/protocols/xrayProtocol.h
-        ${CLIENT_ROOT_DIR}/core/protocols/awgProtocol.h
-        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.h
+        ${CLIENT_ROOT_DIR}/core/ipcclient.h
+        ${CLIENT_ROOT_DIR}/core/privileged_process.h
+        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.h
+        ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/openvpnovercloakprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/shadowsocksvpnprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/wireguardprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/xrayprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/awgprotocol.h
    )

    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/core/utils/ipcClient.cpp
-        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.cpp
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/openVpnProtocol.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/wireGuardProtocol.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/xrayProtocol.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/awgProtocol.cpp
-    )
-endif()
-
-if(APPLE AND MACOS_NE)
-    # Include only the tray notification handler in NE builds
-    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.h
-    )
-
-    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.cpp
+        ${CLIENT_ROOT_DIR}/core/ipcclient.cpp
+        ${CLIENT_ROOT_DIR}/core/privileged_process.cpp
+        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.cpp
+        ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/openvpnovercloakprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/shadowsocksvpnprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/wireguardprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/xrayprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/awgprotocol.cpp
    )
 endif()
@@ -0,0 +1,52 @@
+#include "awg_configurator.h"
+#include "protocols/protocols_defs.h"
+
+AwgConfigurator::AwgConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : WireguardConfigurator(settings, serverController, true, parent)
+{
+}
+
+QSharedPointer<ProtocolConfig> AwgConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                          const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
+{
+    auto result = WireguardConfigurator::createConfig(credentials, container, protocolConfig, errorCode);
+    if (!result) {
+        return nullptr;
+    }
+    
+    auto awgConfig = qSharedPointerCast<AwgProtocolConfig>(result);
+    if (!awgConfig) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
+    }
+    
+    QString config = awgConfig->clientProtocolConfig.nativeConfig;
+
+    QMap<QString, QString> configMap;
+    auto configLines = config.split("\n");
+    for (auto &line : configLines) {
+        auto trimmedLine = line.trimmed();
+        if (trimmedLine.startsWith("[") && trimmedLine.endsWith("]")) {
+            continue;
+        } else {
+            QStringList parts = trimmedLine.split(" = ");
+            if (parts.count() == 2) {
+                configMap.insert(parts[0].trimmed(), parts[1].trimmed());
+            }
+        }
+    }
+
+    awgConfig->clientProtocolConfig.awgData.junkPacketCount = configMap.value(config_key::junkPacketCount);
+    awgConfig->clientProtocolConfig.awgData.junkPacketMinSize = configMap.value(config_key::junkPacketMinSize);
+    awgConfig->clientProtocolConfig.awgData.junkPacketMaxSize = configMap.value(config_key::junkPacketMaxSize);
+    awgConfig->clientProtocolConfig.awgData.initPacketJunkSize = configMap.value(config_key::initPacketJunkSize);
+    awgConfig->clientProtocolConfig.awgData.responsePacketJunkSize = configMap.value(config_key::responsePacketJunkSize);
+    awgConfig->clientProtocolConfig.awgData.initPacketMagicHeader = configMap.value(config_key::initPacketMagicHeader);
+    awgConfig->clientProtocolConfig.awgData.responsePacketMagicHeader = configMap.value(config_key::responsePacketMagicHeader);
+    awgConfig->clientProtocolConfig.awgData.underloadPacketMagicHeader = configMap.value(config_key::underloadPacketMagicHeader);
+    awgConfig->clientProtocolConfig.awgData.transportPacketMagicHeader = configMap.value(config_key::transportPacketMagicHeader);
+
+    awgConfig->clientProtocolConfig.wireGuardData.mtu = awgConfig->serverProtocolConfig.mtu;
+
+    return awgConfig;
+}
@@ -0,0 +1,18 @@
+#ifndef AWGCONFIGURATOR_H
+#define AWGCONFIGURATOR_H
+
+#include <QObject>
+
+#include "wireguard_configurator.h"
+
+class AwgConfigurator : public WireguardConfigurator
+{
+    Q_OBJECT
+public:
+    AwgConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+};
+
+#endif // AWGCONFIGURATOR_H
@@ -0,0 +1,89 @@
+#include "cloak_configurator.h"
+
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+
+#include "core/models/containers/containers_defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/models/protocols/cloakProtocolConfig.h"
+#include "protocols/protocols_defs.h"
+
+CloakConfigurator::CloakConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+ConfiguratorBase::Vars CloakConfigurator::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                               const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    Vars vars = generateCommonVars(credentials, container);
+
+    auto cloakConfig = qSharedPointerCast<CloakProtocolConfig>(protocolConfig);
+    if (!cloakConfig) {
+        return vars;
+    }
+
+    vars.append({{"$CLOAK_SERVER_PORT", cloakConfig->serverProtocolConfig.port}});
+    vars.append({{"$FAKE_WEB_SITE_ADDRESS", cloakConfig->serverProtocolConfig.site}});
+
+    return vars;
+}
+
+QSharedPointer<ProtocolConfig> CloakConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                            const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
+{
+    auto cloakConfig = qSharedPointerCast<CloakProtocolConfig>(protocolConfig);
+    if (!cloakConfig) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
+    }
+
+    QString cloakPublicKey =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::cloak::ckPublicKeyPath, errorCode);
+    cloakPublicKey.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return nullptr;
+    }
+
+    QString cloakBypassUid =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::cloak::ckBypassUidKeyPath, errorCode);
+    cloakBypassUid.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return nullptr;
+    }
+
+    cloakConfig->clientProtocolConfig.transport = "direct";
+    cloakConfig->clientProtocolConfig.proxyMethod = "openvpn";
+    cloakConfig->clientProtocolConfig.encryptionMethod = "aes-gcm";
+    cloakConfig->clientProtocolConfig.uid = cloakBypassUid;
+    cloakConfig->clientProtocolConfig.publicKey = cloakPublicKey;
+    cloakConfig->clientProtocolConfig.serverName = cloakConfig->serverProtocolConfig.site;
+    cloakConfig->clientProtocolConfig.numConn = 1;
+    cloakConfig->clientProtocolConfig.browserSig = "chrome";
+    cloakConfig->clientProtocolConfig.streamTimeout = 300;
+    cloakConfig->clientProtocolConfig.remoteHost = credentials.hostName;
+    cloakConfig->clientProtocolConfig.remotePort = cloakConfig->serverProtocolConfig.port;
+
+    QJsonObject config;
+    config.insert("Transport", cloakConfig->clientProtocolConfig.transport);
+    config.insert("ProxyMethod", cloakConfig->clientProtocolConfig.proxyMethod);
+    config.insert("EncryptionMethod", cloakConfig->clientProtocolConfig.encryptionMethod);
+    config.insert("UID", cloakConfig->clientProtocolConfig.uid);
+    config.insert("PublicKey", cloakConfig->clientProtocolConfig.publicKey);
+    config.insert("ServerName", cloakConfig->clientProtocolConfig.serverName);
+    config.insert("NumConn", cloakConfig->clientProtocolConfig.numConn);
+    config.insert("BrowserSig", cloakConfig->clientProtocolConfig.browserSig);
+    config.insert("StreamTimeout", cloakConfig->clientProtocolConfig.streamTimeout);
+    config.insert("RemoteHost", cloakConfig->clientProtocolConfig.remoteHost);
+    config.insert("RemotePort", cloakConfig->clientProtocolConfig.remotePort);
+
+    QString textCfg = QJsonDocument(config).toJson();
+
+    cloakConfig->clientProtocolConfig.isEmpty = false;
+    cloakConfig->clientProtocolConfig.nativeConfig = textCfg;
+
+    return cloakConfig;
+}
@@ -0,0 +1,24 @@
+#ifndef CLOAK_CONFIGURATOR_H
+#define CLOAK_CONFIGURATOR_H
+
+#include <QObject>
+
+#include "configurator_base.h"
+#include "core/models/protocols/cloakProtocolConfig.h"
+
+using namespace amnezia;
+
+class CloakConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    CloakConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+
+    Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                             const QSharedPointer<ProtocolConfig> &protocolConfig) const override;
+};
+
+#endif // CLOAK_CONFIGURATOR_H
@@ -0,0 +1,58 @@
+#include "configurator_base.h"
+#include "core/networkUtilities.h"
+#include "core/models/protocols/protocolConfig.h"
+#include <variant>
+
+ConfiguratorBase::ConfiguratorBase(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : QObject { parent }, m_settings(settings), m_serverController(serverController)
+{
+}
+
+void ConfiguratorBase::processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                      QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    processConfigWithDnsSettings(dns, protocolConfig);
+}
+
+void ConfiguratorBase::processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                       QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    processConfigWithDnsSettings(dns, protocolConfig);
+}
+
+void ConfiguratorBase::processConfigWithDnsSettings(const QPair<QString, QString> &dns, QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    ProtocolConfigVariant variant = ProtocolConfig::getProtocolConfigVariant(protocolConfig);
+    std::visit([&dns](const auto &config) -> void {
+        config->clientProtocolConfig.nativeConfig.replace("$PRIMARY_DNS", dns.first);
+        config->clientProtocolConfig.nativeConfig.replace("$SECONDARY_DNS", dns.second);
+    }, variant);
+}
+
+ConfiguratorBase::Vars ConfiguratorBase::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                             const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    return generateCommonVars(credentials, container);
+}
+
+ConfiguratorBase::Vars ConfiguratorBase::generateCommonVars(const ServerCredentials &credentials, DockerContainer container) const
+{
+    Vars vars;
+
+    vars.append({{"$REMOTE_HOST", credentials.hostName}});
+
+    QString serverIp = (container != DockerContainer::Awg && container != DockerContainer::WireGuard && container != DockerContainer::Xray)
+            ? NetworkUtilities::getIPAddress(credentials.hostName)
+            : credentials.hostName;
+    if (!serverIp.isEmpty()) {
+        vars.append({{"$SERVER_IP_ADDRESS", serverIp}});
+    }
+
+    vars.append({{"$CONTAINER_NAME", ContainerProps::containerToString(container)}});
+    vars.append({{"$DOCKERFILE_FOLDER", "/opt/amnezia/" + ContainerProps::containerToString(container)}});
+
+    vars.append({{"$PRIMARY_SERVER_DNS", m_settings->primaryDns()}});
+    vars.append({{"$SECONDARY_SERVER_DNS", m_settings->secondaryDns()}});
+
+    return vars;
+}
@@ -0,0 +1,44 @@
+#ifndef CONFIGURATORBASE_H
+#define CONFIGURATORBASE_H
+
+#include <QObject>
+#include <QList>
+#include <QPair>
+#include <QSharedPointer>
+
+#include "core/models/containers/containers_defs.h"
+#include "core/defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/models/protocols/protocolConfig.h"
+#include "settings.h"
+
+class ConfiguratorBase : public QObject
+{
+    Q_OBJECT
+public:
+    using Vars = QList<QPair<QString, QString>>;
+
+    explicit ConfiguratorBase(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    virtual QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                        const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) = 0;
+
+    virtual void processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                QSharedPointer<ProtocolConfig> &protocolConfig);
+    virtual void processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                 QSharedPointer<ProtocolConfig> &protocolConfig);
+
+    virtual Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                     const QSharedPointer<ProtocolConfig> &protocolConfig) const;
+
+protected:
+    void processConfigWithDnsSettings(const QPair<QString, QString> &dns, QSharedPointer<ProtocolConfig> &protocolConfig);
+
+    Vars generateCommonVars(const ServerCredentials &credentials, DockerContainer container) const;
+
+    std::shared_ptr<Settings> m_settings;
+    QSharedPointer<ServerController> m_serverController;
+
+};
+
+#endif // CONFIGURATORBASE_H
@@ -0,0 +1,177 @@
+#include "ikev2_configurator.h"
+
+#include <QDebug>
+#include <QJsonDocument>
+#include <QProcess>
+#include <QString>
+#include <QTemporaryDir>
+#include <QTemporaryFile>
+#include <QUuid>
+
+#include "core/models/containers/containers_defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/scripts_registry.h"
+#include "core/server_defs.h"
+#include "protocols/protocols_defs.h"
+#include "utilities.h"
+
+Ikev2Configurator::Ikev2Configurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+ConfiguratorBase::Vars Ikev2Configurator::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                              const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    Vars vars = generateCommonVars(credentials, container);
+
+    vars.append({{"$IPSEC_VPN_L2TP_NET", "192.168.42.0/24"}});
+    vars.append({{"$IPSEC_VPN_L2TP_POOL", "192.168.42.10-192.168.42.250"}});
+    vars.append({{"$IPSEC_VPN_L2TP_LOCAL", "192.168.42.1"}});
+
+    vars.append({{"$IPSEC_VPN_XAUTH_NET", "192.168.43.0/24"}});
+    vars.append({{"$IPSEC_VPN_XAUTH_POOL", "192.168.43.10-192.168.43.250"}});
+
+    vars.append({{"$IPSEC_VPN_SHA2_TRUNCBUG", "yes"}});
+    vars.append({{"$IPSEC_VPN_VPN_ANDROID_MTU_FIX", "yes"}});
+    vars.append({{"$IPSEC_VPN_DISABLE_IKEV2", "no"}});
+    vars.append({{"$IPSEC_VPN_DISABLE_L2TP", "no"}});
+    vars.append({{"$IPSEC_VPN_DISABLE_XAUTH", "no"}});
+    vars.append({{"$IPSEC_VPN_C2C_TRAFFIC", "no"}});
+
+    return vars;
+}
+
+Ikev2Configurator::ConnectionData Ikev2Configurator::prepareIkev2Config(const ServerCredentials &credentials, DockerContainer container,
+                                                                        ErrorCode &errorCode)
+{
+    Ikev2Configurator::ConnectionData connData;
+    connData.host = credentials.hostName;
+    connData.clientId = Utils::getRandomString(16);
+    connData.password = Utils::getRandomString(16);
+    connData.password = "";
+
+    QString certFileName = "/opt/amnezia/ikev2/clients/" + connData.clientId + ".p12";
+
+    QString scriptCreateCert = QString("certutil -z <(head -c 1024 /dev/urandom) "
+                                       "-S -c \"IKEv2 VPN CA\" -n \"%1\" "
+                                       "-s \"O=IKEv2 VPN,CN=%1\" "
+                                       "-k rsa -g 3072 -v 120 "
+                                       "-d sql:/etc/ipsec.d -t \",,\" "
+                                       "--keyUsage digitalSignature,keyEncipherment "
+                                       "--extKeyUsage serverAuth,clientAuth -8 \"%1\"")
+                                       .arg(connData.clientId);
+
+    errorCode = m_serverController->runContainerScript(credentials, container, scriptCreateCert);
+
+    QString scriptExportCert =
+            QString("pk12util -W \"%1\" -d sql:/etc/ipsec.d -n \"%2\" -o \"%3\"").arg(connData.password).arg(connData.clientId).arg(certFileName);
+    errorCode = m_serverController->runContainerScript(credentials, container, scriptExportCert);
+
+    connData.clientCert = m_serverController->getTextFileFromContainer(container, credentials, certFileName, errorCode);
+    connData.caCert = m_serverController->getTextFileFromContainer(container, credentials, "/etc/ipsec.d/ca_cert_base64.p12", errorCode);
+
+    qDebug() << "Ikev2Configurator::ConnectionData client cert size:" << connData.clientCert.size();
+    qDebug() << "Ikev2Configurator::ConnectionData ca cert size:" << connData.caCert.size();
+
+    return connData;
+}
+
+QSharedPointer<ProtocolConfig> Ikev2Configurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                            const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
+{
+    Q_UNUSED(protocolConfig)
+
+    // IKEv2 uses a generic ProtocolConfig - no specific subclass needed
+    if (!protocolConfig) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
+    }
+
+    ConnectionData connData = prepareIkev2Config(credentials, container, errorCode);
+    if (errorCode != ErrorCode::NoError) {
+        return nullptr;
+    }
+
+    auto ikev2Config = qSharedPointerCast<Ikev2ProtocolConfig>(protocolConfig);
+    if (!ikev2Config) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
+    }
+
+    ikev2Config->clientProtocolConfig.isEmpty = false;
+    ikev2Config->clientProtocolConfig.hostName = connData.host;
+    ikev2Config->clientProtocolConfig.userName = connData.clientId;
+    ikev2Config->clientProtocolConfig.cert = QString(connData.clientCert.toBase64());
+    ikev2Config->clientProtocolConfig.password = connData.password;
+
+    // Generate the appropriate native config based on platform
+    QString nativeConfigStr;
+    switch (Utils::systemType()) {
+    case SystemType::iOS:
+        [[fallthrough]];
+    case SystemType::macOS:
+        nativeConfigStr = genMobileConfig(connData);
+        break;
+    case SystemType::Android:
+        nativeConfigStr = genIkev2Config(connData);
+        break;
+    default:
+        nativeConfigStr = genStrongSwanConfig(connData);
+        break;
+    }
+
+    ikev2Config->clientProtocolConfig.nativeConfig = nativeConfigStr;
+    
+    return ikev2Config;
+}
+
+QString Ikev2Configurator::genIkev2Config(const ConnectionData &connData)
+{
+    // Create temporary JSON for Android platform (will be eliminated when android protocols are updated)
+    QJsonObject config;
+    config[config_key::hostName] = connData.host;
+    config[config_key::userName] = connData.clientId;
+    config[config_key::cert] = QString(connData.clientCert.toBase64());
+    config[config_key::password] = connData.password;
+
+    return QJsonDocument(config).toJson();
+}
+
+QString Ikev2Configurator::genMobileConfig(const ConnectionData &connData)
+{
+    QFile file(":/server_scripts/ipsec/mobileconfig.plist");
+    file.open(QIODevice::ReadOnly);
+    QString config = QString(file.readAll());
+
+    config.replace("$CLIENT_NAME", connData.clientId);
+    config.replace("$UUID1", QUuid::createUuid().toString());
+    config.replace("$SERVER_ADDR", connData.host);
+
+    QString subStr("$(UUID_GEN)");
+    while (config.indexOf(subStr) > 0) {
+        config.replace(config.indexOf(subStr), subStr.size(), QUuid::createUuid().toString());
+    }
+
+    config.replace("$P12_BASE64", connData.clientCert.toBase64());
+    config.replace("$CA_BASE64", connData.caCert.toBase64());
+
+    return config;
+}
+
+QString Ikev2Configurator::genStrongSwanConfig(const ConnectionData &connData)
+{
+    QFile file(":/server_scripts/ipsec/strongswan.profile");
+    file.open(QIODevice::ReadOnly);
+    QString config = QString(file.readAll());
+
+    config.replace("$CLIENT_NAME", connData.clientId);
+    config.replace("$UUID", QUuid::createUuid().toString());
+    config.replace("$SERVER_ADDR", connData.host);
+
+    QByteArray cert = connData.clientCert.toBase64();
+    cert.replace("\r", "").replace("\n", "");
+    config.replace("$P12_BASE64", cert);
+
+    return config;
+}
@@ -0,0 +1,40 @@
+#ifndef IKEV2_CONFIGURATOR_H
+#define IKEV2_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/models/protocols/protocolConfig.h"
+#include "core/models/protocols/ikev2ProtocolConfig.h"
+#include "core/defs.h"
+
+class Ikev2Configurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    Ikev2Configurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    struct ConnectionData {
+        QByteArray clientCert; // p12 client cert
+        QByteArray caCert; // p12 server cert
+        QString clientId;
+        QString password; // certificate password
+        QString host; // host ip
+    };
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+
+    QString genIkev2Config(const ConnectionData &connData);
+    QString genMobileConfig(const ConnectionData &connData);
+    QString genStrongSwanConfig(const ConnectionData &connData);
+
+    Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                             const QSharedPointer<ProtocolConfig> &protocolConfig) const override;
+
+    ConnectionData prepareIkev2Config(const ServerCredentials &credentials,
+        DockerContainer container, ErrorCode &errorCode);
+};
+
+#endif // IKEV2_CONFIGURATOR_H
@@ -0,0 +1,346 @@
+#include "openvpn_configurator.h"
+
+#include <QDebug>
+
+#include <QProcess>
+#include <QString>
+#include <QTemporaryDir>
+#include <QTemporaryFile>
+#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
+    #include <QGuiApplication>
+#else
+    #include <QApplication>
+#endif
+
+#include "core/networkUtilities.h"
+#include "core/models/protocols/protocolConfig.h"
+#include <variant>
+#include "core/models/containers/containers_defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/scripts_registry.h"
+#include "core/models/protocols/openvpnProtocolConfig.h"
+#include "protocols/protocols_defs.h"
+#include "settings.h"
+#include "utilities.h"
+
+#include <openssl/pem.h>
+#include <openssl/rsa.h>
+#include <openssl/x509.h>
+
+
+OpenVpnConfigurator::OpenVpnConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController,
+                                         QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+ConfiguratorBase::Vars OpenVpnConfigurator::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                                 const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    Vars vars = generateCommonVars(credentials, container);
+
+    auto openVpnConfig = qSharedPointerCast<OpenVpnProtocolConfig>(protocolConfig);
+    if (!openVpnConfig) {
+        return vars;
+    }
+
+    vars.append({{"$OPENVPN_SUBNET_IP", openVpnConfig->serverProtocolConfig.subnetAddress}});
+    vars.append({{"$OPENVPN_SUBNET_CIDR", protocols::openvpn::defaultSubnetCidr}});
+    vars.append({{"$OPENVPN_SUBNET_MASK", protocols::openvpn::defaultSubnetMask}});
+
+    vars.append({{"$OPENVPN_PORT", openVpnConfig->serverProtocolConfig.port}});
+    vars.append({{"$OPENVPN_TRANSPORT_PROTO", openVpnConfig->serverProtocolConfig.transportProto}});
+
+    vars.append({{"$OPENVPN_NCP_DISABLE", openVpnConfig->serverProtocolConfig.ncpDisable ? protocols::openvpn::ncpDisableString : ""}});
+
+    vars.append({{"$OPENVPN_CIPHER", openVpnConfig->serverProtocolConfig.cipher}});
+    vars.append({{"$OPENVPN_HASH", openVpnConfig->serverProtocolConfig.hash}});
+
+    vars.append({{"$OPENVPN_TLS_AUTH", openVpnConfig->serverProtocolConfig.tlsAuth ? protocols::openvpn::tlsAuthString : ""}});
+    if (!openVpnConfig->serverProtocolConfig.tlsAuth) {
+        vars.append({{"$OPENVPN_TA_KEY", ""}});
+    }
+
+    vars.append({{"$OPENVPN_ADDITIONAL_CLIENT_CONFIG", openVpnConfig->serverProtocolConfig.additionalClientConfig}});
+    vars.append({{"$OPENVPN_ADDITIONAL_SERVER_CONFIG", openVpnConfig->serverProtocolConfig.additionalServerConfig}});
+
+    return vars;
+}
+
+OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::prepareOpenVpnConfig(const ServerCredentials &credentials,
+                                                                              DockerContainer container, ErrorCode &errorCode)
+{
+    OpenVpnConfigurator::ConnectionData connData = OpenVpnConfigurator::createCertRequest();
+    connData.host = credentials.hostName;
+
+    if (connData.privKey.isEmpty() || connData.request.isEmpty()) {
+        errorCode = ErrorCode::OpenSslFailed;
+        return connData;
+    }
+
+    QString reqFileName = QString("%1/%2.req").arg(amnezia::protocols::openvpn::clientsDirPath).arg(connData.clientId);
+
+    errorCode = m_serverController->uploadTextFileToContainer(container, credentials, connData.request, reqFileName);
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+
+    errorCode = signCert(container, credentials, connData.clientId);
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+
+    connData.caCert =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::caCertPath, errorCode);
+    connData.clientCert = m_serverController->getTextFileFromContainer(
+            container, credentials, QString("%1/%2.crt").arg(amnezia::protocols::openvpn::clientCertPath).arg(connData.clientId), errorCode);
+
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+
+    connData.taKey = m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::taKeyPath, errorCode);
+
+    if (connData.caCert.isEmpty() || connData.clientCert.isEmpty() || connData.taKey.isEmpty()) {
+        errorCode = ErrorCode::SshScpFailureError;
+    }
+
+    return connData;
+}
+
+QSharedPointer<ProtocolConfig> OpenVpnConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
+{
+    auto openVpnConfig = qSharedPointerCast<OpenVpnProtocolConfig>(protocolConfig);
+    if (!openVpnConfig) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
+    }
+
+    QString config = m_serverController->replaceVars(amnezia::scriptData(ProtocolScriptType::openvpn_template, container),
+                                                     generateProtocolVars(credentials, container, protocolConfig));
+
+    ConnectionData connData = prepareOpenVpnConfig(credentials, container, errorCode);
+    if (errorCode != ErrorCode::NoError) {
+        return nullptr;
+    }
+
+    config.replace("$OPENVPN_CA_CERT", connData.caCert);
+    config.replace("$OPENVPN_CLIENT_CERT", connData.clientCert);
+    config.replace("$OPENVPN_PRIV_KEY", connData.privKey);
+
+    if (config.contains("$OPENVPN_TA_KEY")) {
+        config.replace("$OPENVPN_TA_KEY", connData.taKey);
+    } else {
+        config.replace("<tls-auth>", "");
+        config.replace("</tls-auth>", "");
+    }
+
+#ifndef MZ_WINDOWS
+    config.replace("block-outside-dns", "");
+#endif
+
+    openVpnConfig->clientProtocolConfig.isEmpty = false;
+    openVpnConfig->clientProtocolConfig.clientId = connData.clientId;
+    openVpnConfig->clientProtocolConfig.nativeConfig = config;
+
+    return openVpnConfig;
+}
+
+void OpenVpnConfigurator::processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                         QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    processConfigWithDnsSettings(dns, protocolConfig);
+
+    ProtocolConfigVariant variant = ProtocolConfig::getProtocolConfigVariant(protocolConfig);
+    std::visit([this, &dns, isApiConfig](const auto &config) -> void {
+        if constexpr (std::is_same_v<std::decay_t<decltype(config)>, QSharedPointer<OpenVpnProtocolConfig>>) {
+            QString &nativeConfig = config->clientProtocolConfig.nativeConfig;
+
+            if (!isApiConfig) {
+                QRegularExpression regex("redirect-gateway.*");
+                nativeConfig.replace(regex, "");
+                
+                // We don't use secondary DNS if primary DNS is AmneziaDNS
+                if (dns.first.contains(protocols::dns::amneziaDnsIp)) {
+                    QRegularExpression dnsRegex("dhcp-option DNS " + dns.second);
+                    nativeConfig.replace(dnsRegex, "");
+                }
+
+                if (!m_settings->isSitesSplitTunnelingEnabled()) {
+                    nativeConfig.append("\nredirect-gateway def1 ipv6 bypass-dhcp\n");
+                    nativeConfig.append("block-ipv6\n");
+                } else if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
+
+                   // no redirect-gateway
+                } else if (m_settings->routeMode() == Settings::VpnAllExceptSites) {
+#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
+                    nativeConfig.append("\nredirect-gateway ipv6 !ipv4 bypass-dhcp\n");
+                    // Prevent ipv6 leak
+#endif
+                    nativeConfig.append("block-ipv6\n");
+                }
+
+                QStringList routeList = m_settings->vpnRoutes();
+
+                if (!routeList.isEmpty()) {
+                    for (auto route : routeList) {
+                        nativeConfig.append("\nroute " + route + " 255.255.255.255 vpn_gateway\n");
+                    }
+                }
+            }
+
+#ifndef MZ_WINDOWS
+            nativeConfig.replace("block-outside-dns", "");
+#endif
+
+#if (defined(MZ_MACOS) || defined(MZ_LINUX))
+            QString dnsConf = QString("\nscript-security 2\n"
+                                      "up %1/update-resolv-conf.sh\n"
+                                      "down %1/update-resolv-conf.sh\n")
+                                      .arg(qApp->applicationDirPath());
+
+            nativeConfig.append(dnsConf);
+#endif
+        }
+    }, variant);
+}
+
+void OpenVpnConfigurator::processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                          QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    processConfigWithDnsSettings(dns, protocolConfig);
+
+    ProtocolConfigVariant variant = ProtocolConfig::getProtocolConfigVariant(protocolConfig);
+    std::visit([&dns](const auto &config) -> void {
+        if constexpr (std::is_same_v<std::decay_t<decltype(config)>, QSharedPointer<OpenVpnProtocolConfig>>) {
+            QString &nativeConfig = config->clientProtocolConfig.nativeConfig;
+
+            QRegularExpression regex("redirect-gateway.*");
+            nativeConfig.replace(regex, "");
+
+            // We don't use secondary DNS if primary DNS is AmneziaDNS
+            if (dns.first.contains(protocols::dns::amneziaDnsIp)) {
+                QRegularExpression dnsRegex("dhcp-option DNS " + dns.second);
+                nativeConfig.replace(dnsRegex, "");
+            }
+
+            nativeConfig.append("\nredirect-gateway def1 ipv6 bypass-dhcp\n");
+
+            // Prevent ipv6 leak
+            nativeConfig.append("block-ipv6\n");
+
+            // remove block-outside-dns for all exported configs
+            nativeConfig.replace("block-outside-dns", "");
+        }
+    }, variant);
+}
+
+ErrorCode OpenVpnConfigurator::signCert(DockerContainer container, const ServerCredentials &credentials, QString clientId)
+{
+    QString script_import = QString("sudo docker exec -i %1 bash -c \"cd /opt/amnezia/openvpn && "
+                                    "easyrsa import-req %2/%3.req %3\"")
+                                    .arg(ContainerProps::containerToString(container))
+                                    .arg(amnezia::protocols::openvpn::clientsDirPath)
+                                    .arg(clientId);
+
+    QString script_sign = QString("sudo docker exec -i %1 bash -c \"export EASYRSA_BATCH=1; cd /opt/amnezia/openvpn && "
+                                  "easyrsa sign-req client %2\"")
+                                  .arg(ContainerProps::containerToString(container))
+                                  .arg(clientId);
+
+    QStringList scriptList { script_import, script_sign };
+    QString script = m_serverController->replaceVars(scriptList.join("\n"), generateProtocolVars(credentials, container));
+
+    return m_serverController->runScript(credentials, script);
+}
+
+OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::createCertRequest()
+{
+    ConnectionData connData;
+    connData.clientId = Utils::getRandomString(32);
+
+    int ret = 0;
+    int nVersion = 1;
+
+    QByteArray clientIdUtf8 = connData.clientId.toUtf8();
+
+    EVP_PKEY *pKey = EVP_PKEY_new();
+    q_check_ptr(pKey);
+    RSA *rsa = RSA_generate_key(2048, RSA_F4, nullptr, nullptr);
+    q_check_ptr(rsa);
+    EVP_PKEY_assign_RSA(pKey, rsa);
+
+    // 2. set version of x509 req
+    X509_REQ *x509_req = X509_REQ_new();
+    ret = X509_REQ_set_version(x509_req, nVersion);
+    if (ret != 1) {
+        qWarning() << "Could not get X509!";
+        X509_REQ_free(x509_req);
+        EVP_PKEY_free(pKey);
+        return connData;
+    }
+
+    // 3. set subject of x509 req
+    X509_NAME *x509_name = X509_REQ_get_subject_name(x509_req);
+
+    X509_NAME_add_entry_by_txt(x509_name, "C", MBSTRING_ASC, (unsigned char *)"ORG", -1, -1, 0);
+    X509_NAME_add_entry_by_txt(x509_name, "O", MBSTRING_ASC, (unsigned char *)"", -1, -1, 0);
+    X509_NAME_add_entry_by_txt(x509_name, "CN", MBSTRING_ASC, reinterpret_cast<unsigned char const *>(clientIdUtf8.data()),
+                               clientIdUtf8.size(), -1, 0);
+
+    // 4. set public key of x509 req
+    ret = X509_REQ_set_pubkey(x509_req, pKey);
+    if (ret != 1) {
+        qWarning() << "Could not set pubkey!";
+        X509_REQ_free(x509_req);
+        EVP_PKEY_free(pKey);
+        return connData;
+    }
+
+    // 5. set sign key of x509 req
+    ret = X509_REQ_sign(x509_req, pKey, EVP_sha256()); // return x509_req->signature->length
+    if (ret <= 0) {
+        qWarning() << "Could not sign request!";
+        X509_REQ_free(x509_req);
+        EVP_PKEY_free(pKey);
+        return connData;
+    }
+
+    // save private key
+    BIO *bp_private = BIO_new(BIO_s_mem());
+    q_check_ptr(bp_private);
+    if (PEM_write_bio_PrivateKey(bp_private, pKey, nullptr, nullptr, 0, nullptr, nullptr) != 1) {
+        qFatal("PEM_write_bio_PrivateKey");
+        EVP_PKEY_free(pKey);
+        BIO_free_all(bp_private);
+        X509_REQ_free(x509_req);
+        return connData;
+    }
+
+    const char *buffer = nullptr;
+    size_t size = BIO_get_mem_data(bp_private, &buffer);
+    q_check_ptr(buffer);
+    connData.privKey = QByteArray(buffer, size);
+    if (connData.privKey.isEmpty()) {
+        qFatal("Failed to generate a random private key");
+        EVP_PKEY_free(pKey);
+        BIO_free_all(bp_private);
+        X509_REQ_free(x509_req);
+        return connData;
+    }
+    BIO_free_all(bp_private);
+
+    // save req
+    BIO *bio_req = BIO_new(BIO_s_mem());
+    PEM_write_bio_X509_REQ(bio_req, x509_req);
+
+    BUF_MEM *bio_buf;
+    BIO_get_mem_ptr(bio_req, &bio_buf);
+    connData.request = QByteArray(bio_buf->data, bio_buf->length);
+    BIO_free(bio_req);
+
+    EVP_PKEY_free(pKey); // this will also free the rsa key
+
+    return connData;
+}
@@ -0,0 +1,47 @@
+#ifndef OPENVPN_CONFIGURATOR_H
+#define OPENVPN_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+#include "core/models/protocols/openvpnProtocolConfig.h"
+
+class OpenVpnConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    OpenVpnConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    struct ConnectionData
+    {
+        QString clientId;
+        QString request;    // certificate request
+        QString privKey;    // client private key
+        QString clientCert; // client signed certificate
+        QString caCert;     // server certificate
+        QString taKey;      // tls-auth key
+        QString host;       // host ip
+    };
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+
+    void processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                        QSharedPointer<ProtocolConfig> &protocolConfig) override;
+    void processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                         QSharedPointer<ProtocolConfig> &protocolConfig) override;
+
+    Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                             const QSharedPointer<ProtocolConfig> &protocolConfig) const override;
+
+    static ConnectionData createCertRequest();
+
+private:
+    ConnectionData prepareOpenVpnConfig(const ServerCredentials &credentials, DockerContainer container,
+                                        ErrorCode &errorCode);
+    ErrorCode signCert(DockerContainer container, const ServerCredentials &credentials, QString clientId);
+};
+
+#endif // OPENVPN_CONFIGURATOR_H
@@ -0,0 +1,73 @@
+#include "shadowsocks_configurator.h"
+
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+
+#include "core/models/containers/containers_defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/models/protocols/shadowsocksProtocolConfig.h"
+#include "protocols/protocols_defs.h"
+
+ShadowSocksConfigurator::ShadowSocksConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController,
+                                                 QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+ConfiguratorBase::Vars ShadowSocksConfigurator::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                                     const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    Vars vars = generateCommonVars(credentials, container);
+
+    auto shadowsocksConfig = qSharedPointerCast<ShadowsocksProtocolConfig>(protocolConfig);
+    if (!shadowsocksConfig) {
+        return vars;
+    }
+
+    vars.append({{"$SHADOWSOCKS_SERVER_PORT", shadowsocksConfig->serverProtocolConfig.port}});
+    vars.append({{"$SHADOWSOCKS_LOCAL_PORT", protocols::shadowsocks::defaultLocalProxyPort}});
+    vars.append({{"$SHADOWSOCKS_CIPHER", shadowsocksConfig->serverProtocolConfig.cipher}});
+
+    return vars;
+}
+
+QSharedPointer<ProtocolConfig> ShadowSocksConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                                  const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
+{
+    auto shadowsocksConfig = qSharedPointerCast<ShadowsocksProtocolConfig>(protocolConfig);
+    if (!shadowsocksConfig) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
+    }
+
+    QString ssKey =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::shadowsocks::ssKeyPath, errorCode);
+    ssKey.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return nullptr;
+    }
+
+    shadowsocksConfig->clientProtocolConfig.server = credentials.hostName;
+    shadowsocksConfig->clientProtocolConfig.serverPort = shadowsocksConfig->serverProtocolConfig.port;
+    shadowsocksConfig->clientProtocolConfig.localPort = protocols::shadowsocks::defaultLocalProxyPort;
+    shadowsocksConfig->clientProtocolConfig.password = ssKey;
+    shadowsocksConfig->clientProtocolConfig.timeout = 60;
+    shadowsocksConfig->clientProtocolConfig.method = shadowsocksConfig->serverProtocolConfig.cipher;
+
+    QJsonObject config;
+    config.insert("server", shadowsocksConfig->clientProtocolConfig.server);
+    config.insert("server_port", shadowsocksConfig->clientProtocolConfig.serverPort);
+    config.insert("local_port", shadowsocksConfig->clientProtocolConfig.localPort);
+    config.insert("password", shadowsocksConfig->clientProtocolConfig.password);
+    config.insert("timeout", shadowsocksConfig->clientProtocolConfig.timeout);
+    config.insert("method", shadowsocksConfig->clientProtocolConfig.method);
+
+    QString textCfg = QJsonDocument(config).toJson();
+
+    shadowsocksConfig->clientProtocolConfig.isEmpty = false;
+    shadowsocksConfig->clientProtocolConfig.nativeConfig = textCfg;
+
+    return shadowsocksConfig;
+}
@@ -0,0 +1,23 @@
+#ifndef SHADOWSOCKS_CONFIGURATOR_H
+#define SHADOWSOCKS_CONFIGURATOR_H
+
+#include <QObject>
+
+#include "configurator_base.h"
+#include "core/models/protocols/shadowsocksProtocolConfig.h"
+#include "core/defs.h"
+
+class ShadowSocksConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    ShadowSocksConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+
+    Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                             const QSharedPointer<ProtocolConfig> &protocolConfig) const override;
+};
+
+#endif // SHADOWSOCKS_CONFIGURATOR_H
@@ -0,0 +1,111 @@
+#include "ssh_configurator.h"
+
+#include <QDebug>
+#include <QObject>
+#include <QProcess>
+#include <QString>
+#include <QTemporaryDir>
+#include <QTemporaryFile>
+#include <QThread>
+#include <qtimer.h>
+#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
+    #include <QGuiApplication>
+#else
+    #include <QApplication>
+#endif
+
+#include "core/server_defs.h"
+#include "utilities.h"
+
+SshConfigurator::SshConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+QString SshConfigurator::convertOpenSShKey(const QString &key)
+{
+#ifndef Q_OS_IOS
+    QProcess p;
+    p.setProcessChannelMode(QProcess::MergedChannels);
+
+    QTemporaryFile tmp;
+    #ifdef QT_DEBUG
+    tmp.setAutoRemove(false);
+    #endif
+    tmp.open();
+    tmp.write(key.toUtf8());
+    tmp.close();
+
+    // ssh-keygen -p -P "" -N "" -m pem -f id_ssh
+
+    #ifdef Q_OS_WIN
+    p.setProcessEnvironment(prepareEnv());
+    p.setProgram("cmd.exe");
+    p.setNativeArguments(QString("/C \"ssh-keygen.exe -p -P \"\" -N \"\" -m pem -f \"%1\"\"").arg(tmp.fileName()));
+    #else
+    p.setProgram("ssh-keygen");
+    p.setArguments(QStringList() << "-p"
+                                 << "-P"
+                                 << ""
+                                 << "-N"
+                                 << ""
+                                 << "-m"
+                                 << "pem"
+                                 << "-f" << tmp.fileName());
+    #endif
+
+    p.start();
+    p.waitForFinished();
+
+    qDebug().noquote() << "OpenVpnConfigurator::convertOpenSShKey" << p.exitCode() << p.exitStatus() << p.readAll();
+
+    tmp.open();
+
+    return tmp.readAll();
+#else
+    return key;
+#endif
+}
+
+void SshConfigurator::openSshTerminal(const ServerCredentials &credentials)
+{
+#ifndef Q_OS_IOS
+    QProcess *p = new QProcess();
+    p->setProcessChannelMode(QProcess::SeparateChannels);
+
+    #ifdef Q_OS_WIN
+    p->setProcessEnvironment(prepareEnv());
+    p->setProgram(qApp->applicationDirPath() + "\\cygwin\\putty.exe");
+
+    if (credentials.secretData.contains("PRIVATE KEY")) {
+        // todo: connect by key
+        //        p->setNativeArguments(QString("%1@%2")
+        //            .arg(credentials.userName).arg(credentials.hostName).arg(credentials.secretData));
+    } else {
+        p->setNativeArguments(QString("%1@%2 -pw %3").arg(credentials.userName).arg(credentials.hostName).arg(credentials.secretData));
+    }
+    #else
+    p->setProgram("/bin/bash");
+    #endif
+
+    p->startDetached();
+#endif
+}
+
+QProcessEnvironment SshConfigurator::prepareEnv()
+{
+    QProcessEnvironment env = QProcessEnvironment::systemEnvironment();
+    QString pathEnvVar = env.value("PATH");
+
+#ifdef Q_OS_WIN
+    pathEnvVar.clear();
+    pathEnvVar.prepend(QDir::toNativeSeparators(QApplication::applicationDirPath()) + "\\cygwin;");
+    pathEnvVar.prepend(QDir::toNativeSeparators(QApplication::applicationDirPath()) + "\\openvpn;");
+#elif defined(Q_OS_MACX)
+    pathEnvVar.prepend(QDir::toNativeSeparators(QApplication::applicationDirPath()) + "/Contents/MacOS");
+#endif
+
+    env.insert("PATH", pathEnvVar);
+    // qDebug().noquote() << "ENV PATH" << pathEnvVar;
+    return env;
+}
@@ -0,0 +1,22 @@
+#ifndef SSH_CONFIGURATOR_H
+#define SSH_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+
+class SshConfigurator : ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    SshConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QProcessEnvironment prepareEnv();
+    QString convertOpenSShKey(const QString &key);
+    void openSshTerminal(const ServerCredentials &credentials);
+
+};
+
+#endif // SSH_CONFIGURATOR_H
@@ -0,0 +1,309 @@
+#include "wireguard_configurator.h"
+
+#include <QDebug>
+#include <QJsonDocument>
+#include <QProcess>
+#include <QRegularExpression>
+#include <QString>
+#include <QTemporaryDir>
+#include <QTemporaryFile>
+#include <type_traits>
+#include <variant>
+
+#include <openssl/pem.h>
+#include <openssl/rand.h>
+#include <openssl/rsa.h>
+#include <openssl/x509.h>
+
+#include "core/models/containers/containers_defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/scripts_registry.h"
+#include "core/server_defs.h"
+#include "core/models/protocols/wireguardProtocolConfig.h"
+#include "core/models/protocols/awgProtocolConfig.h"
+#include "protocols/protocols_defs.h"
+#include "settings.h"
+#include "utilities.h"
+
+WireguardConfigurator::WireguardConfigurator(std::shared_ptr<Settings> settings,
+                                             const QSharedPointer<ServerController> &serverController, bool isAwg,
+                                             QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent), m_isAwg(isAwg)
+{
+    m_serverConfigPath =
+            m_isAwg ? amnezia::protocols::awg::serverConfigPath : amnezia::protocols::wireguard::serverConfigPath;
+    m_serverPublicKeyPath =
+            m_isAwg ? amnezia::protocols::awg::serverPublicKeyPath : amnezia::protocols::wireguard::serverPublicKeyPath;
+    m_serverPskKeyPath =
+            m_isAwg ? amnezia::protocols::awg::serverPskKeyPath : amnezia::protocols::wireguard::serverPskKeyPath;
+    m_configTemplate = m_isAwg ? ProtocolScriptType::awg_template : ProtocolScriptType::wireguard_template;
+
+    m_protocolName = m_isAwg ? config_key::awg : config_key::wireguard;
+    m_defaultPort = m_isAwg ? protocols::wireguard::defaultPort : protocols::awg::defaultPort;
+}
+
+ConfiguratorBase::Vars WireguardConfigurator::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                                   const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    Vars vars = generateCommonVars(credentials, container);
+
+    if (m_isAwg) {
+        auto awgConfig = qSharedPointerCast<AwgProtocolConfig>(protocolConfig);
+        if (!awgConfig) {
+            return vars;
+        }
+
+        vars.append({{"$AWG_SUBNET_IP", awgConfig->serverProtocolConfig.subnetAddress}});
+        vars.append({{"$AWG_SERVER_PORT", awgConfig->serverProtocolConfig.port}});
+
+        const auto &awgData = awgConfig->serverProtocolConfig.awgData;
+        vars.append({{"$JUNK_PACKET_COUNT", awgData.junkPacketCount}});
+        vars.append({{"$JUNK_PACKET_MIN_SIZE", awgData.junkPacketMinSize}});
+        vars.append({{"$JUNK_PACKET_MAX_SIZE", awgData.junkPacketMaxSize}});
+        vars.append({{"$INIT_PACKET_JUNK_SIZE", awgData.initPacketJunkSize}});
+        vars.append({{"$RESPONSE_PACKET_JUNK_SIZE", awgData.responsePacketJunkSize}});
+        vars.append({{"$INIT_PACKET_MAGIC_HEADER", awgData.initPacketMagicHeader}});
+        vars.append({{"$RESPONSE_PACKET_MAGIC_HEADER", awgData.responsePacketMagicHeader}});
+        vars.append({{"$UNDERLOAD_PACKET_MAGIC_HEADER", awgData.underloadPacketMagicHeader}});
+        vars.append({{"$TRANSPORT_PACKET_MAGIC_HEADER", awgData.transportPacketMagicHeader}});
+        vars.append({{"$COOKIE_REPLY_PACKET_JUNK_SIZE", awgData.cookieReplyPacketJunkSize}});
+        vars.append({{"$TRANSPORT_PACKET_JUNK_SIZE", awgData.transportPacketJunkSize}});
+    } else {
+        auto wgConfig = qSharedPointerCast<WireGuardProtocolConfig>(protocolConfig);
+        if (!wgConfig) {
+            return vars;
+        }
+
+        vars.append({{"$WIREGUARD_SUBNET_IP", wgConfig->serverProtocolConfig.subnetAddress}});
+        vars.append({{"$WIREGUARD_SUBNET_CIDR", protocols::wireguard::defaultSubnetCidr}});
+        vars.append({{"$WIREGUARD_SUBNET_MASK", protocols::wireguard::defaultSubnetMask}});
+        vars.append({{"$WIREGUARD_SERVER_PORT", wgConfig->serverProtocolConfig.port}});
+    }
+
+    return vars;
+}
+
+WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
+{
+    // TODO review
+    constexpr size_t EDDSA_KEY_LENGTH = 32;
+
+    ConnectionData connData;
+
+    unsigned char buff[EDDSA_KEY_LENGTH];
+    int ret = RAND_priv_bytes(buff, EDDSA_KEY_LENGTH);
+    if (ret <= 0)
+        return connData;
+
+    EVP_PKEY *pKey = EVP_PKEY_new();
+    q_check_ptr(pKey);
+    pKey = EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, &buff[0], EDDSA_KEY_LENGTH);
+
+    size_t keySize = EDDSA_KEY_LENGTH;
+
+    // save private key
+    unsigned char priv[EDDSA_KEY_LENGTH];
+    EVP_PKEY_get_raw_private_key(pKey, priv, &keySize);
+    connData.clientPrivKey = QByteArray::fromRawData((char *)priv, keySize).toBase64();
+
+    // save public key
+    unsigned char pub[EDDSA_KEY_LENGTH];
+    EVP_PKEY_get_raw_public_key(pKey, pub, &keySize);
+    connData.clientPubKey = QByteArray::fromRawData((char *)pub, keySize).toBase64();
+
+    return connData;
+}
+
+QList<QHostAddress> WireguardConfigurator::getIpsFromConf(const QString &input)
+{
+    QRegularExpression regex("AllowedIPs = (\\d+\\.\\d+\\.\\d+\\.\\d+)");
+    QRegularExpressionMatchIterator matchIterator = regex.globalMatch(input);
+
+    QList<QHostAddress> ips;
+
+    while (matchIterator.hasNext()) {
+        QRegularExpressionMatch match = matchIterator.next();
+        const QString address_string { match.captured(1) };
+        const QHostAddress address { address_string };
+        if (address.isNull()) {
+            qWarning() << "Couldn't recognize the ip address: " << address_string;
+        } else {
+            ips << address;
+        }
+    }
+
+    return ips;
+}
+
+WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardConfig(const ServerCredentials &credentials,
+                                                                                    DockerContainer container,
+                                                                                    const QSharedPointer<ProtocolConfig> &protocolConfig,
+                                                                                    ErrorCode &errorCode)
+{
+    WireguardConfigurator::ConnectionData connData = WireguardConfigurator::genClientKeys();
+    connData.host = credentials.hostName;
+    
+    // Extract port from appropriate protocol config
+    if (m_isAwg) {
+        auto awgConfig = qSharedPointerCast<AwgProtocolConfig>(protocolConfig);
+        connData.port = awgConfig ? awgConfig->serverProtocolConfig.port : m_defaultPort;
+    } else {
+        auto wgConfig = qSharedPointerCast<WireGuardProtocolConfig>(protocolConfig);
+        connData.port = wgConfig ? wgConfig->serverProtocolConfig.port : m_defaultPort;
+    }
+
+    if (connData.clientPrivKey.isEmpty() || connData.clientPubKey.isEmpty()) {
+        errorCode = ErrorCode::InternalError;
+        return connData;
+    }
+
+    QString getIpsScript = QString("cat %1 | grep AllowedIPs").arg(m_serverConfigPath);
+    QString stdOut;
+    auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
+        stdOut += data + "\n";
+        return ErrorCode::NoError;
+    };
+
+    errorCode = m_serverController->runContainerScript(credentials, container, getIpsScript, cbReadStdOut);
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+    auto ips = getIpsFromConf(stdOut);
+
+    QHostAddress nextIp = [&] {
+        QHostAddress result;
+        QHostAddress lastIp;
+        if (ips.empty()) {
+            // Get subnet from protocol config
+            QString subnetAddress;
+            if (m_isAwg) {
+                auto awgConfig = qSharedPointerCast<AwgProtocolConfig>(protocolConfig);
+                subnetAddress = awgConfig ? awgConfig->serverProtocolConfig.subnetAddress : protocols::wireguard::defaultSubnetAddress;
+            } else {
+                auto wgConfig = qSharedPointerCast<WireGuardProtocolConfig>(protocolConfig);
+                subnetAddress = wgConfig ? wgConfig->serverProtocolConfig.subnetAddress : protocols::wireguard::defaultSubnetAddress;
+            }
+            lastIp.setAddress(subnetAddress);
+        } else {
+            lastIp = ips.last();
+        }
+        quint8 lastOctet = static_cast<quint8>(lastIp.toIPv4Address());
+        switch (lastOctet) {
+        case 254: result.setAddress(lastIp.toIPv4Address() + 3); break;
+        case 255: result.setAddress(lastIp.toIPv4Address() + 2); break;
+        default: result.setAddress(lastIp.toIPv4Address() + 1); break;
+        }
+
+        return result;
+    }();
+
+    connData.clientIP = nextIp.toString();
+
+    // Get keys
+    connData.serverPubKey =
+            m_serverController->getTextFileFromContainer(container, credentials, m_serverPublicKeyPath, errorCode);
+    connData.serverPubKey.replace("\n", "");
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+
+    connData.pskKey = m_serverController->getTextFileFromContainer(container, credentials, m_serverPskKeyPath, errorCode);
+    connData.pskKey.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+
+    // Add client to config
+    QString configPart = QString("[Peer]\n"
+                                 "PublicKey = %1\n"
+                                 "PresharedKey = %2\n"
+                                 "AllowedIPs = %3/32\n\n")
+                                 .arg(connData.clientPubKey, connData.pskKey, connData.clientIP);
+
+    errorCode = m_serverController->uploadTextFileToContainer(container, credentials, configPart, m_serverConfigPath,
+                                                              libssh::ScpOverwriteMode::ScpAppendToExisting);
+
+    if (errorCode != ErrorCode::NoError) {
+        return connData;
+    }
+
+    QString script = QString("sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip %1)'")
+                             .arg(m_serverConfigPath);
+
+    errorCode = m_serverController->runScript(
+            credentials,
+            m_serverController->replaceVars(script, generateProtocolVars(credentials, container)));
+
+    return connData;
+}
+
+QSharedPointer<ProtocolConfig> WireguardConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                               const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
+{
+    QSharedPointer<ProtocolConfig> result;
+    
+    if (m_isAwg) {
+        auto awgConfig = qSharedPointerCast<AwgProtocolConfig>(protocolConfig);
+        if (!awgConfig) {
+            errorCode = ErrorCode::InternalError;
+            return nullptr;
+        }
+        result = awgConfig;
+    } else {
+        auto wgConfig = qSharedPointerCast<WireGuardProtocolConfig>(protocolConfig);
+        if (!wgConfig) {
+            errorCode = ErrorCode::InternalError;
+            return nullptr;
+        }
+        result = wgConfig;
+    }
+
+    QString scriptData = amnezia::scriptData(m_configTemplate, container);
+    QString config = m_serverController->replaceVars(
+            scriptData, generateProtocolVars(credentials, container, protocolConfig));
+
+    ConnectionData connData = prepareWireguardConfig(credentials, container, protocolConfig, errorCode);
+    if (errorCode != ErrorCode::NoError) {
+        return nullptr;
+    }
+
+    config.replace("$WIREGUARD_CLIENT_PRIVATE_KEY", connData.clientPrivKey);
+    config.replace("$WIREGUARD_CLIENT_IP", connData.clientIP);
+    config.replace("$WIREGUARD_SERVER_PUBLIC_KEY", connData.serverPubKey);
+    config.replace("$WIREGUARD_PSK", connData.pskKey);
+
+    ProtocolConfigVariant variant = ProtocolConfig::getProtocolConfigVariant(result);
+    std::visit([&connData, &config](const auto &protocolConfig) -> void {
+        using ConfigType = std::decay_t<decltype(*protocolConfig)>;
+        if constexpr (std::is_same_v<ConfigType, AwgProtocolConfig> || std::is_same_v<ConfigType, WireGuardProtocolConfig>) {
+            protocolConfig->clientProtocolConfig.isEmpty = false;
+            protocolConfig->clientProtocolConfig.clientId = connData.clientPubKey;
+            protocolConfig->clientProtocolConfig.hostname = connData.host;
+            protocolConfig->clientProtocolConfig.port = connData.port.toInt();
+            protocolConfig->clientProtocolConfig.wireGuardData.clientPrivateKey = connData.clientPrivKey;
+            protocolConfig->clientProtocolConfig.wireGuardData.clientIp = connData.clientIP;
+            protocolConfig->clientProtocolConfig.wireGuardData.clientPublicKey = connData.clientPubKey;
+            protocolConfig->clientProtocolConfig.wireGuardData.pskKey = connData.pskKey;
+            protocolConfig->clientProtocolConfig.wireGuardData.serverPubKey = connData.serverPubKey;
+            protocolConfig->clientProtocolConfig.wireGuardData.mtu = protocolConfig->serverProtocolConfig.mtu;
+            protocolConfig->clientProtocolConfig.wireGuardData.persistentKeepAlive = "25";
+            protocolConfig->clientProtocolConfig.wireGuardData.allowedIps = QStringList{"0.0.0.0/0", "::/0"};
+            protocolConfig->clientProtocolConfig.nativeConfig = config;
+        }
+    }, variant);
+
+    return result;
+}
+
+void WireguardConfigurator::processConfigWithLocalSettings(const QPair<QString, QString> &dns,
+                                                           const bool isApiConfig, QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    processConfigWithDnsSettings(dns, protocolConfig);
+}
+
+void WireguardConfigurator::processConfigWithExportSettings(const QPair<QString, QString> &dns,
+                                                            const bool isApiConfig, QSharedPointer<ProtocolConfig> &protocolConfig)
+{
+    processConfigWithDnsSettings(dns, protocolConfig);
+}
@@ -0,0 +1,59 @@
+#ifndef WIREGUARD_CONFIGURATOR_H
+#define WIREGUARD_CONFIGURATOR_H
+
+#include <QHostAddress>
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/models/protocols/wireguardProtocolConfig.h"
+#include "core/models/protocols/awgProtocolConfig.h"
+#include "core/defs.h"
+#include "core/scripts_registry.h"
+
+class WireguardConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    WireguardConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController,
+                          bool isAwg, QObject *parent = nullptr);
+
+    struct ConnectionData
+    {
+        QString clientPrivKey; // client private key
+        QString clientPubKey;  // client public key
+        QString clientIP;      // internal client IP address
+        QString serverPubKey;  // tls-auth key
+        QString pskKey;        // preshared key
+        QString host;          // host ip
+        QString port;
+    };
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+
+    void processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                        QSharedPointer<ProtocolConfig> &protocolConfig) override;
+    void processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                         QSharedPointer<ProtocolConfig> &protocolConfig) override;
+
+    Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                             const QSharedPointer<ProtocolConfig> &protocolConfig) const override;
+
+    static ConnectionData genClientKeys();
+
+private:
+    QList<QHostAddress> getIpsFromConf(const QString &input);
+    ConnectionData prepareWireguardConfig(const ServerCredentials &credentials, DockerContainer container,
+                                          const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode);
+
+    bool m_isAwg;
+    QString m_serverConfigPath;
+    QString m_serverPublicKeyPath;
+    QString m_serverPskKeyPath;
+    amnezia::ProtocolScriptType m_configTemplate;
+    QString m_protocolName;
+    QString m_defaultPort;
+};
+
+#endif // WIREGUARD_CONFIGURATOR_H
@@ -1,43 +1,50 @@
-#include "xrayConfigurator.h"
+#include "xray_configurator.h"

 #include <QFile>
 #include <QJsonDocument>
 #include <QJsonObject>
-#include <QJsonArray>
 #include <QUuid>
 #include "logger.h"

-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/models/containerConfig.h"
+#include "core/models/containers/containers_defs.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/scripts_registry.h"
 #include "core/models/protocols/xrayProtocolConfig.h"
+#include "protocols/protocols_defs.h"

 namespace {
 Logger logger("XrayConfigurator");
 }

-XrayConfigurator::XrayConfigurator(SshSession* sshSession, QObject *parent)
-    : ConfiguratorBase(sshSession, parent)
+XrayConfigurator::XrayConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
 {
 }

+ConfiguratorBase::Vars XrayConfigurator::generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                                                              const QSharedPointer<ProtocolConfig> &protocolConfig) const
+{
+    Vars vars = generateCommonVars(credentials, container);
+
+    auto xrayConfig = qSharedPointerCast<XrayProtocolConfig>(protocolConfig);
+    if (!xrayConfig) {
+        return vars;
+    }
+
+    vars.append({{"$XRAY_SITE_NAME", xrayConfig->serverProtocolConfig.site}});
+    vars.append({{"$XRAY_SERVER_PORT", xrayConfig->serverProtocolConfig.port}});
+
+    return vars;
+}
+
 QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentials, DockerContainer container,
-                                               const ContainerConfig &containerConfig,
-                                               const DnsSettings &dnsSettings,
-                                               ErrorCode &errorCode)
+                                               const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
 {
    // Generate new UUID for client
    QString clientId = QUuid::createUuid().toString(QUuid::WithoutBraces);
    
    // Get current server config
-    QString currentConfig = m_sshSession->getTextFileFromContainer(
+    QString currentConfig = m_serverController->getTextFileFromContainer(
        container, credentials, amnezia::protocols::xray::serverConfigPath, errorCode);
    
    if (errorCode != ErrorCode::NoError) {
@@ -55,14 +62,13 @@ QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentia

    QJsonObject serverConfig = doc.object();
    
-    // Validate server config structure
-    if (!serverConfig.contains(amnezia::protocols::xray::inbounds)) {
+    if (!serverConfig.contains("inbounds")) {
        logger.error() << "Server config missing 'inbounds' field";
        errorCode = ErrorCode::InternalError;
        return "";
    }

-    QJsonArray inbounds = serverConfig[amnezia::protocols::xray::inbounds].toArray();
+    QJsonArray inbounds = serverConfig["inbounds"].toArray();
    if (inbounds.isEmpty()) {
        logger.error() << "Server config has empty 'inbounds' array";
        errorCode = ErrorCode::InternalError;
@@ -70,38 +76,38 @@ QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentia
    }
    
    QJsonObject inbound = inbounds[0].toObject();
-    if (!inbound.contains(amnezia::protocols::xray::settings)) {
+    if (!inbound.contains("settings")) {
        logger.error() << "Inbound missing 'settings' field";
        errorCode = ErrorCode::InternalError;
        return "";
    }

-    QJsonObject settings = inbound[amnezia::protocols::xray::settings].toObject();
-    if (!settings.contains(amnezia::protocols::xray::clients)) {
+    QJsonObject settings = inbound["settings"].toObject();
+    if (!settings.contains("clients")) {
        logger.error() << "Settings missing 'clients' field";
        errorCode = ErrorCode::InternalError;
        return "";
    }

-    QJsonArray clients = settings[amnezia::protocols::xray::clients].toArray();
+    QJsonArray clients = settings["clients"].toArray();
    
    // Create configuration for new client
    QJsonObject clientConfig {
-        {amnezia::protocols::xray::id, clientId},
-        {amnezia::protocols::xray::flow, "xtls-rprx-vision"}
+        {"id", clientId},
+        {"flow", "xtls-rprx-vision"}
    };
    
    clients.append(clientConfig);
    
    // Update config
-    settings[amnezia::protocols::xray::clients] = clients;
-    inbound[amnezia::protocols::xray::settings] = settings;
+    settings["clients"] = clients;
+    inbound["settings"] = settings;
    inbounds[0] = inbound;
-    serverConfig[amnezia::protocols::xray::inbounds] = inbounds;
+    serverConfig["inbounds"] = inbounds;
    
    // Save updated config to server
    QString updatedConfig = QJsonDocument(serverConfig).toJson();
-    errorCode = m_sshSession->uploadTextFileToContainer(
+    errorCode = m_serverController->uploadTextFileToContainer(
        container, 
        credentials, 
        updatedConfig,
@@ -115,9 +121,9 @@ QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentia

    // Restart container
    QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
-    errorCode = m_sshSession->runScript(
+    errorCode = m_serverController->runScript(
        credentials, 
-        m_sshSession->replaceVars(restartScript, amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns))
+        m_serverController->replaceVars(restartScript, generateProtocolVars(credentials, container))
    );

    if (errorCode != ErrorCode::NoError) {
@@ -128,75 +134,67 @@ QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentia
    return clientId;
 }

-ProtocolConfig XrayConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                               const ContainerConfig &containerConfig,
-                                               const DnsSettings &dnsSettings,
-                                               ErrorCode &errorCode)
+QSharedPointer<ProtocolConfig> XrayConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                           const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode)
 {
-    const XrayServerConfig* serverConfig = nullptr;
-    if (auto* xrayConfig = containerConfig.protocolConfig.as<XrayProtocolConfig>()) {
-        serverConfig = &xrayConfig->serverConfig;
+    auto xrayConfig = qSharedPointerCast<XrayProtocolConfig>(protocolConfig);
+    if (!xrayConfig) {
+        errorCode = ErrorCode::InternalError;
+        return nullptr;
    }
-    
-    QString xrayClientId = prepareServerConfig(credentials, container, containerConfig, dnsSettings, errorCode);
+
+    // Get client ID from prepareServerConfig
+    QString xrayClientId = prepareServerConfig(credentials, container, protocolConfig, errorCode);
    if (errorCode != ErrorCode::NoError || xrayClientId.isEmpty()) {
        logger.error() << "Failed to prepare server config";
        errorCode = ErrorCode::InternalError;
-        return XrayProtocolConfig{};
+        return nullptr;
    }

-    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
-    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
-    QString config = m_sshSession->replaceVars(amnezia::scriptData(ProtocolScriptType::xray_template, container), vars);
+    QString config = m_serverController->replaceVars(amnezia::scriptData(ProtocolScriptType::xray_template, container),
+                                                     generateProtocolVars(credentials, container, protocolConfig));
    
    if (config.isEmpty()) {
        logger.error() << "Failed to get config template";
        errorCode = ErrorCode::InternalError;
-        return XrayProtocolConfig{};
+        return nullptr;
    }

    QString xrayPublicKey =
-            m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::PublicKeyPath, errorCode);
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::PublicKeyPath, errorCode);
    if (errorCode != ErrorCode::NoError || xrayPublicKey.isEmpty()) {
        logger.error() << "Failed to get public key";
        errorCode = ErrorCode::InternalError;
-        return XrayProtocolConfig{};
+        return nullptr;
    }
    xrayPublicKey.replace("\n", "");
    
    QString xrayShortId =
-            m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::shortidPath, errorCode);
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::shortidPath, errorCode);
    if (errorCode != ErrorCode::NoError || xrayShortId.isEmpty()) {
        logger.error() << "Failed to get short ID";
        errorCode = ErrorCode::InternalError;
-        return XrayProtocolConfig{};
+        return nullptr;
    }
    xrayShortId.replace("\n", "");

+    // Validate all required variables are present
    if (!config.contains("$XRAY_CLIENT_ID") || !config.contains("$XRAY_PUBLIC_KEY") || !config.contains("$XRAY_SHORT_ID")) {
        logger.error() << "Config template missing required variables:"
                      << "XRAY_CLIENT_ID:" << !config.contains("$XRAY_CLIENT_ID")
                      << "XRAY_PUBLIC_KEY:" << !config.contains("$XRAY_PUBLIC_KEY")
                      << "XRAY_SHORT_ID:" << !config.contains("$XRAY_SHORT_ID");
        errorCode = ErrorCode::InternalError;
-        return XrayProtocolConfig{};
+        return nullptr;
    }

    config.replace("$XRAY_CLIENT_ID", xrayClientId);
    config.replace("$XRAY_PUBLIC_KEY", xrayPublicKey);
    config.replace("$XRAY_SHORT_ID", xrayShortId);

-    XrayProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    }
-    
-    XrayClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    clientConfig.localPort = "";
-    clientConfig.id = xrayClientId;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
+    xrayConfig->clientProtocolConfig.isEmpty = false;
+    xrayConfig->clientProtocolConfig.clientId = xrayClientId;
+    xrayConfig->clientProtocolConfig.nativeConfig = config;
+
+    return xrayConfig;
 }
@@ -0,0 +1,27 @@
+#ifndef XRAY_CONFIGURATOR_H
+#define XRAY_CONFIGURATOR_H
+
+#include <QObject>
+
+#include "configurator_base.h"
+#include "core/models/protocols/xrayProtocolConfig.h"
+#include "core/defs.h"
+
+class XrayConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    XrayConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QSharedPointer<ProtocolConfig> createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode) override;
+
+    Vars generateProtocolVars(const ServerCredentials &credentials, DockerContainer container,
+                             const QSharedPointer<ProtocolConfig> &protocolConfig) const override;
+
+private:
+    QString prepareServerConfig(const ServerCredentials &credentials, DockerContainer container,
+                                const QSharedPointer<ProtocolConfig> &protocolConfig, ErrorCode &errorCode);
+};
+
+#endif // XRAY_CONFIGURATOR_H
@@ -0,0 +1,67 @@
+#ifndef APIDEFS_H
+#define APIDEFS_H
+
+#include <QString>
+
+namespace apiDefs
+{
+    enum ConfigType {
+        AmneziaFreeV2 = 0,
+        AmneziaFreeV3,
+        AmneziaPremiumV1,
+        AmneziaPremiumV2,
+        SelfHosted,
+        ExternalPremium
+    };
+
+    namespace key
+    {
+        constexpr QLatin1String configVersion("config_version");
+        constexpr QLatin1String apiEndpoint("api_endpoint");
+        constexpr QLatin1String apiKey("api_key");
+        constexpr QLatin1String description("description");
+        constexpr QLatin1String name("name");
+        constexpr QLatin1String protocol("protocol");
+
+        constexpr QLatin1String apiConfig("api_config");
+        constexpr QLatin1String stackType("stack_type");
+        constexpr QLatin1String serviceType("service_type");
+        constexpr QLatin1String cliVersion("cli_version");
+        constexpr QLatin1String supportedProtocols("supported_protocols");
+
+        constexpr QLatin1String vpnKey("vpn_key");
+        constexpr QLatin1String config("config");
+        constexpr QLatin1String configs("configs");
+
+        constexpr QLatin1String installationUuid("installation_uuid");
+        constexpr QLatin1String workerLastUpdated("worker_last_updated");
+        constexpr QLatin1String lastDownloaded("last_downloaded");
+        constexpr QLatin1String sourceType("source_type");
+
+        constexpr QLatin1String serverCountryCode("server_country_code");
+        constexpr QLatin1String serverCountryName("server_country_name");
+
+        constexpr QLatin1String osVersion("os_version");
+
+        constexpr QLatin1String availableCountries("available_countries");
+        constexpr QLatin1String activeDeviceCount("active_device_count");
+        constexpr QLatin1String maxDeviceCount("max_device_count");
+        constexpr QLatin1String subscriptionEndDate("subscription_end_date");
+        constexpr QLatin1String issuedConfigs("issued_configs");
+
+        constexpr QLatin1String supportInfo("support_info");
+        constexpr QLatin1String email("email");
+        constexpr QLatin1String billingEmail("billing_email");
+        constexpr QLatin1String website("website");
+        constexpr QLatin1String websiteName("website_name");
+        constexpr QLatin1String telegram("telegram");
+
+        constexpr QLatin1String id("id");
+        constexpr QLatin1String orderId("order_id");
+        constexpr QLatin1String migrationCode("migration_code");
+    }
+
+    const int requestTimeoutMsecs = 12 * 1000; // 12 secs
+}
+
+#endif // APIDEFS_H
@@ -0,0 +1,164 @@
+#include "apiUtils.h"
+
+#include <QDateTime>
+#include <QJsonObject>
+
+namespace
+{
+    const QByteArray AMNEZIA_CONFIG_SIGNATURE = QByteArray::fromHex("000000ff");
+
+    QString escapeUnicode(const QString &input)
+    {
+        QString output;
+        for (QChar c : input) {
+            if (c.unicode() < 0x20 || c.unicode() > 0x7E) {
+                output += QString("\\u%1").arg(QString::number(c.unicode(), 16).rightJustified(4, '0'));
+            } else {
+                output += c;
+            }
+        }
+        return output;
+    }
+}
+
+bool apiUtils::isSubscriptionExpired(const QString &subscriptionEndDate)
+{
+    QDateTime now = QDateTime::currentDateTime();
+    QDateTime endDate = QDateTime::fromString(subscriptionEndDate, Qt::ISODateWithMs);
+    return endDate < now;
+}
+
+bool apiUtils::isServerFromApi(const QJsonObject &serverConfigObject)
+{
+    auto configVersion = serverConfigObject.value(apiDefs::key::configVersion).toInt();
+    switch (configVersion) {
+    case amnezia::ServerConfigType::ApiV1: return true;
+    case amnezia::ServerConfigType::ApiV2: return true;
+    default: return false;
+    }
+}
+
+apiDefs::ConfigType apiUtils::getConfigType(const QJsonObject &serverConfigObject)
+{
+    auto configVersion = serverConfigObject.value(apiDefs::key::configVersion).toInt();
+
+    switch (configVersion) {
+    case amnezia::ServerConfigType::ApiV1: {
+        constexpr QLatin1String freeV2Endpoint(FREE_V2_ENDPOINT);
+        constexpr QLatin1String premiumV1Endpoint(PREM_V1_ENDPOINT);
+
+        auto apiEndpoint = serverConfigObject.value(apiDefs::key::apiEndpoint).toString();
+
+        if (apiEndpoint.contains(premiumV1Endpoint)) {
+            return apiDefs::ConfigType::AmneziaPremiumV1;
+        } else if (apiEndpoint.contains(freeV2Endpoint)) {
+            return apiDefs::ConfigType::AmneziaFreeV2;
+        }
+    };
+    case amnezia::ServerConfigType::ApiV2: {
+        constexpr QLatin1String servicePremium("amnezia-premium");
+        constexpr QLatin1String serviceFree("amnezia-free");
+        constexpr QLatin1String serviceExternalPremium("external-premium");
+
+        auto apiConfigObject = serverConfigObject.value(apiDefs::key::apiConfig).toObject();
+        auto serviceType = apiConfigObject.value(apiDefs::key::serviceType).toString();
+
+        if (serviceType == servicePremium) {
+            return apiDefs::ConfigType::AmneziaPremiumV2;
+        } else if (serviceType == serviceFree) {
+            return apiDefs::ConfigType::AmneziaFreeV3;
+        } else if (serviceType == serviceExternalPremium) {
+            return apiDefs::ConfigType::ExternalPremium;
+        }
+    }
+    default: {
+        return apiDefs::ConfigType::SelfHosted;
+    }
+    };
+}
+
+amnezia::ServerConfigType apiUtils::getConfigSource(const QJsonObject &serverConfigObject)
+{
+    return static_cast<amnezia::ServerConfigType>(serverConfigObject.value(apiDefs::key::configVersion).toInt());
+}
+
+amnezia::ErrorCode apiUtils::checkNetworkReplyErrors(const QList<QSslError> &sslErrors, QNetworkReply *reply)
+{
+    const int httpStatusCodeConflict = 409;
+    const int httpStatusCodeNotFound = 404;
+
+    if (!sslErrors.empty()) {
+        qDebug().noquote() << sslErrors;
+        return amnezia::ErrorCode::ApiConfigSslError;
+    } else if (reply->error() == QNetworkReply::NoError) {
+        return amnezia::ErrorCode::NoError;
+    } else if (reply->error() == QNetworkReply::NetworkError::OperationCanceledError
+               || reply->error() == QNetworkReply::NetworkError::TimeoutError) {
+        qDebug() << reply->error();
+        return amnezia::ErrorCode::ApiConfigTimeoutError;
+    } else if (reply->error() == QNetworkReply::NetworkError::OperationNotImplementedError) {
+        qDebug() << reply->error();
+        return amnezia::ErrorCode::ApiUpdateRequestError;
+    } else {
+        QString err = reply->errorString();
+        int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+        qDebug() << QString::fromUtf8(reply->readAll());
+        qDebug() << reply->error();
+        qDebug() << err;
+        qDebug() << httpStatusCode;
+        if (httpStatusCode == httpStatusCodeConflict) {
+            return amnezia::ErrorCode::ApiConfigLimitError;
+        } else if (httpStatusCode == httpStatusCodeNotFound) {
+            return amnezia::ErrorCode::ApiNotFoundError;
+        }
+        return amnezia::ErrorCode::ApiConfigDownloadError;
+    }
+
+    qDebug() << "something went wrong";
+    return amnezia::ErrorCode::InternalError;
+}
+
+bool apiUtils::isPremiumServer(const QJsonObject &serverConfigObject)
+{
+    static const QSet<apiDefs::ConfigType> premiumTypes = { apiDefs::ConfigType::AmneziaPremiumV1, apiDefs::ConfigType::AmneziaPremiumV2,
+                                                            apiDefs::ConfigType::ExternalPremium };
+    return premiumTypes.contains(getConfigType(serverConfigObject));
+}
+
+QString apiUtils::getPremiumV1VpnKey(const QJsonObject &serverConfigObject)
+{
+    if (apiUtils::getConfigType(serverConfigObject) != apiDefs::ConfigType::AmneziaPremiumV1) {
+        return {};
+    }
+
+    QList<QPair<QString, QVariant>> orderedFields;
+    orderedFields.append(qMakePair(apiDefs::key::name, serverConfigObject[apiDefs::key::name].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::description, serverConfigObject[apiDefs::key::description].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::configVersion, serverConfigObject[apiDefs::key::configVersion].toDouble()));
+    orderedFields.append(qMakePair(apiDefs::key::protocol, serverConfigObject[apiDefs::key::protocol].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::apiEndpoint, serverConfigObject[apiDefs::key::apiEndpoint].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::apiKey, serverConfigObject[apiDefs::key::apiKey].toString()));
+
+    QString vpnKeyStr = "{";
+    for (int i = 0; i < orderedFields.size(); ++i) {
+        const auto &pair = orderedFields[i];
+        if (pair.second.typeId() == QMetaType::Type::QString) {
+            vpnKeyStr += "\"" + pair.first + "\": \"" + pair.second.toString() + "\"";
+        } else if (pair.second.typeId() == QMetaType::Type::Double || pair.second.typeId() == QMetaType::Type::Int) {
+            vpnKeyStr += "\"" + pair.first + "\": " + QString::number(pair.second.toDouble(), 'f', 1);
+        }
+
+        if (i < orderedFields.size() - 1) {
+            vpnKeyStr += ", ";
+        }
+    }
+    vpnKeyStr += "}";
+
+    QByteArray vpnKeyCompressed = escapeUnicode(vpnKeyStr).toUtf8();
+    vpnKeyCompressed = qCompress(vpnKeyCompressed, 6);
+    vpnKeyCompressed = vpnKeyCompressed.mid(4);
+
+    QByteArray signedData = AMNEZIA_CONFIG_SIGNATURE + vpnKeyCompressed;
+
+    return QString("vpn://%1").arg(QString(signedData.toBase64(QByteArray::Base64UrlEncoding)));
+}
@@ -0,0 +1,26 @@
+#ifndef APIUTILS_H
+#define APIUTILS_H
+
+#include <QNetworkReply>
+#include <QObject>
+
+#include "apiDefs.h"
+#include "core/defs.h"
+
+namespace apiUtils
+{
+    bool isServerFromApi(const QJsonObject &serverConfigObject);
+
+    bool isSubscriptionExpired(const QString &subscriptionEndDate);
+
+    bool isPremiumServer(const QJsonObject &serverConfigObject);
+
+    apiDefs::ConfigType getConfigType(const QJsonObject &serverConfigObject);
+    amnezia::ServerConfigType getConfigSource(const QJsonObject &serverConfigObject);
+
+    amnezia::ErrorCode checkNetworkReplyErrors(const QList<QSslError> &sslErrors, QNetworkReply *reply);
+
+    QString getPremiumV1VpnKey(const QJsonObject &serverConfigObject);
+}
+
+#endif // APIUTILS_H
@@ -1,109 +0,0 @@
-#include "awgConfigurator.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/awgProtocolConfig.h"
-
-#include <QJsonDocument>
-#include <QJsonObject>
-
-using namespace amnezia;
-
-AwgConfigurator::AwgConfigurator(SshSession* sshSession, QObject *parent)
-    : WireguardConfigurator(sshSession, true, parent)
-{
-}
-
-ProtocolConfig AwgConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const ContainerConfig &containerConfig,
-                                              const DnsSettings &dnsSettings,
-                                              ErrorCode &errorCode)
-{
-    const AwgServerConfig* serverConfig = nullptr;
-    const AwgClientConfig* clientConfig = nullptr;
-    
-    if (auto* awgProtocolConfig = containerConfig.getAwgProtocolConfig()) {
-        serverConfig = &awgProtocolConfig->serverConfig;
-        if (awgProtocolConfig->clientConfig.has_value()) {
-            clientConfig = &awgProtocolConfig->clientConfig.value();
-        }
-    }
-    
-    ProtocolConfig wireguardConfig = WireguardConfigurator::createConfig(credentials, container, containerConfig, dnsSettings, errorCode);
-    if (errorCode != ErrorCode::NoError) {
-        return AwgProtocolConfig{};
-    }
-    
-    WireGuardProtocolConfig* wgConfig = wireguardConfig.as<WireGuardProtocolConfig>();
-    if (!wgConfig || !wgConfig->clientConfig.has_value()) {
-        errorCode = ErrorCode::InternalError;
-        return AwgProtocolConfig{};
-    }
-    
-    QString awgConfig = wgConfig->clientConfig->nativeConfig;
-
-    QMap<QString, QString> configMap;
-    auto configLines = awgConfig.split("\n");
-    for (auto &line : configLines) {
-        auto trimmedLine = line.trimmed();
-        if (trimmedLine.startsWith("[") && trimmedLine.endsWith("]")) {
-            continue;
-        } else {
-            QStringList parts = trimmedLine.split(" = ");
-            if (parts.count() == 2) {
-                configMap.insert(parts[0].trimmed(), parts[1].trimmed());
-            }
-        }
-    }
-
-    AwgProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    }
-    
-    AwgClientConfig newClientConfig;
-    newClientConfig.nativeConfig = awgConfig;
-    newClientConfig.hostName = wgConfig->clientConfig->hostName;
-    newClientConfig.port = wgConfig->clientConfig->port;
-    newClientConfig.clientIp = wgConfig->clientConfig->clientIp;
-    newClientConfig.clientPrivateKey = wgConfig->clientConfig->clientPrivateKey;
-    newClientConfig.clientPublicKey = wgConfig->clientConfig->clientPublicKey;
-    newClientConfig.serverPublicKey = wgConfig->clientConfig->serverPublicKey;
-    newClientConfig.presharedKey = wgConfig->clientConfig->presharedKey;
-    newClientConfig.clientId = wgConfig->clientConfig->clientId;
-    newClientConfig.allowedIps = wgConfig->clientConfig->allowedIps;
-    newClientConfig.persistentKeepAlive = wgConfig->clientConfig->persistentKeepAlive;
-    
-    QString mtu = protocols::awg::defaultMtu;
-    if (clientConfig && !clientConfig->mtu.isEmpty()) {
-        mtu = clientConfig->mtu;
-    }
-    newClientConfig.mtu = mtu;
-    
-    newClientConfig.junkPacketCount = configMap.value(configKey::junkPacketCount);
-    newClientConfig.junkPacketMinSize = configMap.value(configKey::junkPacketMinSize);
-    newClientConfig.junkPacketMaxSize = configMap.value(configKey::junkPacketMaxSize);
-    newClientConfig.initPacketJunkSize = configMap.value(configKey::initPacketJunkSize);
-    newClientConfig.responsePacketJunkSize = configMap.value(configKey::responsePacketJunkSize);
-    newClientConfig.initPacketMagicHeader = configMap.value(configKey::initPacketMagicHeader);
-    newClientConfig.responsePacketMagicHeader = configMap.value(configKey::responsePacketMagicHeader);
-    newClientConfig.underloadPacketMagicHeader = configMap.value(configKey::underloadPacketMagicHeader);
-    newClientConfig.transportPacketMagicHeader = configMap.value(configKey::transportPacketMagicHeader);
-    newClientConfig.specialJunk1 = configMap.value(configKey::specialJunk1);
-    newClientConfig.specialJunk2 = configMap.value(configKey::specialJunk2);
-    newClientConfig.specialJunk3 = configMap.value(configKey::specialJunk3);
-    newClientConfig.specialJunk4 = configMap.value(configKey::specialJunk4);
-    newClientConfig.specialJunk5 = configMap.value(configKey::specialJunk5);
-    
-    if (container == DockerContainer::Awg2) {
-        newClientConfig.cookieReplyPacketJunkSize = configMap.value(configKey::cookieReplyPacketJunkSize);
-        newClientConfig.transportPacketJunkSize = configMap.value(configKey::transportPacketJunkSize);
-    }
-    
-    newClientConfig.isObfuscationEnabled = false;
-    
-    protocolConfig.setClientConfig(newClientConfig);
-    
-    return protocolConfig;
-}
@@ -1,20 +0,0 @@
-#ifndef AWGCONFIGURATOR_H
-#define AWGCONFIGURATOR_H
-
-#include <QObject>
-
-#include "wireguardConfigurator.h"
-
-class AwgConfigurator : public WireguardConfigurator
-{
-    Q_OBJECT
-public:
-    AwgConfigurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-};
-
-#endif // AWGCONFIGURATOR_H
@@ -1,50 +0,0 @@
-#include "configuratorBase.h"
-
-#include "core/configurators/awgConfigurator.h"
-#include "core/configurators/ikev2Configurator.h"
-#include "core/configurators/openVpnConfigurator.h"
-#include "core/configurators/wireguardConfigurator.h"
-#include "core/configurators/xrayConfigurator.h"
-
-using namespace amnezia;
-
-ConfiguratorBase::ConfiguratorBase(SshSession* sshSession, QObject *parent)
-    : QObject { parent }, m_sshSession(sshSession)
-{
-}
-
-QScopedPointer<ConfiguratorBase> ConfiguratorBase::create(Proto protocol,
-                                                          SshSession* sshSession)
-{
-    switch (protocol) {
-    case Proto::OpenVpn: return QScopedPointer<ConfiguratorBase>(new OpenVpnConfigurator(sshSession));
-    case Proto::WireGuard: return QScopedPointer<ConfiguratorBase>(new WireguardConfigurator(sshSession, false));
-    case Proto::Awg: return QScopedPointer<ConfiguratorBase>(new AwgConfigurator(sshSession));
-    case Proto::Ikev2: return QScopedPointer<ConfiguratorBase>(new Ikev2Configurator(sshSession));
-    case Proto::Xray: return QScopedPointer<ConfiguratorBase>(new XrayConfigurator(sshSession));
-    case Proto::SSXray: return QScopedPointer<ConfiguratorBase>(new XrayConfigurator(sshSession));
-    default: return QScopedPointer<ConfiguratorBase>();
-    }
-}
-
-ProtocolConfig ConfiguratorBase::processConfigWithLocalSettings(const ConnectionSettings &settings,
-                                                                 ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-    return protocolConfig;
-}
-
-ProtocolConfig ConfiguratorBase::processConfigWithExportSettings(const ExportSettings &settings,
-                                                                 ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-    return protocolConfig;
-}
-
-void ConfiguratorBase::applyDnsToNativeConfig(const DnsSettings &dns, ProtocolConfig &protocolConfig)
-{
-    QString config = protocolConfig.nativeConfig();
-    config.replace("$PRIMARY_DNS", dns.primaryDns);
-    config.replace("$SECONDARY_DNS", dns.secondaryDns);
-    protocolConfig.setNativeConfig(config);
-}
@@ -1,43 +0,0 @@
-#ifndef CONFIGURATORBASE_H
-#define CONFIGURATORBASE_H
-
-#include <QObject>
-#include <QScopedPointer>
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocolConfig.h"
-
-class SshSession;
-
-class ConfiguratorBase : public QObject
-{
-    Q_OBJECT
-public:
-    explicit ConfiguratorBase(SshSession* sshSession, QObject *parent = nullptr);
-
-    static QScopedPointer<ConfiguratorBase> create(amnezia::Proto protocol,
-                                                   SshSession* sshSession);
-
-    virtual amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                        const amnezia::ContainerConfig &containerConfig,
-                                        const amnezia::DnsSettings &dnsSettings,
-                                        amnezia::ErrorCode &errorCode) = 0;
-
-    virtual amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                                   amnezia::ProtocolConfig protocolConfig);
-    virtual amnezia::ProtocolConfig processConfigWithExportSettings(const amnezia::ExportSettings &settings,
-                                                                     amnezia::ProtocolConfig protocolConfig);
-
-protected:
-    void applyDnsToNativeConfig(const amnezia::DnsSettings &dns, amnezia::ProtocolConfig &protocolConfig);
-
-    SshSession* m_sshSession;
-};
-
-#endif // CONFIGURATORBASE_H
@@ -1,143 +0,0 @@
-#include "ikev2Configurator.h"
-
-#include <QDebug>
-#include <QJsonDocument>
-#include <QProcess>
-#include <QString>
-#include <QTemporaryDir>
-#include <QTemporaryFile>
-#include <QUuid>
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/utilities.h"
-#include "core/models/protocols/ikev2ProtocolConfig.h"
-
-Ikev2Configurator::Ikev2Configurator(SshSession* sshSession, QObject *parent)
-    : ConfiguratorBase(sshSession, parent)
-{
-}
-
-Ikev2Configurator::ConnectionData Ikev2Configurator::prepareIkev2Config(const ServerCredentials &credentials, DockerContainer container,
-                                                                        ErrorCode &errorCode)
-{
-    Ikev2Configurator::ConnectionData connData;
-    connData.host = credentials.hostName;
-    connData.clientId = Utils::getRandomString(16);
-    connData.password = "";
-
-    QString certFileName = "/opt/amnezia/ikev2/clients/" + connData.clientId + ".p12";
-
-    QString scriptCreateCert = QString("certutil -z <(head -c 1024 /dev/urandom) "
-                                       "-S -c \"IKEv2 VPN CA\" -n \"%1\" "
-                                       "-s \"O=IKEv2 VPN,CN=%1\" "
-                                       "-k rsa -g 3072 -v 120 "
-                                       "-d sql:/etc/ipsec.d -t \",,\" "
-                                       "--keyUsage digitalSignature,keyEncipherment "
-                                       "--extKeyUsage serverAuth,clientAuth -8 \"%1\"")
-                                       .arg(connData.clientId);
-
-    errorCode = m_sshSession->runContainerScript(credentials, container, scriptCreateCert);
-
-    QString scriptExportCert =
-            QString("pk12util -W \"%1\" -d sql:/etc/ipsec.d -n \"%2\" -o \"%3\"").arg(connData.password).arg(connData.clientId).arg(certFileName);
-    errorCode = m_sshSession->runContainerScript(credentials, container, scriptExportCert);
-
-    connData.clientCert = m_sshSession->getTextFileFromContainer(container, credentials, certFileName, errorCode);
-    connData.caCert = m_sshSession->getTextFileFromContainer(container, credentials, "/etc/ipsec.d/ca_cert_base64.p12", errorCode);
-
-    qDebug() << "Ikev2Configurator::ConnectionData client cert size:" << connData.clientCert.size();
-    qDebug() << "Ikev2Configurator::ConnectionData ca cert size:" << connData.caCert.size();
-
-    return connData;
-}
-
-ProtocolConfig Ikev2Configurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const ContainerConfig &containerConfig,
-                                               const DnsSettings &dnsSettings,
-                                               ErrorCode &errorCode)
-{
-    const Ikev2ServerConfig* serverConfig = nullptr;
-    if (auto* ikev2Config = containerConfig.protocolConfig.as<Ikev2ProtocolConfig>()) {
-        serverConfig = &ikev2Config->serverConfig;
-    }
-
-    ConnectionData connData = prepareIkev2Config(credentials, container, errorCode);
-    if (errorCode != ErrorCode::NoError) {
-        return Ikev2ProtocolConfig{};
-    }
-
-    QString configJson = genIkev2Config(connData);
-    QJsonDocument doc = QJsonDocument::fromJson(configJson.toUtf8());
-    QJsonObject configObj = doc.object();
-
-    Ikev2ProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    } else {
-        protocolConfig.serverConfig.hostName = connData.host;
-    }
-    
-    Ikev2ClientConfig clientConfig;
-    clientConfig.nativeConfig = configJson;
-    clientConfig.hostName = connData.host;
-    clientConfig.userName = connData.clientId;
-    clientConfig.cert = QString(connData.clientCert.toBase64());
-    clientConfig.password = connData.password;
-    clientConfig.clientId = connData.clientId;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
-}
-
-QString Ikev2Configurator::genIkev2Config(const ConnectionData &connData)
-{
-    QJsonObject config;
-    config[configKey::hostName] = connData.host;
-    config[configKey::userName] = connData.clientId;
-    config[configKey::cert] = QString(connData.clientCert.toBase64());
-    config[configKey::password] = connData.password;
-
-    return QJsonDocument(config).toJson();
-}
-
-QString Ikev2Configurator::genMobileConfig(const ConnectionData &connData)
-{
-    QFile file(":/server_scripts/ipsec/mobileconfig.plist");
-    file.open(QIODevice::ReadOnly);
-    QString config = QString(file.readAll());
-
-    config.replace("$CLIENT_NAME", connData.clientId);
-    config.replace("$UUID1", QUuid::createUuid().toString());
-    config.replace("$SERVER_ADDR", connData.host);
-
-    QString subStr("$(UUID_GEN)");
-    while (config.indexOf(subStr) > 0) {
-        config.replace(config.indexOf(subStr), subStr.size(), QUuid::createUuid().toString());
-    }
-
-    config.replace("$P12_BASE64", connData.clientCert.toBase64());
-    config.replace("$CA_BASE64", connData.caCert.toBase64());
-
-    return config;
-}
-
-QString Ikev2Configurator::genStrongSwanConfig(const ConnectionData &connData)
-{
-    QFile file(":/server_scripts/ipsec/strongswan.profile");
-    file.open(QIODevice::ReadOnly);
-    QString config = QString(file.readAll());
-
-    config.replace("$CLIENT_NAME", connData.clientId);
-    config.replace("$UUID", QUuid::createUuid().toString());
-    config.replace("$SERVER_ADDR", connData.host);
-
-    QByteArray cert = connData.clientCert.toBase64();
-    cert.replace("\r", "").replace("\n", "");
-    config.replace("$P12_BASE64", cert);
-
-    return config;
-}
@@ -1,39 +0,0 @@
-#ifndef IKEV2_CONFIGURATOR_H
-#define IKEV2_CONFIGURATOR_H
-
-#include <QObject>
-#include <QProcessEnvironment>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-
-class Ikev2Configurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    Ikev2Configurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    struct ConnectionData {
-        QByteArray clientCert; // p12 client cert
-        QByteArray caCert; // p12 server cert
-        QString clientId;
-        QString password; // certificate password
-        QString host; // host ip
-    };
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-
-    QString genIkev2Config(const ConnectionData &connData);
-    QString genMobileConfig(const ConnectionData &connData);
-    QString genStrongSwanConfig(const ConnectionData &connData);
-
-    ConnectionData prepareIkev2Config(const amnezia::ServerCredentials &credentials,
-        amnezia::DockerContainer container, amnezia::ErrorCode &errorCode);
-};
-
-#endif // IKEV2_CONFIGURATOR_H
@@ -1,326 +0,0 @@
-#include "openVpnConfigurator.h"
-
-#include <QDebug>
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QRegularExpression>
-#include <QProcess>
-#include <QString>
-#include <QTemporaryDir>
-#include <QTemporaryFile>
-#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
-    #include <QGuiApplication>
-#else
-    #include <QApplication>
-#endif
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/utils/networkUtilities.h"
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/utilities.h"
-#include "core/models/protocols/openVpnProtocolConfig.h"
-
-using namespace amnezia;
-
-#include <openssl/pem.h>
-#include <openssl/rsa.h>
-#include <openssl/x509.h>
-
-
-OpenVpnConfigurator::OpenVpnConfigurator(SshSession* sshSession, QObject *parent)
-    : ConfiguratorBase(sshSession, parent)
-{
-}
-
-OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::prepareOpenVpnConfig(const ServerCredentials &credentials,
-                                                                              DockerContainer container, 
-                                                                              const DnsSettings &dnsSettings,
-                                                                              ErrorCode &errorCode)
-{
-    OpenVpnConfigurator::ConnectionData connData = OpenVpnConfigurator::createCertRequest();
-    connData.host = credentials.hostName;
-
-    if (connData.privKey.isEmpty() || connData.request.isEmpty()) {
-        errorCode = ErrorCode::OpenSslFailed;
-        return connData;
-    }
-
-    QString reqFileName = QString("%1/%2.req").arg(amnezia::protocols::openvpn::clientsDirPath).arg(connData.clientId);
-
-    errorCode = m_sshSession->uploadTextFileToContainer(container, credentials, connData.request, reqFileName);
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-
-    errorCode = signCert(container, credentials, dnsSettings, connData.clientId);
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-
-    connData.caCert =
-            m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::caCertPath, errorCode);
-    connData.clientCert = m_sshSession->getTextFileFromContainer(
-            container, credentials, QString("%1/%2.crt").arg(amnezia::protocols::openvpn::clientCertPath).arg(connData.clientId), errorCode);
-
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-
-    connData.taKey = m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::taKeyPath, errorCode);
-
-    if (connData.caCert.isEmpty() || connData.clientCert.isEmpty() || connData.taKey.isEmpty()) {
-        errorCode = ErrorCode::SshScpFailureError;
-    }
-
-    return connData;
-}
-
-ProtocolConfig OpenVpnConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                                  const ContainerConfig &containerConfig,
-                                                  const DnsSettings &dnsSettings,
-                                                  ErrorCode &errorCode)
-{
-    const OpenVpnServerConfig* serverConfig = nullptr;
-    if (auto* openVpnProtocolConfig = containerConfig.getOpenVpnProtocolConfig()) {
-        serverConfig = &openVpnProtocolConfig->serverConfig;
-    }
-    
-    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
-    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
-    QString config = m_sshSession->replaceVars(amnezia::scriptData(ProtocolScriptType::openvpn_template, container), vars);
-
-    ConnectionData connData = prepareOpenVpnConfig(credentials, container, dnsSettings, errorCode);
-    if (errorCode != ErrorCode::NoError) {
-        return OpenVpnProtocolConfig{};
-    }
-
-    auto sanitizeStaticKey = [](const QString &key) {
-        QStringList lines = key.split('\n');
-        QStringList filtered;
-        filtered.reserve(lines.size());
-        for (const QString &line : lines) {
-            const QString trimmed = line.trimmed();
-            if (trimmed.startsWith('#')) {
-                continue;
-            }
-            filtered.append(line);
-        }
-        QString result = filtered.join('\n');
-        if (!result.endsWith('\n')) {
-            result.append('\n');
-        }
-        return result;
-    };
-
-    config.replace("$OPENVPN_CA_CERT", connData.caCert);
-    config.replace("$OPENVPN_CLIENT_CERT", connData.clientCert);
-    config.replace("$OPENVPN_PRIV_KEY", connData.privKey);
-
-    if (config.contains("$OPENVPN_TA_KEY")) {
-        config.replace("$OPENVPN_TA_KEY", sanitizeStaticKey(connData.taKey));
-    } else {
-        config.replace("<tls-auth>", "");
-        config.replace("</tls-auth>", "");
-    }
-
-#ifndef MZ_WINDOWS
-    config.replace("block-outside-dns", "");
-#endif
-
-    OpenVpnProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    }
-    
-    OpenVpnClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    clientConfig.clientId = connData.clientId;
-    clientConfig.blockOutsideDns = false;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
-}
-
-ProtocolConfig OpenVpnConfigurator::processConfigWithLocalSettings(const ConnectionSettings &settings,
-                                                                   ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-
-    QString config = protocolConfig.nativeConfig();
-
-    if (!settings.isApiConfig) {
-        QRegularExpression regex("redirect-gateway.*");
-        config.replace(regex, "");
-
-        if (settings.dns.primaryDns.contains(protocols::dns::amneziaDnsIp)) {
-            QRegularExpression dnsRegex("dhcp-option DNS " + settings.dns.secondaryDns);
-            config.replace(dnsRegex, "");
-        }
-
-        if (!settings.splitTunneling.isSitesSplitTunnelingEnabled) {
-            config.append("\nredirect-gateway def1 ipv6 bypass-dhcp\n");
-            config.append("block-ipv6\n");
-        } else if (settings.splitTunneling.routeMode == RouteMode::VpnOnlyForwardSites) {
-            // no redirect-gateway
-        } else if (settings.splitTunneling.routeMode == RouteMode::VpnAllExceptSites) {
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
-            config.append("\nredirect-gateway ipv6 !ipv4 bypass-dhcp\n");
-#endif
-            config.append("block-ipv6\n");
-        }
-    }
-
-#ifndef MZ_WINDOWS
-    config.replace("block-outside-dns", "");
-#endif
-
-#if (defined(MZ_MACOS) || defined(MZ_LINUX))
-    config.append(QString("\nscript-security 2\n"
-                         "up %1/update-resolv-conf.sh\n"
-                         "down %1/update-resolv-conf.sh\n")
-                  .arg(qApp->applicationDirPath()));
-#endif
-
-    protocolConfig.setNativeConfig(config);
-    return protocolConfig;
-}
-
-ProtocolConfig OpenVpnConfigurator::processConfigWithExportSettings(const ExportSettings &settings,
-                                                                    ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-
-    QString config = protocolConfig.nativeConfig();
-
-    QRegularExpression regex("redirect-gateway.*");
-    config.replace(regex, "");
-
-    if (settings.dns.primaryDns.contains(protocols::dns::amneziaDnsIp)) {
-        QRegularExpression dnsRegex("dhcp-option DNS " + settings.dns.secondaryDns);
-        config.replace(dnsRegex, "");
-    }
-
-    config.append("\nredirect-gateway def1 ipv6 bypass-dhcp\n");
-    config.append("block-ipv6\n");
-    config.replace("block-outside-dns", "");
-
-    protocolConfig.setNativeConfig(config);
-    return protocolConfig;
-}
-
-ErrorCode OpenVpnConfigurator::signCert(DockerContainer container, const ServerCredentials &credentials, 
-                                        const DnsSettings &dnsSettings, QString clientId)
-{
-    QString script_import = QString("sudo docker exec -i %1 bash -c \"cd /opt/amnezia/openvpn && "
-                                    "easyrsa import-req %2/%3.req %3\"")
-                                    .arg(ContainerUtils::containerToString(container))
-                                    .arg(amnezia::protocols::openvpn::clientsDirPath)
-                                    .arg(clientId);
-
-    QString script_sign = QString("sudo docker exec -i %1 bash -c \"export EASYRSA_BATCH=1; cd /opt/amnezia/openvpn && "
-                                  "easyrsa sign-req client %2\"")
-                                  .arg(ContainerUtils::containerToString(container))
-                                  .arg(clientId);
-
-    QStringList scriptList { script_import, script_sign };
-    QString script = m_sshSession->replaceVars(scriptList.join("\n"), amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns));
-
-    return m_sshSession->runScript(credentials, script);
-}
-
-OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::createCertRequest()
-{
-    ConnectionData connData;
-    connData.clientId = Utils::getRandomString(32);
-
-    int ret = 0;
-    int nVersion = 1;
-
-    QByteArray clientIdUtf8 = connData.clientId.toUtf8();
-
-    EVP_PKEY *pKey = EVP_PKEY_new();
-    q_check_ptr(pKey);
-    RSA *rsa = RSA_generate_key(2048, RSA_F4, nullptr, nullptr);
-    q_check_ptr(rsa);
-    EVP_PKEY_assign_RSA(pKey, rsa);
-
-    // 2. set version of x509 req
-    X509_REQ *x509_req = X509_REQ_new();
-    ret = X509_REQ_set_version(x509_req, nVersion);
-    if (ret != 1) {
-        qWarning() << "Could not get X509!";
-        X509_REQ_free(x509_req);
-        EVP_PKEY_free(pKey);
-        return connData;
-    }
-
-    // 3. set subject of x509 req
-    X509_NAME *x509_name = X509_REQ_get_subject_name(x509_req);
-
-    X509_NAME_add_entry_by_txt(x509_name, "C", MBSTRING_ASC, (unsigned char *)"ORG", -1, -1, 0);
-    X509_NAME_add_entry_by_txt(x509_name, "O", MBSTRING_ASC, (unsigned char *)"", -1, -1, 0);
-    X509_NAME_add_entry_by_txt(x509_name, "CN", MBSTRING_ASC, reinterpret_cast<unsigned char const *>(clientIdUtf8.data()),
-                               clientIdUtf8.size(), -1, 0);
-
-    // 4. set public key of x509 req
-    ret = X509_REQ_set_pubkey(x509_req, pKey);
-    if (ret != 1) {
-        qWarning() << "Could not set pubkey!";
-        X509_REQ_free(x509_req);
-        EVP_PKEY_free(pKey);
-        return connData;
-    }
-
-    // 5. set sign key of x509 req
-    ret = X509_REQ_sign(x509_req, pKey, EVP_sha256()); // return x509_req->signature->length
-    if (ret <= 0) {
-        qWarning() << "Could not sign request!";
-        X509_REQ_free(x509_req);
-        EVP_PKEY_free(pKey);
-        return connData;
-    }
-
-    // save private key
-    BIO *bp_private = BIO_new(BIO_s_mem());
-    q_check_ptr(bp_private);
-    if (PEM_write_bio_PrivateKey(bp_private, pKey, nullptr, nullptr, 0, nullptr, nullptr) != 1) {
-        qFatal("PEM_write_bio_PrivateKey");
-        EVP_PKEY_free(pKey);
-        BIO_free_all(bp_private);
-        X509_REQ_free(x509_req);
-        return connData;
-    }
-
-    const char *buffer = nullptr;
-    size_t size = BIO_get_mem_data(bp_private, &buffer);
-    q_check_ptr(buffer);
-    connData.privKey = QByteArray(buffer, size);
-    if (connData.privKey.isEmpty()) {
-        qFatal("Failed to generate a random private key");
-        EVP_PKEY_free(pKey);
-        BIO_free_all(bp_private);
-        X509_REQ_free(x509_req);
-        return connData;
-    }
-    BIO_free_all(bp_private);
-
-    // save req
-    BIO *bio_req = BIO_new(BIO_s_mem());
-    PEM_write_bio_X509_REQ(bio_req, x509_req);
-
-    BUF_MEM *bio_buf;
-    BIO_get_mem_ptr(bio_req, &bio_buf);
-    connData.request = QByteArray(bio_buf->data, bio_buf->length);
-    BIO_free(bio_req);
-
-    EVP_PKEY_free(pKey); // this will also free the rsa key
-
-    return connData;
-}
@@ -1,49 +0,0 @@
-#ifndef OPENVPN_CONFIGURATOR_H
-#define OPENVPN_CONFIGURATOR_H
-
-#include <QObject>
-#include <QProcessEnvironment>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-
-class OpenVpnConfigurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    OpenVpnConfigurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    struct ConnectionData
-    {
-        QString clientId;
-        QString request;    // certificate request
-        QString privKey;    // client private key
-        QString clientCert; // client signed certificate
-        QString caCert;     // server certificate
-        QString taKey;      // tls-auth key
-        QString host;       // host ip
-    };
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                               const amnezia::ContainerConfig &containerConfig,
-                               const amnezia::DnsSettings &dnsSettings,
-                               amnezia::ErrorCode &errorCode) override;
-
-    amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                           amnezia::ProtocolConfig protocolConfig) override;
-    amnezia::ProtocolConfig processConfigWithExportSettings(const amnezia::ExportSettings &settings,
-                                                            amnezia::ProtocolConfig protocolConfig) override;
-
-    static ConnectionData createCertRequest();
-
-private:
-    ConnectionData prepareOpenVpnConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                       const amnezia::DnsSettings &dnsSettings,
-                                       amnezia::ErrorCode &errorCode);
-    amnezia::ErrorCode signCert(amnezia::DockerContainer container, const amnezia::ServerCredentials &credentials, 
-                      const amnezia::DnsSettings &dnsSettings, QString clientId);
-};
-
-#endif // OPENVPN_CONFIGURATOR_H
@@ -1,288 +0,0 @@
-#include "wireguardConfigurator.h"
-
-#include <QDebug>
-#include <QJsonDocument>
-#include <QProcess>
-#include <QRegularExpression>
-#include <QString>
-#include <QTemporaryDir>
-#include <QTemporaryFile>
-
-#include <openssl/pem.h>
-#include <openssl/rand.h>
-#include <openssl/rsa.h>
-#include <openssl/x509.h>
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/utils/utilities.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/wireGuardProtocolConfig.h"
-#include "core/models/protocols/awgProtocolConfig.h"
-#include <QJsonArray>
-
-using namespace amnezia;
-
-WireguardConfigurator::WireguardConfigurator(SshSession* sshSession, bool isAwg,
-                                             QObject *parent)
-    : ConfiguratorBase(sshSession, parent), m_isAwg(isAwg)
-{
-    m_serverConfigPath =
-            m_isAwg ? amnezia::protocols::awg::serverConfigPath : amnezia::protocols::wireguard::serverConfigPath;
-    m_serverPublicKeyPath =
-            m_isAwg ? amnezia::protocols::awg::serverPublicKeyPath : amnezia::protocols::wireguard::serverPublicKeyPath;
-    m_serverPskKeyPath =
-            m_isAwg ? amnezia::protocols::awg::serverPskKeyPath : amnezia::protocols::wireguard::serverPskKeyPath;
-    m_configTemplate = m_isAwg ? ProtocolScriptType::awg_template : ProtocolScriptType::wireguard_template;
-
-    m_protocolName = m_isAwg ? configKey::awg : configKey::wireguard;
-    m_defaultPort = m_isAwg ? protocols::awg::defaultPort : protocols::wireguard::defaultPort;
-}
-
-WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
-{
-    // TODO review
-    constexpr size_t EDDSA_KEY_LENGTH = 32;
-
-    ConnectionData connData;
-
-    unsigned char buff[EDDSA_KEY_LENGTH];
-    int ret = RAND_priv_bytes(buff, EDDSA_KEY_LENGTH);
-    if (ret <= 0)
-        return connData;
-
-    EVP_PKEY *pKey = EVP_PKEY_new();
-    q_check_ptr(pKey);
-    pKey = EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, &buff[0], EDDSA_KEY_LENGTH);
-
-    size_t keySize = EDDSA_KEY_LENGTH;
-
-    // save private key
-    unsigned char priv[EDDSA_KEY_LENGTH];
-    EVP_PKEY_get_raw_private_key(pKey, priv, &keySize);
-    connData.clientPrivKey = QByteArray::fromRawData((char *)priv, keySize).toBase64();
-
-    // save public key
-    unsigned char pub[EDDSA_KEY_LENGTH];
-    EVP_PKEY_get_raw_public_key(pKey, pub, &keySize);
-    connData.clientPubKey = QByteArray::fromRawData((char *)pub, keySize).toBase64();
-
-    return connData;
-}
-
-QList<QHostAddress> WireguardConfigurator::getIpsFromConf(const QString &input)
-{
-    QRegularExpression regex("AllowedIPs = (\\d+\\.\\d+\\.\\d+\\.\\d+)");
-    QRegularExpressionMatchIterator matchIterator = regex.globalMatch(input);
-
-    QList<QHostAddress> ips;
-
-    while (matchIterator.hasNext()) {
-        QRegularExpressionMatch match = matchIterator.next();
-        const QString address_string { match.captured(1) };
-        const QHostAddress address { address_string };
-        if (address.isNull()) {
-            qWarning() << "Couldn't recognize the ip address: " << address_string;
-        } else {
-            ips << address;
-        }
-    }
-
-    return ips;
-}
-
-WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardConfig(const ServerCredentials &credentials,
-                                                                                    DockerContainer container,
-                                                                                    const WireGuardServerConfig* serverConfig,
-                                                                                    const AwgServerConfig* awgServerConfig,
-                                                                                    const DnsSettings &dnsSettings,
-                                                                                    ErrorCode &errorCode)
-{
-    WireguardConfigurator::ConnectionData connData = WireguardConfigurator::genClientKeys();
-    connData.host = credentials.hostName;
-    
-    QString portStr = m_defaultPort;
-    if (serverConfig && !serverConfig->port.isEmpty()) {
-        portStr = serverConfig->port;
-    } else if (awgServerConfig && !awgServerConfig->port.isEmpty()) {
-        portStr = awgServerConfig->port;
-    }
-    connData.port = portStr;
-
-    if (connData.clientPrivKey.isEmpty() || connData.clientPubKey.isEmpty()) {
-        errorCode = ErrorCode::InternalError;
-        return connData;
-    }
-
-    QString configPath = m_serverConfigPath;
-    if (container == DockerContainer::Awg) {
-        configPath = amnezia::protocols::awg::serverLegacyConfigPath;
-    }
-    QString getIpsScript = QString("cat %1 | grep AllowedIPs").arg(configPath);
-    QString stdOut;
-    auto cbReadStdOut = [&](const QString &data, libssh::Client &) {
-        stdOut += data + "\n";
-        return ErrorCode::NoError;
-    };
-
-    errorCode = m_sshSession->runContainerScript(credentials, container, getIpsScript, cbReadStdOut);
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-    auto ips = getIpsFromConf(stdOut);
-
-    QHostAddress nextIp = [&] {
-        QHostAddress result;
-        QHostAddress lastIp;
-        QString subnetAddress = protocols::wireguard::defaultSubnetAddress;
-        if (serverConfig && !serverConfig->subnetAddress.isEmpty()) {
-            subnetAddress = serverConfig->subnetAddress;
-        } else if (awgServerConfig && !awgServerConfig->subnetAddress.isEmpty()) {
-            subnetAddress = awgServerConfig->subnetAddress;
-        }
-        if (ips.empty()) {
-            lastIp.setAddress(subnetAddress);
-        } else {
-            lastIp = ips.last();
-        }
-        quint8 lastOctet = static_cast<quint8>(lastIp.toIPv4Address());
-        switch (lastOctet) {
-        case 254: result.setAddress(lastIp.toIPv4Address() + 3); break;
-        case 255: result.setAddress(lastIp.toIPv4Address() + 2); break;
-        default: result.setAddress(lastIp.toIPv4Address() + 1); break;
-        }
-
-        return result;
-    }();
-
-    connData.clientIP = nextIp.toString();
-
-    // Get keys
-    connData.serverPubKey =
-            m_sshSession->getTextFileFromContainer(container, credentials, m_serverPublicKeyPath, errorCode);
-    connData.serverPubKey.replace("\n", "");
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-
-    connData.pskKey = m_sshSession->getTextFileFromContainer(container, credentials, m_serverPskKeyPath, errorCode);
-    connData.pskKey.replace("\n", "");
-
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-
-    // Add client to config
-    QString configPart = QString("[Peer]\n"
-                                 "PublicKey = %1\n"
-                                 "PresharedKey = %2\n"
-                                 "AllowedIPs = %3/32\n\n")
-                                 .arg(connData.clientPubKey, connData.pskKey, connData.clientIP);
-
-    errorCode = m_sshSession->uploadTextFileToContainer(container, credentials, configPart, configPath,
-                                                              libssh::ScpOverwriteMode::ScpAppendToExisting);
-
-    if (errorCode != ErrorCode::NoError) {
-        return connData;
-    }
-
-    bool isAwg = (container == DockerContainer::Awg2);
-    QString bin = isAwg ? QStringLiteral("awg") : QStringLiteral("wg");
-    QString iface = isAwg ? QStringLiteral("awg0") : QStringLiteral("wg0");
-    QString script = QString(
-        "sudo docker exec -i $CONTAINER_NAME bash -c '%1 syncconf %2 <(%1-quick strip %3)'").arg(bin, iface, configPath);
-
-    errorCode = m_sshSession->runScript(
-            credentials,
-            m_sshSession->replaceVars(script, amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns)));
-
-    return connData;
-}
-
-ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                                    const ContainerConfig &containerConfig,
-                                                    const DnsSettings &dnsSettings,
-                                                    ErrorCode &errorCode)
-{
-    const WireGuardServerConfig* wireguardServerConfig = nullptr;
-    const WireGuardClientConfig* wireguardClientConfig = nullptr;
-    const AwgServerConfig* awgServerConfig = nullptr;
-    const AwgClientConfig* awgClientConfig = nullptr;
-    
-    if (auto* wireGuardProtocolConfig = containerConfig.getWireGuardProtocolConfig()) {
-        wireguardServerConfig = &wireGuardProtocolConfig->serverConfig;
-        if (wireGuardProtocolConfig->clientConfig.has_value()) {
-            wireguardClientConfig = &wireGuardProtocolConfig->clientConfig.value();
-        }
-    } else if (auto* awgProtocolConfig = containerConfig.getAwgProtocolConfig()) {
-        awgServerConfig = &awgProtocolConfig->serverConfig;
-        if (awgProtocolConfig->clientConfig.has_value()) {
-            awgClientConfig = &awgProtocolConfig->clientConfig.value();
-        }
-    }
-    
-    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
-    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
-    QString scriptData = amnezia::scriptData(m_configTemplate, container);
-    QString config = m_sshSession->replaceVars(scriptData, vars);
-
-    ConnectionData connData = prepareWireguardConfig(credentials, container, wireguardServerConfig, awgServerConfig, dnsSettings, errorCode);
-    if (errorCode != ErrorCode::NoError) {
-        return WireGuardProtocolConfig{};
-    }
-
-    config.replace("$WIREGUARD_CLIENT_PRIVATE_KEY", connData.clientPrivKey);
-    config.replace("$WIREGUARD_CLIENT_IP", connData.clientIP);
-    config.replace("$WIREGUARD_SERVER_PUBLIC_KEY", connData.serverPubKey);
-    config.replace("$WIREGUARD_PSK", connData.pskKey);
-
-    QString mtu = protocols::wireguard::defaultMtu;
-    if (wireguardClientConfig && !wireguardClientConfig->mtu.isEmpty()) {
-        mtu = wireguardClientConfig->mtu;
-    } else if (awgClientConfig && !awgClientConfig->mtu.isEmpty()) {
-        mtu = awgClientConfig->mtu;
-    }
-    
-    WireGuardProtocolConfig protocolConfig;
-    if (wireguardServerConfig) {
-        protocolConfig.serverConfig = *wireguardServerConfig;
-    }
-    
-    WireGuardClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    clientConfig.hostName = connData.host;
-    clientConfig.port = connData.port.toInt();
-    clientConfig.clientIp = connData.clientIP;
-    clientConfig.clientPrivateKey = connData.clientPrivKey;
-    clientConfig.clientPublicKey = connData.clientPubKey;
-    clientConfig.serverPublicKey = connData.serverPubKey;
-    clientConfig.presharedKey = connData.pskKey;
-    clientConfig.clientId = connData.clientPubKey;
-    clientConfig.allowedIps = QStringList { "0.0.0.0/0", "::/0" };
-    clientConfig.persistentKeepAlive = "25";
-    clientConfig.mtu = mtu;
-    clientConfig.isObfuscationEnabled = false;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
-}
-
-ProtocolConfig WireguardConfigurator::processConfigWithLocalSettings(const ConnectionSettings &settings,
-                                                                     ProtocolConfig protocolConfig)
-{
-    return ConfiguratorBase::processConfigWithLocalSettings(settings, protocolConfig);
-}
-
-ProtocolConfig WireguardConfigurator::processConfigWithExportSettings(const ExportSettings &settings,
-                                                                      ProtocolConfig protocolConfig)
-{
-    return ConfiguratorBase::processConfigWithExportSettings(settings, protocolConfig);
-}
@@ -1,61 +0,0 @@
-#ifndef WIREGUARD_CONFIGURATOR_H
-#define WIREGUARD_CONFIGURATOR_H
-
-#include <QHostAddress>
-#include <QObject>
-#include <QProcessEnvironment>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-
-class WireguardConfigurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    WireguardConfigurator(SshSession* sshSession,
-                          bool isAwg, QObject *parent = nullptr);
-
-    struct ConnectionData
-    {
-        QString clientPrivKey; // client private key
-        QString clientPubKey;  // client public key
-        QString clientIP;      // internal client IP address
-        QString serverPubKey;  // tls-auth key
-        QString pskKey;        // preshared key
-        QString host;          // host ip
-        QString port;
-    };
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-
-    amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                           amnezia::ProtocolConfig protocolConfig) override;
-    amnezia::ProtocolConfig processConfigWithExportSettings(const amnezia::ExportSettings &settings,
-                                                            amnezia::ProtocolConfig protocolConfig) override;
-
-    static ConnectionData genClientKeys();
-
-private:
-    QList<QHostAddress> getIpsFromConf(const QString &input);
-    ConnectionData prepareWireguardConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                          const amnezia::WireGuardServerConfig* serverConfig,
-                                          const amnezia::AwgServerConfig* awgServerConfig,
-                                          const amnezia::DnsSettings &dnsSettings,
-                                          amnezia::ErrorCode &errorCode);
-
-    bool m_isAwg;
-    QString m_serverConfigPath;
-    QString m_serverPublicKeyPath;
-    QString m_serverPskKeyPath;
-    amnezia::ProtocolScriptType m_configTemplate;
-    QString m_protocolName;
-    QString m_defaultPort;
-};
-
-#endif // WIREGUARD_CONFIGURATOR_H
@@ -1,27 +0,0 @@
-#ifndef XRAY_CONFIGURATOR_H
-#define XRAY_CONFIGURATOR_H
-
-#include <QObject>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-
-class XrayConfigurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    XrayConfigurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container, const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-
-private:
-    QString prepareServerConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container, const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode);
-};
-
-#endif // XRAY_CONFIGURATOR_H
@@ -1,54 +0,0 @@
-#include "allowedDnsController.h"
-
-AllowedDnsController::AllowedDnsController(SecureAppSettingsRepository* appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-    fillDnsServers();
-}
-
-bool AllowedDnsController::addDns(const QString &ip)
-{
-    if (m_dnsServers.contains(ip)) {
-        return false;
-    }
-
-    m_dnsServers.append(ip);
-    m_appSettingsRepository->setAllowedDnsServers(m_dnsServers);
-    return true;
-}
-
-void AllowedDnsController::addDnsList(const QStringList &dnsServers, bool replaceExisting)
-{
-    if (replaceExisting) {
-        m_dnsServers.clear();
-    }
-    
-    for (const QString &ip : dnsServers) {
-        if (!m_dnsServers.contains(ip)) {
-            m_dnsServers.append(ip);
-        }
-    }
-    
-    m_appSettingsRepository->setAllowedDnsServers(m_dnsServers);
-}
-
-void AllowedDnsController::removeDns(int index)
-{
-    if (index < 0 || index >= m_dnsServers.size()) {
-        return;
-    }
-
-    m_dnsServers.removeAt(index);
-    m_appSettingsRepository->setAllowedDnsServers(m_dnsServers);
-}
-
-QStringList AllowedDnsController::getCurrentDnsServers() const
-{
-    return m_dnsServers;
-}
-
-void AllowedDnsController::fillDnsServers()
-{
-    m_dnsServers = m_appSettingsRepository->getAllowedDnsServers();
-}
-
@@ -1,26 +0,0 @@
-#ifndef ALLOWEDDNSCONTROLLER_H
-#define ALLOWEDDNSCONTROLLER_H
-
-#include <QStringList>
-
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class AllowedDnsController
-{
-public:
-    explicit AllowedDnsController(SecureAppSettingsRepository* appSettingsRepository);
-
-    bool addDns(const QString &ip);
-    void addDnsList(const QStringList &dnsServers, bool replaceExisting);
-    void removeDns(int index);
-    QStringList getCurrentDnsServers() const;
-
-private:
-    void fillDnsServers();
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    QStringList m_dnsServers;
-};
-
-#endif // ALLOWEDDNSCONTROLLER_H
-
@@ -0,0 +1,684 @@
+#include "apiConfigController.h"
+
+#include <QClipboard>
+#include <QEventLoop>
+
+#include "amnezia_application.h"
+#include "configurators/wireguard_configurator.h"
+#include "core/api/apiDefs.h"
+#include "core/api/apiUtils.h"
+#include "core/controllers/api/gatewayController.h"
+#include "core/qrCodeUtils.h"
+#include "core/utils/fileUtils.h"
+#include "core/models/servers/serverConfig.h"
+#include "core/models/servers/apiV2ServerConfig.h"
+#include "version.h"
+
+namespace
+{
+    namespace configKey
+    {
+        constexpr char cloak[] = "cloak";
+        constexpr char awg[] = "awg";
+        constexpr char vless[] = "vless";
+
+        constexpr char apiEndpoint[] = "api_endpoint";
+        constexpr char accessToken[] = "api_key";
+        constexpr char certificate[] = "certificate";
+        constexpr char publicKey[] = "public_key";
+        constexpr char protocol[] = "protocol";
+
+        constexpr char uuid[] = "installation_uuid";
+        constexpr char osVersion[] = "os_version";
+        constexpr char appVersion[] = "app_version";
+
+        constexpr char userCountryCode[] = "user_country_code";
+        constexpr char serverCountryCode[] = "server_country_code";
+        constexpr char serviceType[] = "service_type";
+        constexpr char serviceInfo[] = "service_info";
+        constexpr char serviceProtocol[] = "service_protocol";
+
+        constexpr char apiPayload[] = "api_payload";
+        constexpr char keyPayload[] = "key_payload";
+
+        constexpr char apiConfig[] = "api_config";
+        constexpr char authData[] = "auth_data";
+
+        constexpr char config[] = "config";
+    }
+
+    struct ProtocolData
+    {
+        OpenVpnConfigurator::ConnectionData certRequest;
+
+        QString wireGuardClientPrivKey;
+        QString wireGuardClientPubKey;
+
+        QString xrayUuid;
+    };
+
+    struct GatewayRequestData
+    {
+        QString osVersion;
+        QString appVersion;
+
+        QString installationUuid;
+
+        QString userCountryCode;
+        QString serverCountryCode;
+        QString serviceType;
+        QString serviceProtocol;
+
+        QJsonObject authData;
+
+        QJsonObject toJsonObject() const
+        {
+            QJsonObject obj;
+            if (!osVersion.isEmpty()) {
+                obj[configKey::osVersion] = osVersion;
+            }
+            if (!appVersion.isEmpty()) {
+                obj[configKey::appVersion] = appVersion;
+            }
+            if (!installationUuid.isEmpty()) {
+                obj[configKey::uuid] = installationUuid;
+            }
+            if (!userCountryCode.isEmpty()) {
+                obj[configKey::userCountryCode] = userCountryCode;
+            }
+            if (!serverCountryCode.isEmpty()) {
+                obj[configKey::serverCountryCode] = serverCountryCode;
+            }
+            if (!serviceType.isEmpty()) {
+                obj[configKey::serviceType] = serviceType;
+            }
+            if (!serviceProtocol.isEmpty()) {
+                obj[configKey::serviceProtocol] = serviceProtocol;
+            }
+            if (!authData.isEmpty()) {
+                obj[configKey::authData] = authData;
+            }
+            return obj;
+        }
+    };
+
+    ProtocolData generateProtocolData(const QString &protocol)
+    {
+        ProtocolData protocolData;
+        if (protocol == configKey::cloak) {
+            protocolData.certRequest = OpenVpnConfigurator::createCertRequest();
+        } else if (protocol == configKey::awg) {
+            auto connData = WireguardConfigurator::genClientKeys();
+            protocolData.wireGuardClientPubKey = connData.clientPubKey;
+            protocolData.wireGuardClientPrivKey = connData.clientPrivKey;
+        } else if (protocol == configKey::vless) {
+            protocolData.xrayUuid = QUuid::createUuid().toString(QUuid::WithoutBraces);
+        }
+
+        return protocolData;
+    }
+
+    void appendProtocolDataToApiPayload(const QString &protocol, const ProtocolData &protocolData, QJsonObject &apiPayload)
+    {
+        if (protocol == configKey::cloak) {
+            apiPayload[configKey::certificate] = protocolData.certRequest.request;
+        } else if (protocol == configKey::awg) {
+            apiPayload[configKey::publicKey] = protocolData.wireGuardClientPubKey;
+        } else if (protocol == configKey::vless) {
+            apiPayload[configKey::publicKey] = protocolData.xrayUuid;
+        }
+    }
+
+    ErrorCode fillServerConfig(const QString &protocol, const ProtocolData &apiPayloadData, const QByteArray &apiResponseBody,
+                               QSharedPointer<ServerConfig> &serverConfigPtr)
+    {
+        QJsonObject serverConfig;
+        QString data = QJsonDocument::fromJson(apiResponseBody).object().value(config_key::config).toString();
+
+        data.replace("vpn://", "");
+        QByteArray ba = QByteArray::fromBase64(data.toUtf8(), QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals);
+
+        if (ba.isEmpty()) {
+            qDebug() << "empty vpn key";
+            return ErrorCode::ApiConfigEmptyError;
+        }
+
+        QByteArray ba_uncompressed = qUncompress(ba);
+        if (!ba_uncompressed.isEmpty()) {
+            ba = ba_uncompressed;
+        }
+
+        QString configStr = ba;
+        if (protocol == configKey::cloak) {
+            configStr.replace("<key>", "<key>\n");
+            configStr.replace("$OPENVPN_PRIV_KEY", apiPayloadData.certRequest.privKey);
+        } else if (protocol == configKey::awg) {
+            configStr.replace("$WIREGUARD_CLIENT_PRIVATE_KEY", apiPayloadData.wireGuardClientPrivKey);
+            auto newServerConfig = QJsonDocument::fromJson(configStr.toUtf8()).object();
+            auto containers = newServerConfig.value(config_key::containers).toArray();
+            if (containers.isEmpty()) {
+                qDebug() << "missing containers field";
+                return ErrorCode::ApiConfigEmptyError;
+            }
+            auto container = containers.at(0).toObject();
+            QString containerName = ContainerProps::containerTypeToString(DockerContainer::Awg);
+            auto serverProtocolConfig = container.value(containerName).toObject();
+            auto clientProtocolConfig =
+                    QJsonDocument::fromJson(serverProtocolConfig.value(config_key::last_config).toString().toUtf8()).object();
+
+            //TODO looks like this block can be removed after v1 configs EOL
+
+            serverProtocolConfig[config_key::junkPacketCount] = clientProtocolConfig.value(config_key::junkPacketCount);
+            serverProtocolConfig[config_key::junkPacketMinSize] = clientProtocolConfig.value(config_key::junkPacketMinSize);
+            serverProtocolConfig[config_key::junkPacketMaxSize] = clientProtocolConfig.value(config_key::junkPacketMaxSize);
+            serverProtocolConfig[config_key::initPacketJunkSize] = clientProtocolConfig.value(config_key::initPacketJunkSize);
+            serverProtocolConfig[config_key::responsePacketJunkSize] = clientProtocolConfig.value(config_key::responsePacketJunkSize);
+            serverProtocolConfig[config_key::initPacketMagicHeader] = clientProtocolConfig.value(config_key::initPacketMagicHeader);
+            serverProtocolConfig[config_key::responsePacketMagicHeader] = clientProtocolConfig.value(config_key::responsePacketMagicHeader);
+            serverProtocolConfig[config_key::underloadPacketMagicHeader] = clientProtocolConfig.value(config_key::underloadPacketMagicHeader);
+            serverProtocolConfig[config_key::transportPacketMagicHeader] = clientProtocolConfig.value(config_key::transportPacketMagicHeader);
+
+            serverProtocolConfig[config_key::cookieReplyPacketJunkSize] = clientProtocolConfig.value(config_key::cookieReplyPacketJunkSize);
+            serverProtocolConfig[config_key::transportPacketJunkSize] = clientProtocolConfig.value(config_key::transportPacketJunkSize);
+            serverProtocolConfig[config_key::specialJunk1] = clientProtocolConfig.value(config_key::specialJunk1);
+            serverProtocolConfig[config_key::specialJunk2] = clientProtocolConfig.value(config_key::specialJunk2);
+            serverProtocolConfig[config_key::specialJunk3] = clientProtocolConfig.value(config_key::specialJunk3);
+            serverProtocolConfig[config_key::specialJunk4] = clientProtocolConfig.value(config_key::specialJunk4);
+            serverProtocolConfig[config_key::specialJunk5] = clientProtocolConfig.value(config_key::specialJunk5);
+            serverProtocolConfig[config_key::controlledJunk1] = clientProtocolConfig.value(config_key::controlledJunk1);
+            serverProtocolConfig[config_key::controlledJunk2] = clientProtocolConfig.value(config_key::controlledJunk2);
+            serverProtocolConfig[config_key::controlledJunk3] = clientProtocolConfig.value(config_key::controlledJunk3);
+            serverProtocolConfig[config_key::specialHandshakeTimeout] = clientProtocolConfig.value(config_key::specialHandshakeTimeout);
+
+            //
+
+            container[containerName] = serverProtocolConfig;
+            containers.replace(0, container);
+            newServerConfig[config_key::containers] = containers;
+            configStr = QString(QJsonDocument(newServerConfig).toJson());
+        }
+
+        QJsonObject newServerConfig = QJsonDocument::fromJson(configStr.toUtf8()).object();
+        serverConfig[config_key::dns1] = newServerConfig.value(config_key::dns1);
+        serverConfig[config_key::dns2] = newServerConfig.value(config_key::dns2);
+        serverConfig[config_key::containers] = newServerConfig.value(config_key::containers);
+        serverConfig[config_key::hostName] = newServerConfig.value(config_key::hostName);
+
+        if (newServerConfig.value(config_key::configVersion).toInt() == static_cast<int>(amnezia::ServerConfigType::ApiV2)) {
+            serverConfig[config_key::configVersion] = newServerConfig.value(config_key::configVersion);
+            serverConfig[config_key::description] = newServerConfig.value(config_key::description);
+            serverConfig[config_key::name] = newServerConfig.value(config_key::name);
+        }
+
+        auto defaultContainer = newServerConfig.value(config_key::defaultContainer).toString();
+        serverConfig[config_key::defaultContainer] = defaultContainer;
+
+        QVariantMap map = serverConfig.value(configKey::apiConfig).toObject().toVariantMap();
+        map.insert(newServerConfig.value(configKey::apiConfig).toObject().toVariantMap());
+        auto apiConfig = QJsonObject::fromVariantMap(map);
+
+        if (newServerConfig.value(config_key::configVersion).toInt() == static_cast<int>(amnezia::ServerConfigType::ApiV2)) {
+            apiConfig.insert(apiDefs::key::supportedProtocols,
+                             QJsonDocument::fromJson(apiResponseBody).object().value(apiDefs::key::supportedProtocols).toArray());
+        }
+
+        serverConfig[configKey::apiConfig] = apiConfig;
+
+        serverConfigPtr = ServerConfig::createServerConfig(serverConfig);
+        return ErrorCode::NoError;
+    }
+}
+
+ApiConfigsController::ApiConfigsController(const QSharedPointer<ServersModel> &serversModel,
+                                           const QSharedPointer<ApiServicesModel> &apiServicesModel,
+                                           const std::shared_ptr<Settings> &settings, QObject *parent)
+    : QObject(parent), m_serversModel(serversModel), m_apiServicesModel(apiServicesModel), m_settings(settings)
+{
+}
+
+ErrorCode ApiConfigsController::exportNativeConfig(const QString &serverCountryCode, const QString &fileName)
+{
+    if (fileName.isEmpty()) {
+        return ErrorCode::PermissionsError;
+    }
+
+    auto serverConfigPtr = m_serversModel->getServerConfig(m_serversModel->getProcessedServerIndex());
+    auto serverConfigObject = serverConfigPtr->toJson();
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
+                                            QString(APP_VERSION),
+                                            m_settings->getInstallationUuid(true),
+                                            apiConfigObject.value(configKey::userCountryCode).toString(),
+                                            serverCountryCode,
+                                            apiConfigObject.value(configKey::serviceType).toString(),
+                                            configKey::awg, // apiConfigObject.value(configKey::serviceProtocol).toString(),
+                                            serverConfigObject.value(configKey::authData).toObject() };
+
+    QString protocol = gatewayRequestData.serviceProtocol;
+    ProtocolData protocolData = generateProtocolData(protocol);
+
+    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+    appendProtocolDataToApiPayload(gatewayRequestData.serviceProtocol, protocolData, apiPayload);
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/native_config"), apiPayload, responseBody);
+    if (errorCode != ErrorCode::NoError) {
+        return errorCode;
+    }
+
+    QJsonObject jsonConfig = QJsonDocument::fromJson(responseBody).object();
+    QString nativeConfig = jsonConfig.value(configKey::config).toString();
+    nativeConfig.replace("$WIREGUARD_CLIENT_PRIVATE_KEY", protocolData.wireGuardClientPrivKey);
+
+    FileUtils::saveFile(fileName, nativeConfig);
+    return ErrorCode::NoError;
+}
+
+ErrorCode ApiConfigsController::revokeNativeConfig(const QString &serverCountryCode)
+{
+    auto serverConfigPtr = m_serversModel->getServerConfig(m_serversModel->getProcessedServerIndex());
+    auto serverConfigObject = serverConfigPtr->toJson();
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
+                                            QString(APP_VERSION),
+                                            m_settings->getInstallationUuid(true),
+                                            apiConfigObject.value(configKey::userCountryCode).toString(),
+                                            serverCountryCode,
+                                            apiConfigObject.value(configKey::serviceType).toString(),
+                                            configKey::awg, // apiConfigObject.value(configKey::serviceProtocol).toString(),
+                                            serverConfigObject.value(configKey::authData).toObject() };
+
+    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/revoke_native_config"), apiPayload, responseBody);
+    if (errorCode != ErrorCode::NoError && errorCode != ErrorCode::ApiNotFoundError) {
+        return errorCode;
+    }
+    return ErrorCode::NoError;
+}
+
+void ApiConfigsController::prepareVpnKeyExport()
+{
+    auto serverConfigPtr = m_serversModel->getServerConfig(m_serversModel->getProcessedServerIndex());
+    auto serverConfigObject = serverConfigPtr->toJson();
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    auto vpnKey = apiConfigObject.value(apiDefs::key::vpnKey).toString();
+    m_vpnKey = vpnKey;
+
+    vpnKey.replace("vpn://", "");
+
+    m_qrCodes = qrCodeUtils::generateQrCodeImageSeries(vpnKey.toUtf8());
+
+    
+}
+
+void ApiConfigsController::copyVpnKeyToClipboard()
+{
+    auto clipboard = amnApp->getClipboard();
+    clipboard->setText(m_vpnKey);
+}
+
+ErrorCode ApiConfigsController::fillAvailableServices()
+{
+    QJsonObject apiPayload;
+    apiPayload[configKey::osVersion] = QSysInfo::productType();
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/services"), apiPayload, responseBody);
+    if (errorCode == ErrorCode::NoError) {
+        if (!responseBody.contains("services")) {
+            errorCode = ErrorCode::ApiServicesMissingError;
+        }
+    }
+
+    if (errorCode != ErrorCode::NoError) {
+        return errorCode;
+    }
+
+    QJsonObject data = QJsonDocument::fromJson(responseBody).object();
+    m_apiServicesModel->updateModel(data);
+    return ErrorCode::NoError;
+}
+
+bool ApiConfigsController::isServerFromApiAlreadyExists(const QString &userCountryCode,
+                                                       const QString &serviceType,
+                                                       const QString &serviceProtocol) const
+{
+    auto servers = m_settings->serversArray();
+    for (const auto &server : servers) {
+        auto serverConfig = ServerConfig::createServerConfig(server.toObject());
+        if (serverConfig->type != amnezia::ServerConfigType::ApiV2) continue;
+        auto apiV2Config = qSharedPointerCast<ApiV2ServerConfig>(serverConfig);
+        if (!apiV2Config) continue;
+
+        if (apiV2Config->apiConfig.userCountryCode == userCountryCode &&
+            apiV2Config->apiConfig.serviceType == serviceType &&
+            apiV2Config->apiConfig.serviceProtocol == serviceProtocol) {
+            return true;
+        }
+    }
+    return false;
+}
+
+bool ApiConfigsController::isApiKeyExpired(int serverIndex) const
+{
+    auto servers = m_settings->serversArray();
+    if (serverIndex >= servers.size()) return false;
+
+    auto serverConfig = ServerConfig::createServerConfig(servers.at(serverIndex).toObject());
+    if (serverConfig->type != amnezia::ServerConfigType::ApiV2) return false;
+
+    auto apiV2Config = qSharedPointerCast<ApiV2ServerConfig>(serverConfig);
+    if (!apiV2Config) return false;
+
+    QString expiresIso = apiV2Config->apiConfig.publicKey.expiresAt;
+    if (expiresIso.isEmpty()) {
+        expiresIso = apiV2Config->apiConfig.subscription.end_date;
+    }
+    if (expiresIso.isEmpty()) return false;
+
+    auto expiresAt = QDateTime::fromString(expiresIso, Qt::ISODate);
+    return QDateTime::currentDateTime() > expiresAt;
+}
+
+void ApiConfigsController::removeApiConfig(int serverIndex)
+{
+    auto servers = m_settings->serversArray();
+    if (serverIndex >= servers.size()) return;
+
+    auto serverConfig = ServerConfig::createServerConfig(servers.at(serverIndex).toObject());
+    if (serverConfig->type != amnezia::ServerConfigType::ApiV2) return;
+
+    auto apiV2 = qSharedPointerCast<ApiV2ServerConfig>(serverConfig);
+    if (!apiV2) return;
+
+    apiV2->containerConfigs.clear();
+    apiV2->apiConfig.publicKey.expiresAt.clear();
+    apiV2->apiConfig.vpnKey.clear();
+    apiV2->defaultContainer = ContainerProps::containerToString(DockerContainer::None);
+
+    m_serversModel->editServer(apiV2, serverIndex);
+}
+
+ErrorCode ApiConfigsController::importServiceFromGateway()
+{
+    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
+                                            QString(APP_VERSION),
+                                            m_settings->getInstallationUuid(true),
+                                            m_apiServicesModel->getCountryCode(),
+                                            "",
+                                            m_apiServicesModel->getSelectedServiceType(),
+                                            m_apiServicesModel->getSelectedServiceProtocol(),
+                                            QJsonObject() };
+
+    if (isServerFromApiAlreadyExists(gatewayRequestData.userCountryCode, gatewayRequestData.serviceType,
+                                     gatewayRequestData.serviceProtocol)) {
+        return ErrorCode::ApiConfigAlreadyAdded;
+    }
+
+    ProtocolData protocolData = generateProtocolData(gatewayRequestData.serviceProtocol);
+
+    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+    appendProtocolDataToApiPayload(gatewayRequestData.serviceProtocol, protocolData, apiPayload);
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody);
+
+    QSharedPointer<ServerConfig> serverConfigPtr;
+    if (errorCode == ErrorCode::NoError) {
+        errorCode = fillServerConfig(gatewayRequestData.serviceProtocol, protocolData, responseBody, serverConfigPtr);
+        if (errorCode != ErrorCode::NoError) {
+            return errorCode;
+        }
+        if (serverConfigPtr->type == amnezia::ServerConfigType::ApiV2) {
+            auto apiV2ServerConfig = qSharedPointerCast<ApiV2ServerConfig>(serverConfigPtr);
+            apiV2ServerConfig->apiConfig.userCountryCode = m_apiServicesModel->getCountryCode();
+            apiV2ServerConfig->apiConfig.serviceType = m_apiServicesModel->getSelectedServiceType();
+            apiV2ServerConfig->apiConfig.serviceProtocol = m_apiServicesModel->getSelectedServiceProtocol();
+        }
+        m_serversModel->addServer(serverConfigPtr);
+        return ErrorCode::NoError;
+    } else {
+        return errorCode;
+    }
+}
+
+ErrorCode ApiConfigsController::updateServiceFromGateway(const int serverIndex, const QString &newCountryCode, const QString &newCountryName,
+                                                    bool reloadServiceConfig)
+{
+    auto serverConfigPtr = m_serversModel->getServerConfig(serverIndex);
+    auto serverConfigJson = serverConfigPtr->toJson();
+    auto apiConfig = serverConfigJson.value(configKey::apiConfig).toObject();
+
+    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
+                                            QString(APP_VERSION),
+                                            m_settings->getInstallationUuid(true),
+                                            apiConfig.value(configKey::userCountryCode).toString(),
+        newCountryCode,
+                                            apiConfig.value(configKey::serviceType).toString(),
+                                            apiConfig.value(configKey::serviceProtocol).toString(),
+                                            serverConfigJson.value(configKey::authData).toObject() };
+
+    ProtocolData protocolData = generateProtocolData(gatewayRequestData.serviceProtocol);
+
+    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+    appendProtocolDataToApiPayload(gatewayRequestData.serviceProtocol, protocolData, apiPayload);
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/config"), apiPayload, responseBody);
+
+    QSharedPointer<ServerConfig> newServerConfigPtr;
+    if (errorCode == ErrorCode::NoError) {
+        errorCode = fillServerConfig(gatewayRequestData.serviceProtocol, protocolData, responseBody, newServerConfigPtr);
+        if (errorCode != ErrorCode::NoError) {
+            return errorCode;
+        }
+        if (newServerConfigPtr->type == amnezia::ServerConfigType::ApiV2 && serverConfigPtr->type == amnezia::ServerConfigType::ApiV2) {
+            auto newApiV2 = qSharedPointerCast<ApiV2ServerConfig>(newServerConfigPtr);
+            auto oldApiV2 = qSharedPointerCast<ApiV2ServerConfig>(serverConfigPtr);
+            newApiV2->apiConfig.userCountryCode = oldApiV2->apiConfig.userCountryCode;
+            newApiV2->apiConfig.serviceType = oldApiV2->apiConfig.serviceType;
+            newApiV2->apiConfig.serviceProtocol = oldApiV2->apiConfig.serviceProtocol;
+            newApiV2->apiConfig.vpnKey = oldApiV2->apiConfig.vpnKey;
+            newApiV2->apiConfig.authData.apiKey = gatewayRequestData.authData.value("api_key").toString();
+            if (serverConfigPtr->nameOverriddenByUser) {
+                newApiV2->name = oldApiV2->name;
+                newApiV2->nameOverriddenByUser = true;
+            }
+        }
+        m_serversModel->editServer(newServerConfigPtr, serverIndex);
+        return ErrorCode::NoError;
+    } else {
+        return errorCode;
+    }
+}
+
+ErrorCode ApiConfigsController::updateServiceFromTelegram(const int serverIndex)
+{
+#ifdef Q_OS_IOS
+    IosController::Instance()->requestInetAccess();
+    QThread::msleep(10);
+#endif
+
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+
+    auto serverConfigPtr = m_serversModel->getServerConfig(serverIndex);
+    auto installationUuid = m_settings->getInstallationUuid(true);
+
+    auto serverConfigJson2 = serverConfigPtr->toJson();
+    QString serviceProtocol = serverConfigJson2.value(configKey::protocol).toString();
+    ProtocolData protocolData = generateProtocolData(serviceProtocol);
+
+    QJsonObject apiPayload;
+    appendProtocolDataToApiPayload(serviceProtocol, protocolData, apiPayload);
+    apiPayload[configKey::uuid] = installationUuid;
+    apiPayload[configKey::osVersion] = QSysInfo::productType();
+    apiPayload[configKey::appVersion] = QString(APP_VERSION);
+    apiPayload[configKey::accessToken] = serverConfigJson2.value(configKey::accessToken).toString();
+    apiPayload[configKey::apiEndpoint] = serverConfigJson2.value(configKey::apiEndpoint).toString();
+
+    QByteArray responseBody;
+    ErrorCode errorCode = gatewayController.post(QString("%1v1/proxy_config"), apiPayload, responseBody);
+
+    if (errorCode == ErrorCode::NoError) {
+        QSharedPointer<ServerConfig> updatedConfigPtr;
+        errorCode = fillServerConfig(serviceProtocol, protocolData, responseBody, updatedConfigPtr);
+        if (errorCode != ErrorCode::NoError) {
+            return errorCode;
+        }
+        m_serversModel->editServer(updatedConfigPtr, serverIndex);
+        return ErrorCode::NoError;
+    } else {
+        return errorCode;
+    }
+}
+
+ErrorCode ApiConfigsController::deactivateDevice()
+{
+    auto serverIndex = m_serversModel->getProcessedServerIndex();
+    auto serverConfigPtr = m_serversModel->getServerConfig(serverIndex);
+    auto serverConfigObject = serverConfigPtr->toJson();
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    if (!apiUtils::isPremiumServer(serverConfigObject)) {
+        return ErrorCode::NoError;
+    }
+
+    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
+                                            QString(APP_VERSION),
+                                            m_settings->getInstallationUuid(true),
+                                            apiConfigObject.value(configKey::userCountryCode).toString(),
+                                            apiConfigObject.value(configKey::serverCountryCode).toString(),
+                                            apiConfigObject.value(configKey::serviceType).toString(),
+                                            "",
+                                            serverConfigObject.value(configKey::authData).toObject() };
+
+    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/revoke_config"), apiPayload, responseBody);
+    if (errorCode != ErrorCode::NoError && errorCode != ErrorCode::ApiNotFoundError) {
+        return errorCode;
+    }
+
+    serverConfigPtr->containerConfigs.clear();
+    m_serversModel->editServer(serverConfigPtr, serverIndex);
+
+    return ErrorCode::NoError;
+}
+
+ErrorCode ApiConfigsController::deactivateExternalDevice(const QString &uuid, const QString &serverCountryCode)
+{
+    auto serverIndex = m_serversModel->getProcessedServerIndex();
+    auto serverConfigPtr = m_serversModel->getServerConfig(serverIndex);
+    auto serverConfigObject = serverConfigPtr->toJson();
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    if (!apiUtils::isPremiumServer(serverConfigObject)) {
+        return ErrorCode::NoError;
+    }
+
+    GatewayRequestData gatewayRequestData { QSysInfo::productType(),
+                                            QString(APP_VERSION),
+                                            uuid,
+                                            apiConfigObject.value(configKey::userCountryCode).toString(),
+                                            serverCountryCode,
+                                            apiConfigObject.value(configKey::serviceType).toString(),
+                                            "",
+                                            serverConfigObject.value(configKey::authData).toObject() };
+
+    QJsonObject apiPayload = gatewayRequestData.toJsonObject();
+
+    QByteArray responseBody;
+    ErrorCode errorCode = executeRequest(QString("%1v1/revoke_config"), apiPayload, responseBody);
+    if (errorCode != ErrorCode::NoError && errorCode != ErrorCode::ApiNotFoundError) {
+        return errorCode;
+    }
+
+    if (uuid == m_settings->getInstallationUuid(true)) {
+        serverConfigPtr->containerConfigs.clear();
+        m_serversModel->editServer(serverConfigPtr, serverIndex);
+    }
+
+    return ErrorCode::NoError;
+}
+
+bool ApiConfigsController::isConfigValid()
+{
+    int serverIndex = m_serversModel->getDefaultServerIndex();
+    auto serverConfigPtr = m_serversModel->getServerConfig(serverIndex);
+    QJsonObject serverConfigObject = serverConfigPtr->toJson();
+    auto configSource = apiUtils::getConfigSource(serverConfigObject);
+
+    if (configSource == amnezia::ServerConfigType::ApiV1
+        && !m_serversModel->data(serverIndex, ServersModel::Roles::HasInstalledContainers).toBool()) {
+        removeApiConfig(serverIndex);
+        return updateServiceFromTelegram(serverIndex);
+    } else if (configSource == amnezia::ServerConfigType::ApiV2
+               && !m_serversModel->data(serverIndex, ServersModel::Roles::HasInstalledContainers).toBool()) {
+        return updateServiceFromGateway(serverIndex, "", "");
+    } else if (configSource && isApiKeyExpired(serverIndex)) {
+        qDebug() << "attempt to update api config by expires_at event";
+        if (configSource == amnezia::ServerConfigType::ApiV2) {
+            return updateServiceFromGateway(serverIndex, "", "");
+        } else {
+            removeApiConfig(serverIndex);
+            return updateServiceFromTelegram(serverIndex);
+        }
+    }
+    return true;
+}
+
+void ApiConfigsController::setCurrentProtocol(const QString &protocolName)
+{
+    auto serverIndex = m_serversModel->getProcessedServerIndex();
+    auto serverConfigPtr = m_serversModel->getServerConfig(serverIndex);
+    auto serverConfigObject = serverConfigPtr->toJson();
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    apiConfigObject[configKey::serviceProtocol] = protocolName;
+
+    serverConfigObject.insert(configKey::apiConfig, apiConfigObject);
+
+    auto updatedPtr = ServerConfig::createServerConfig(serverConfigObject);
+    m_serversModel->editServer(updatedPtr, serverIndex);
+}
+
+bool ApiConfigsController::isVlessProtocol()
+{
+    auto serverIndex = m_serversModel->getProcessedServerIndex();
+    auto serverConfigObject = m_serversModel->getServerConfig(serverIndex);
+    auto apiConfigObject = serverConfigObject.value(configKey::apiConfig).toObject();
+
+    if (apiConfigObject[configKey::serviceProtocol].toString() == "vless") {
+        return true;
+    }
+    return false;
+}
+
+QList<QString> ApiConfigsController::getQrCodes()
+{
+    return m_qrCodes;
+}
+
+int ApiConfigsController::getQrCodesCount()
+{
+    return m_qrCodes.size();
+}
+
+QString ApiConfigsController::getVpnKey()
+{
+    return m_vpnKey;
+}
+
+ErrorCode ApiConfigsController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody)
+{
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+    return gatewayController.post(endpoint, apiPayload, responseBody);
+}
@@ -0,0 +1,57 @@
+#ifndef APICONFIGSCONTROLLER_H
+#define APICONFIGSCONTROLLER_H
+
+#include <QObject>
+
+#include "configurators/openvpn_configurator.h"
+#include "ui/models/api/apiServicesModel.h"
+#include "ui/models/servers_model.h"
+
+class ApiConfigsController : public QObject
+{
+    Q_OBJECT
+public:
+    ApiConfigsController(const QSharedPointer<ServersModel> &serversModel, const QSharedPointer<ApiServicesModel> &apiServicesModel,
+                         const std::shared_ptr<Settings> &settings, QObject *parent = nullptr);
+
+    QList<QString> getQrCodes();
+    int getQrCodesCount();
+    QString getVpnKey();
+
+public slots:
+    ErrorCode exportNativeConfig(const QString &serverCountryCode, const QString &fileName);
+    ErrorCode revokeNativeConfig(const QString &serverCountryCode);
+    void prepareVpnKeyExport();
+    void copyVpnKeyToClipboard();
+
+    ErrorCode fillAvailableServices();
+    ErrorCode importServiceFromGateway();
+    ErrorCode updateServiceFromGateway(const int serverIndex, const QString &newCountryCode, const QString &newCountryName,
+                                       bool reloadServiceConfig = false);
+    ErrorCode updateServiceFromTelegram(const int serverIndex);
+    ErrorCode deactivateDevice();
+    ErrorCode deactivateExternalDevice(const QString &uuid, const QString &serverCountryCode);
+
+    bool isConfigValid();
+
+    void setCurrentProtocol(const QString &protocolName);
+    bool isVlessProtocol();
+
+private:
+    ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody);
+
+      bool isServerFromApiAlreadyExists(const QString &userCountryCode,
+                                        const QString &serviceType,
+                                        const QString &serviceProtocol) const;
+      bool isApiKeyExpired(int serverIndex) const;
+      void removeApiConfig(int serverIndex);
+
+    QList<QString> m_qrCodes;
+    QString m_vpnKey;
+
+    QSharedPointer<ServersModel> m_serversModel;
+    QSharedPointer<ApiServicesModel> m_apiServicesModel;
+    std::shared_ptr<Settings> m_settings;
+};
+
+#endif // APICONFIGSCONTROLLER_H
@@ -0,0 +1,134 @@
+#include "apiPremV1MigrationController.h"
+
+#include <QEventLoop>
+#include <QTimer>
+
+#include "core/api/apiDefs.h"
+#include "core/api/apiUtils.h"
+#include "core/controllers/api/gatewayController.h"
+
+ApiPremV1MigrationController::ApiPremV1MigrationController(const QSharedPointer<ServersModel> &serversModel,
+                                                           const std::shared_ptr<Settings> &settings, QObject *parent)
+    : QObject(parent), m_serversModel(serversModel), m_settings(settings)
+{
+}
+
+bool ApiPremV1MigrationController::hasConfigsToMigration()
+{
+    QJsonArray vpnKeys;
+
+    auto serversCount = m_serversModel->getServersCount();
+    for (size_t i = 0; i < serversCount; i++) {
+        auto serverConfigPtr = m_serversModel->getServerConfig(i);
+        auto serverConfigObject = serverConfigPtr->toJson();
+
+        if (apiUtils::getConfigType(serverConfigObject) != apiDefs::ConfigType::AmneziaPremiumV1) {
+            continue;
+        }
+
+        QString vpnKey = apiUtils::getPremiumV1VpnKey(serverConfigObject);
+        vpnKeys.append(vpnKey);
+    }
+
+    if (!vpnKeys.isEmpty()) {
+        GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
+                                            m_settings->isStrictKillSwitchEnabled());
+        QJsonObject apiPayload;
+
+        apiPayload["configs"] = vpnKeys;
+        QByteArray responseBody;
+        ErrorCode errorCode = gatewayController.post(QString("%1v1/prem-v1/is-active-subscription"), apiPayload, responseBody);
+
+        auto migrationsStatus = QJsonDocument::fromJson(responseBody).object();
+        for (const auto &migrationStatus : migrationsStatus) {
+            if (migrationStatus == "not_found") {
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
+void ApiPremV1MigrationController::getSubscriptionList(const QString &email)
+{
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+    QJsonObject apiPayload;
+
+    apiPayload[apiDefs::key::email] = email;
+    QByteArray responseBody;
+    ErrorCode errorCode = gatewayController.post(QString("%1v1/prem-v1/subscription-list"), apiPayload, responseBody);
+
+    if (errorCode == ErrorCode::NoError) {
+        m_email = email;
+        m_subscriptionsModel = QJsonDocument::fromJson(responseBody).array();
+        if (m_subscriptionsModel.isEmpty()) {
+            emit noSubscriptionToMigrate();
+            return;
+        }
+
+        emit subscriptionsModelChanged();
+    } else {
+        emit errorOccurred(ErrorCode::ApiMigrationError);
+    }
+}
+
+QJsonArray ApiPremV1MigrationController::getSubscriptionModel()
+{
+    return m_subscriptionsModel;
+}
+
+void ApiPremV1MigrationController::sendMigrationCode(const int subscriptionIndex)
+{
+    QEventLoop wait;
+    QTimer::singleShot(1000, &wait, &QEventLoop::quit);
+    wait.exec();
+
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+    QJsonObject apiPayload;
+
+    apiPayload[apiDefs::key::email] = m_email;
+    QByteArray responseBody;
+    ErrorCode errorCode = gatewayController.post(QString("%1v1/prem-v1/migration-code"), apiPayload, responseBody);
+
+    if (errorCode == ErrorCode::NoError) {
+        m_subscriptionIndex = subscriptionIndex;
+        emit otpSuccessfullySent();
+    } else {
+        emit errorOccurred(ErrorCode::ApiMigrationError);
+    }
+}
+
+void ApiPremV1MigrationController::migrate(const QString &migrationCode)
+{
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+    QJsonObject apiPayload;
+
+    apiPayload[apiDefs::key::email] = m_email;
+    apiPayload[apiDefs::key::orderId] = m_subscriptionsModel.at(m_subscriptionIndex).toObject().value(apiDefs::key::id).toString();
+    apiPayload[apiDefs::key::migrationCode] = migrationCode;
+    QByteArray responseBody;
+    ErrorCode errorCode = gatewayController.post(QString("%1v1/prem-v1/migrate"), apiPayload, responseBody);
+
+    if (errorCode == ErrorCode::NoError) {
+        auto responseObject = QJsonDocument::fromJson(responseBody).object();
+        QString premiumV2VpnKey = responseObject.value(apiDefs::key::config).toString();
+
+        emit importPremiumV2VpnKey(premiumV2VpnKey);
+    } else {
+        emit errorOccurred(ErrorCode::ApiMigrationError);
+    }
+}
+
+bool ApiPremV1MigrationController::isPremV1MigrationReminderActive()
+{
+    return m_settings->isPremV1MigrationReminderActive();
+}
+
+void ApiPremV1MigrationController::disablePremV1MigrationReminder()
+{
+    m_settings->disablePremV1MigrationReminder();
+}
@@ -0,0 +1,50 @@
+#ifndef APIPREMV1MIGRATIONCONTROLLER_H
+#define APIPREMV1MIGRATIONCONTROLLER_H
+
+#include <QObject>
+
+#include "ui/models/servers_model.h"
+
+class ApiPremV1MigrationController : public QObject
+{
+    Q_OBJECT
+public:
+    ApiPremV1MigrationController(const QSharedPointer<ServersModel> &serversModel, const std::shared_ptr<Settings> &settings,
+                                 QObject *parent = nullptr);
+
+    Q_PROPERTY(QJsonArray subscriptionsModel READ getSubscriptionModel NOTIFY subscriptionsModelChanged)
+
+public slots:
+    bool hasConfigsToMigration();
+    void getSubscriptionList(const QString &email);
+    QJsonArray getSubscriptionModel();
+    void sendMigrationCode(const int subscriptionIndex);
+    void migrate(const QString &migrationCode);
+
+    bool isPremV1MigrationReminderActive();
+    void disablePremV1MigrationReminder();
+
+signals:
+    void subscriptionsModelChanged();
+
+    void otpSuccessfullySent();
+
+    void importPremiumV2VpnKey(const QString &vpnKey);
+
+    void errorOccurred(ErrorCode errorCode);
+
+    void showMigrationDrawer();
+    void migrationFinished();
+
+    void noSubscriptionToMigrate();
+
+private:
+    QSharedPointer<ServersModel> m_serversModel;
+    std::shared_ptr<Settings> m_settings;
+
+    QJsonArray m_subscriptionsModel;
+    int m_subscriptionIndex;
+    QString m_email;
+};
+
+#endif // APIPREMV1MIGRATIONCONTROLLER_H
@@ -0,0 +1,94 @@
+#include "apiSettingsController.h"
+
+#include <QEventLoop>
+#include <QTimer>
+
+#include "core/api/apiUtils.h"
+#include "core/controllers/api/gatewayController.h"
+#include "version.h"
+
+namespace
+{
+    namespace configKey
+    {
+        constexpr char userCountryCode[] = "user_country_code";
+        constexpr char serverCountryCode[] = "server_country_code";
+        constexpr char serviceType[] = "service_type";
+        constexpr char serviceInfo[] = "service_info";
+
+        constexpr char apiConfig[] = "api_config";
+        constexpr char authData[] = "auth_data";
+    }
+
+    const int requestTimeoutMsecs = 12 * 1000; // 12 secs
+}
+
+ApiSettingsController::ApiSettingsController(const QSharedPointer<ServersModel> &serversModel,
+                                             const QSharedPointer<ApiAccountInfoModel> &apiAccountInfoModel,
+                                             const QSharedPointer<ApiCountryModel> &apiCountryModel,
+                                             const QSharedPointer<ApiDevicesModel> &apiDevicesModel,
+                                             const std::shared_ptr<Settings> &settings, QObject *parent)
+    : QObject(parent),
+      m_serversModel(serversModel),
+      m_apiAccountInfoModel(apiAccountInfoModel),
+      m_apiCountryModel(apiCountryModel),
+      m_apiDevicesModel(apiDevicesModel),
+      m_settings(settings)
+{
+}
+
+ApiSettingsController::~ApiSettingsController()
+{
+}
+
+ErrorCode ApiSettingsController::getAccountInfo(bool reload)
+{
+    if (reload) {
+        QEventLoop wait;
+        QTimer::singleShot(1000, &wait, &QEventLoop::quit);
+        wait.exec();
+    }
+
+    GatewayController gatewayController(m_settings->getGatewayEndpoint(), m_settings->isDevGatewayEnv(), requestTimeoutMsecs,
+                                        m_settings->isStrictKillSwitchEnabled());
+
+    auto processedIndex = m_serversModel->getProcessedServerIndex();
+    auto serverConfigPtr = m_serversModel->getServerConfig(processedIndex);
+    auto serverConfig = serverConfigPtr->toJson();
+    auto apiConfig = serverConfig.value(configKey::apiConfig).toObject();
+    auto authData = serverConfig.value(configKey::authData).toObject();
+
+    QJsonObject apiPayload;
+    apiPayload[configKey::userCountryCode] = apiConfig.value(configKey::userCountryCode).toString();
+    apiPayload[configKey::serviceType] = apiConfig.value(configKey::serviceType).toString();
+    apiPayload[configKey::authData] = authData;
+    apiPayload[apiDefs::key::cliVersion] = QString(APP_VERSION);
+
+    QByteArray responseBody;
+
+    ErrorCode errorCode = gatewayController.post(QString("%1v1/account_info"), apiPayload, responseBody);
+    if (errorCode != ErrorCode::NoError) {
+        return errorCode;
+    }
+
+    QJsonObject accountInfo = QJsonDocument::fromJson(responseBody).object();
+    m_apiAccountInfoModel->updateModel(accountInfo, serverConfig);
+
+    if (reload) {
+        updateApiCountryModel();
+        updateApiDevicesModel();
+    }
+
+    return ErrorCode::NoError;
+}
+
+void ApiSettingsController::updateApiCountryModel()
+{
+    m_apiCountryModel->updateModel(m_apiAccountInfoModel->getAvailableCountries(), "");
+    m_apiCountryModel->updateIssuedConfigsInfo(m_apiAccountInfoModel->getIssuedConfigsInfo());
+}
+
+void ApiSettingsController::updateApiDevicesModel()
+{
+    m_apiDevicesModel->updateModel(m_apiAccountInfoModel->getIssuedConfigsInfo());
+}
@@ -0,0 +1,34 @@
+#ifndef APISETTINGSCONTROLLER_H
+#define APISETTINGSCONTROLLER_H
+
+#include <QObject>
+
+#include "ui/models/api/apiAccountInfoModel.h"
+#include "ui/models/api/apiCountryModel.h"
+#include "ui/models/api/apiDevicesModel.h"
+#include "ui/models/servers_model.h"
+
+class ApiSettingsController : public QObject
+{
+    Q_OBJECT
+public:
+    ApiSettingsController(const QSharedPointer<ServersModel> &serversModel, const QSharedPointer<ApiAccountInfoModel> &apiAccountInfoModel,
+                          const QSharedPointer<ApiCountryModel> &apiCountryModel, const QSharedPointer<ApiDevicesModel> &apiDevicesModel,
+                          const std::shared_ptr<Settings> &settings, QObject *parent = nullptr);
+    ~ApiSettingsController();
+
+public slots:
+    ErrorCode getAccountInfo(bool reload);
+    void updateApiCountryModel();
+    void updateApiDevicesModel();
+
+private:
+    QSharedPointer<ServersModel> m_serversModel;
+    QSharedPointer<ApiAccountInfoModel> m_apiAccountInfoModel;
+    QSharedPointer<ApiCountryModel> m_apiCountryModel;
+    QSharedPointer<ApiDevicesModel> m_apiDevicesModel;
+
+    std::shared_ptr<Settings> m_settings;
+};
+
+#endif // APISETTINGSCONTROLLER_H
@@ -0,0 +1,364 @@
+#include "gatewayController.h"
+
+#include <algorithm>
+#include <random>
+
+#include <QJsonArray>
+#include <QJsonDocument>
+#include <QJsonObject>
+#include <QNetworkReply>
+#include <QUrl>
+
+#include "QBlockCipher.h"
+#include "QRsa.h"
+
+#include "amnezia_application.h"
+#include "core/api/apiUtils.h"
+#include "core/networkUtilities.h"
+#include "utilities.h"
+
+#ifdef AMNEZIA_DESKTOP
+    #include "core/ipcclient.h"
+#endif
+
+namespace
+{
+    namespace configKey
+    {
+        constexpr char aesKey[] = "aes_key";
+        constexpr char aesIv[] = "aes_iv";
+        constexpr char aesSalt[] = "aes_salt";
+
+        constexpr char apiPayload[] = "api_payload";
+        constexpr char keyPayload[] = "key_payload";
+    }
+
+    constexpr QLatin1String errorResponsePattern1("No active configuration found for");
+    constexpr QLatin1String errorResponsePattern2("No non-revoked public key found for");
+    constexpr QLatin1String errorResponsePattern3("Account not found.");
+
+    constexpr QLatin1String updateRequestResponsePattern("client version update is required");
+}
+
+GatewayController::GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
+                                     const bool isStrictKillSwitchEnabled, QObject *parent)
+    : QObject(parent),
+      m_gatewayEndpoint(gatewayEndpoint),
+      m_isDevEnvironment(isDevEnvironment),
+      m_requestTimeoutMsecs(requestTimeoutMsecs),
+      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
+{
+}
+
+ErrorCode GatewayController::get(const QString &endpoint, QByteArray &responseBody)
+{
+#ifdef Q_OS_IOS
+    IosController::Instance()->requestInetAccess();
+    QThread::msleep(10);
+#endif
+
+    QNetworkRequest request;
+    request.setTransferTimeout(m_requestTimeoutMsecs);
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+
+    request.setUrl(QString(endpoint).arg(m_gatewayEndpoint));
+
+    // bypass killSwitch exceptions for API-gateway
+#ifdef AMNEZIA_DESKTOP
+    if (m_isStrictKillSwitchEnabled) {
+        QString host = QUrl(request.url()).host();
+        QString ip = NetworkUtilities::getIPAddress(host);
+        if (!ip.isEmpty()) {
+            IpcClient::Interface()->addKillSwitchAllowedRange(QStringList { ip });
+        }
+    }
+#endif
+
+    QNetworkReply *reply;
+    reply = amnApp->networkManager()->get(request);
+
+    QEventLoop wait;
+    QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+
+    QList<QSslError> sslErrors;
+    connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
+    wait.exec();
+
+    responseBody = reply->readAll();
+
+    if (sslErrors.isEmpty() && shouldBypassProxy(reply, responseBody, false)) {
+        auto requestFunction = [&request, &responseBody](const QString &url) {
+            request.setUrl(url);
+            return amnApp->networkManager()->get(request);
+        };
+
+        auto replyProcessingFunction = [&responseBody, &reply, &sslErrors, this](QNetworkReply *nestedReply,
+                                                                                 const QList<QSslError> &nestedSslErrors) {
+            responseBody = nestedReply->readAll();
+            if (!sslErrors.isEmpty() || !shouldBypassProxy(nestedReply, responseBody, false)) {
+                sslErrors = nestedSslErrors;
+                reply = nestedReply;
+                return true;
+            }
+            return false;
+        };
+
+        bypassProxy(endpoint, reply, requestFunction, replyProcessingFunction);
+    }
+
+    auto errorCode = apiUtils::checkNetworkReplyErrors(sslErrors, reply);
+    reply->deleteLater();
+
+    return errorCode;
+}
+
+ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody)
+{
+#ifdef Q_OS_IOS
+    IosController::Instance()->requestInetAccess();
+    QThread::msleep(10);
+#endif
+
+    QNetworkRequest request;
+    request.setTransferTimeout(m_requestTimeoutMsecs);
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+
+    request.setUrl(endpoint.arg(m_gatewayEndpoint));
+
+    // bypass killSwitch exceptions for API-gateway
+#ifdef AMNEZIA_DESKTOP
+    if (m_isStrictKillSwitchEnabled) {
+        QString host = QUrl(request.url()).host();
+        QString ip = NetworkUtilities::getIPAddress(host);
+        if (!ip.isEmpty()) {
+            IpcClient::Interface()->addKillSwitchAllowedRange(QStringList { ip });
+        }
+    }
+#endif
+
+    QSimpleCrypto::QBlockCipher blockCipher;
+    QByteArray key = blockCipher.generatePrivateSalt(32);
+    QByteArray iv = blockCipher.generatePrivateSalt(32);
+    QByteArray salt = blockCipher.generatePrivateSalt(8);
+
+    QJsonObject keyPayload;
+    keyPayload[configKey::aesKey] = QString(key.toBase64());
+    keyPayload[configKey::aesIv] = QString(iv.toBase64());
+    keyPayload[configKey::aesSalt] = QString(salt.toBase64());
+
+    QByteArray encryptedKeyPayload;
+    QByteArray encryptedApiPayload;
+    try {
+        QSimpleCrypto::QRsa rsa;
+
+        EVP_PKEY *publicKey = nullptr;
+        try {
+            QByteArray rsaKey = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+            QSimpleCrypto::QRsa rsa;
+            publicKey = rsa.getPublicKeyFromByteArray(rsaKey);
+        } catch (...) {
+            Utils::logException();
+            qCritical() << "error loading public key from environment variables";
+            return ErrorCode::ApiMissingAgwPublicKey;
+        }
+
+        encryptedKeyPayload = rsa.encrypt(QJsonDocument(keyPayload).toJson(), publicKey, RSA_PKCS1_PADDING);
+        EVP_PKEY_free(publicKey);
+
+        encryptedApiPayload = blockCipher.encryptAesBlockCipher(QJsonDocument(apiPayload).toJson(), key, iv, "", salt);
+    } catch (...) { // todo change error handling in QSimpleCrypto?
+        Utils::logException();
+        qCritical() << "error when encrypting the request body";
+        return ErrorCode::ApiConfigDecryptionError;
+    }
+
+    QJsonObject requestBody;
+    requestBody[configKey::keyPayload] = QString(encryptedKeyPayload.toBase64());
+    requestBody[configKey::apiPayload] = QString(encryptedApiPayload.toBase64());
+
+    QNetworkReply *reply = amnApp->networkManager()->post(request, QJsonDocument(requestBody).toJson());
+
+    QEventLoop wait;
+    connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+
+    QList<QSslError> sslErrors;
+    connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
+    wait.exec();
+
+    QByteArray encryptedResponseBody = reply->readAll();
+
+    if (sslErrors.isEmpty() && shouldBypassProxy(reply, encryptedResponseBody, true, key, iv, salt)) {
+        auto requestFunction = [&request, &encryptedResponseBody, &requestBody](const QString &url) {
+            request.setUrl(url);
+            return amnApp->networkManager()->post(request, QJsonDocument(requestBody).toJson());
+        };
+
+        auto replyProcessingFunction = [&encryptedResponseBody, &reply, &sslErrors, &key, &iv, &salt,
+                                        this](QNetworkReply *nestedReply, const QList<QSslError> &nestedSslErrors) {
+            encryptedResponseBody = nestedReply->readAll();
+            reply = nestedReply;
+            if (!sslErrors.isEmpty() || shouldBypassProxy(nestedReply, encryptedResponseBody, true, key, iv, salt)) {
+                sslErrors = nestedSslErrors;
+                return false;
+            }
+            return true;
+        };
+
+        bypassProxy(endpoint, reply, requestFunction, replyProcessingFunction);
+    }
+
+    auto errorCode = apiUtils::checkNetworkReplyErrors(sslErrors, reply);
+    reply->deleteLater();
+    if (errorCode) {
+        return errorCode;
+    }
+
+    try {
+        responseBody = blockCipher.decryptAesBlockCipher(encryptedResponseBody, key, iv, "", salt);
+        return ErrorCode::NoError;
+    } catch (...) { // todo change error handling in QSimpleCrypto?
+        Utils::logException();
+        qCritical() << "error when decrypting the request body";
+        return ErrorCode::ApiConfigDecryptionError;
+    }
+}
+
+QStringList GatewayController::getProxyUrls()
+{
+    QNetworkRequest request;
+    request.setTransferTimeout(m_requestTimeoutMsecs);
+    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
+
+    QEventLoop wait;
+    QList<QSslError> sslErrors;
+    QNetworkReply *reply;
+
+    QStringList proxyStorageUrls;
+    if (m_isDevEnvironment) {
+        proxyStorageUrls = QString(DEV_S3_ENDPOINT).split(", ");
+    } else {
+        proxyStorageUrls = QString(PROD_S3_ENDPOINT).split(", ");
+    }
+
+    QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+
+    for (const auto &proxyStorageUrl : proxyStorageUrls) {
+        request.setUrl(proxyStorageUrl);
+        reply = amnApp->networkManager()->get(request);
+
+        connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+        connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
+        wait.exec();
+
+        if (reply->error() == QNetworkReply::NetworkError::NoError) {
+            auto encryptedResponseBody = reply->readAll();
+            reply->deleteLater();
+
+            EVP_PKEY *privateKey = nullptr;
+            QByteArray responseBody;
+            try {
+                if (!m_isDevEnvironment) {
+                    QCryptographicHash hash(QCryptographicHash::Sha512);
+                    hash.addData(key);
+                    QByteArray hashResult = hash.result().toHex();
+
+                    QByteArray key = QByteArray::fromHex(hashResult.left(64));
+                    QByteArray iv = QByteArray::fromHex(hashResult.mid(64, 32));
+
+                    QByteArray ba = QByteArray::fromBase64(encryptedResponseBody);
+
+                    QSimpleCrypto::QBlockCipher blockCipher;
+                    responseBody = blockCipher.decryptAesBlockCipher(ba, key, iv);
+                } else {
+                    responseBody = encryptedResponseBody;
+                }
+            } catch (...) {
+                Utils::logException();
+                qCritical() << "error loading private key from environment variables or decrypting payload" << encryptedResponseBody;
+                continue;
+            }
+
+            auto endpointsArray = QJsonDocument::fromJson(responseBody).array();
+
+            QStringList endpoints;
+            for (const auto &endpoint : endpointsArray) {
+                endpoints.push_back(endpoint.toString());
+            }
+            return endpoints;
+        } else {
+            apiUtils::checkNetworkReplyErrors(sslErrors, reply);
+            qDebug() << "go to the next storage endpoint";
+
+            reply->deleteLater();
+        }
+    }
+    return {};
+}
+
+bool GatewayController::shouldBypassProxy(QNetworkReply *reply, const QByteArray &responseBody, bool checkEncryption, const QByteArray &key,
+                                          const QByteArray &iv, const QByteArray &salt)
+{
+    if (reply->error() == QNetworkReply::NetworkError::OperationCanceledError || reply->error() == QNetworkReply::NetworkError::TimeoutError) {
+        qDebug() << "timeout occurred";
+        qDebug() << reply->error();
+        return true;
+    } else if (responseBody.contains("html")) {
+        qDebug() << "the response contains an html tag";
+        return true;
+    } else if (reply->error() == QNetworkReply::NetworkError::ContentNotFoundError) {
+        if (responseBody.contains(errorResponsePattern1) || responseBody.contains(errorResponsePattern2)
+            || responseBody.contains(errorResponsePattern3)) {
+            return false;
+        } else {
+            qDebug() << reply->error();
+            return true;
+        }
+    } else if (reply->error() == QNetworkReply::NetworkError::OperationNotImplementedError) {
+        if (responseBody.contains(updateRequestResponsePattern)) {
+            return false;
+        } else {
+            qDebug() << reply->error();
+            return true;
+        }
+    } else if (reply->error() != QNetworkReply::NetworkError::NoError) {
+        qDebug() << reply->error();
+        return true;
+    } else if (checkEncryption) {
+        try {
+            QSimpleCrypto::QBlockCipher blockCipher;
+            static_cast<void>(blockCipher.decryptAesBlockCipher(responseBody, key, iv, "", salt));
+        } catch (...) {
+            qDebug() << "failed to decrypt the data";
+            return true;
+        }
+    }
+    return false;
+}
+
+void GatewayController::bypassProxy(const QString &endpoint, QNetworkReply *reply,
+                                    std::function<QNetworkReply *(const QString &url)> requestFunction,
+                                    std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction)
+{
+    QStringList proxyUrls = getProxyUrls();
+    std::random_device randomDevice;
+    std::mt19937 generator(randomDevice());
+    std::shuffle(proxyUrls.begin(), proxyUrls.end(), generator);
+
+    QEventLoop wait;
+    QList<QSslError> sslErrors;
+    QByteArray responseBody;
+
+    for (const QString &proxyUrl : proxyUrls) {
+        qDebug() << "go to the next proxy endpoint";
+        reply->deleteLater(); // delete the previous reply
+        reply = requestFunction(endpoint.arg(proxyUrl));
+
+        QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
+        connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
+        wait.exec();
+
+        if (replyProcessingFunction(reply, sslErrors)) {
+            break;
+        }
+    }
+}
@@ -0,0 +1,37 @@
+#ifndef GATEWAYCONTROLLER_H
+#define GATEWAYCONTROLLER_H
+
+#include <QNetworkReply>
+#include <QObject>
+
+#include "core/defs.h"
+
+#ifdef Q_OS_IOS
+    #include "platforms/ios/ios_controller.h"
+#endif
+
+class GatewayController : public QObject
+{
+    Q_OBJECT
+
+public:
+    explicit GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
+                               const bool isStrictKillSwitchEnabled, QObject *parent = nullptr);
+
+    amnezia::ErrorCode get(const QString &endpoint, QByteArray &responseBody);
+    amnezia::ErrorCode post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody);
+
+private:
+    QStringList getProxyUrls();
+    bool shouldBypassProxy(QNetworkReply *reply, const QByteArray &responseBody, bool checkEncryption, const QByteArray &key = "",
+                           const QByteArray &iv = "", const QByteArray &salt = "");
+    void bypassProxy(const QString &endpoint, QNetworkReply *reply, std::function<QNetworkReply *(const QString &url)> requestFunction,
+                     std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction);
+
+    int m_requestTimeoutMsecs;
+    QString m_gatewayEndpoint;
+    bool m_isDevEnvironment = false;
+    bool m_isStrictKillSwitchEnabled = false;
+};
+
+#endif // GATEWAYCONTROLLER_H
@@ -1,72 +0,0 @@
-#include "newsController.h"
-
-#include "core/controllers/gatewayController.h"
-#include "core/utils/api/apiEnums.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/constants/apiConstants.h"
-#include "core/utils/constants/configKeys.h"
-#include <QtConcurrent/QtConcurrent>
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QSharedPointer>
-
-using namespace amnezia;
-
-NewsController::NewsController(SecureAppSettingsRepository* appSettingsRepository,
-                               ServersController* serversController)
-    : m_appSettingsRepository(appSettingsRepository), m_serversController(serversController)
-{
-}
-
-QFuture<QPair<ErrorCode, QJsonArray>> NewsController::fetchNews()
-{
-    if (!m_serversController) {
-        qWarning() << "ServersController is null, skip fetchNews";
-        return QtFuture::makeReadyFuture(qMakePair(ErrorCode::InternalError, QJsonArray()));
-    }
-    
-    const auto stacks = m_serversController->gatewayStacks();
-    if (stacks.isEmpty()) {
-        qDebug() << "No Gateway stacks, skip fetchNews";
-        return QtFuture::makeReadyFuture(qMakePair(ErrorCode::NoError, QJsonArray()));
-    }
-
-    auto gatewayController = QSharedPointer<GatewayController>::create(
-        m_appSettingsRepository->getGatewayEndpoint(),
-        m_appSettingsRepository->isDevGatewayEnv(),
-        apiDefs::requestTimeoutMsecs,
-        m_appSettingsRepository->isStrictKillSwitchEnabled());
-    
-    QJsonObject payload;
-    payload.insert("locale", m_appSettingsRepository->getAppLanguage().name().split("_").first());
-
-    const QJsonObject stacksJson = stacks.toJson();
-    if (stacksJson.contains(apiDefs::key::userCountryCode)) {
-        payload.insert(apiDefs::key::userCountryCode, stacksJson.value(apiDefs::key::userCountryCode));
-    }
-    if (stacksJson.contains(apiDefs::key::serviceType)) {
-        payload.insert(apiDefs::key::serviceType, stacksJson.value(apiDefs::key::serviceType));
-    }
-
-    auto future = gatewayController->postAsync(QString("%1v1/news"), payload);
-    return future.then([gatewayController](QPair<ErrorCode, QByteArray> result) -> QPair<ErrorCode, QJsonArray> {
-        auto [errorCode, responseBody] = result;
-        if (errorCode != ErrorCode::NoError) {
-            return qMakePair(errorCode, QJsonArray());
-        }
-
-        QJsonDocument doc = QJsonDocument::fromJson(responseBody);
-        QJsonArray newsArray;
-        if (doc.isArray()) {
-            newsArray = doc.array();
-        } else if (doc.isObject()) {
-            QJsonObject obj = doc.object();
-            if (obj.value("news").isArray()) {
-                newsArray = obj.value("news").toArray();
-            }
-        }
-
-        return qMakePair(ErrorCode::NoError, newsArray);
-    });
-}
-
@@ -1,28 +0,0 @@
-#ifndef NEWSCONTROLLER_H
-#define NEWSCONTROLLER_H
-
-#include <QFuture>
-#include <QJsonArray>
-#include <QPair>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "core/controllers/serversController.h"
-
-class NewsController
-{
-public:
-    explicit NewsController(SecureAppSettingsRepository* appSettingsRepository,
-                           ServersController* serversController);
-
-    QFuture<QPair<ErrorCode, QJsonArray>> fetchNews();
-
-private:
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    ServersController* m_serversController;
-};
-
-#endif // NEWSCONTROLLER_H
-
@@ -1,248 +0,0 @@
-#include "servicesCatalogController.h"
-
-#include <QJsonDocument>
-#include <QSysInfo>
-#include <QJsonArray>
-#include <QEventLoop>
-#include <QDebug>
-#include <QCoreApplication>
-#include <QHash>
-#include <QSet>
-#include <limits>
-
-#include "core/controllers/gatewayController.h"
-#include "core/utils/api/apiEnums.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/constants/apiConstants.h"
-#include "version.h"
-
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-#include "platforms/ios/ios_controller.h"
-#endif
-
-namespace
-{
-    namespace configKey
-    {
-        constexpr char serviceDescription[] = "service_description";
-        constexpr char subscriptionPlans[] = "subscription_plans";
-        constexpr char storeProductId[] = "store_product_id";
-        constexpr char priceLabel[] = "price_label";
-        constexpr char subtitle[] = "subtitle";
-        constexpr char isTrial[] = "is_trial";
-        constexpr char minPriceLabel[] = "min_price_label";
-    }
-
-    namespace serviceType
-    {
-        constexpr char amneziaPremium[] = "amnezia-premium";
-    }
-
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-    struct StoreKitPlanQuote {
-        QString displayPrice;
-        double priceAmount = 0.0;
-        double subscriptionBillingMonths = 0.0;
-        QString displayPricePerMonth;
-    };
-
-    constexpr double oneMonthThreshold = 1.0 + 1e-6;
-    constexpr double monthsFallbackThreshold = 1e-6;
-    constexpr double monthlyPriceEpsilon = 1e-9;
-
-    QStringList collectPremiumStoreProductIds(const QJsonArray &services)
-    {
-        QStringList productIds;
-        QSet<QString> seenProductIds;
-        for (const QJsonValue &serviceValue : services) {
-            const QJsonObject serviceObject = serviceValue.toObject();
-            if (serviceObject.value(apiDefs::key::serviceType).toString() != serviceType::amneziaPremium) {
-                continue;
-            }
-            const QJsonArray subscriptionPlans =
-                    serviceObject.value(configKey::serviceDescription).toObject().value(configKey::subscriptionPlans).toArray();
-            for (const QJsonValue &planValue : subscriptionPlans) {
-                if (!planValue.isObject()) {
-                    continue;
-                }
-                const QString storeProductId = planValue.toObject().value(configKey::storeProductId).toString();
-                if (storeProductId.isEmpty() || seenProductIds.contains(storeProductId)) {
-                    continue;
-                }
-                seenProductIds.insert(storeProductId);
-                productIds.append(storeProductId);
-            }
-        }
-        return productIds;
-    }
-
-    QHash<QString, StoreKitPlanQuote> buildStoreKitQuoteMap(const QList<QVariantMap> &fetchedProducts)
-    {
-        QHash<QString, StoreKitPlanQuote> quotesByProductId;
-        quotesByProductId.reserve(fetchedProducts.size());
-
-        for (const QVariantMap &productInfo : fetchedProducts) {
-            const QString productId = productInfo.value(QStringLiteral("productId")).toString();
-            if (productId.isEmpty()) {
-                continue;
-            }
-
-            QString displayPrice = productInfo.value(QStringLiteral("displayPrice")).toString();
-            if (displayPrice.isEmpty()) {
-                const QString price = productInfo.value(QStringLiteral("price")).toString();
-                const QString currencyCode = productInfo.value(QStringLiteral("currencyCode")).toString();
-                displayPrice = currencyCode.isEmpty() ? price : (price + QLatin1Char(' ') + currencyCode);
-            }
-
-            StoreKitPlanQuote quote;
-            quote.displayPrice = displayPrice;
-            quote.priceAmount = productInfo.value(QStringLiteral("priceAmount")).toDouble();
-            quote.subscriptionBillingMonths = productInfo.value(QStringLiteral("subscriptionBillingMonths")).toDouble();
-            quote.displayPricePerMonth = productInfo.value(QStringLiteral("displayPricePerMonth")).toString();
-            quotesByProductId.insert(productId, quote);
-        }
-
-        return quotesByProductId;
-    }
-
-    void mergeStoreKitPricesIntoPremiumPlans(QJsonObject &data)
-    {
-        QJsonArray services = data.value(apiDefs::key::services).toArray();
-        if (services.isEmpty()) {
-            return;
-        }
-
-        const QStringList productIds = collectPremiumStoreProductIds(services);
-        if (productIds.isEmpty()) {
-            qInfo().noquote() << "[IAP] No store_product_id in premium plans; skip StoreKit merge into services payload";
-            return;
-        }
-
-        QList<QVariantMap> fetchedProducts;
-        QEventLoop loop;
-        IosController::Instance()->fetchProducts(productIds,
-                                                 [&](const QList<QVariantMap> &products, const QStringList &invalidIds,
-                                                     const QString &errorString) {
-                                                     if (!errorString.isEmpty()) {
-                                                         qWarning().noquote() << "[IAP] StoreKit merge fetch:" << errorString;
-                                                     }
-                                                     if (!invalidIds.isEmpty()) {
-                                                         qWarning().noquote() << "[IAP] Unknown App Store product ids:" << invalidIds;
-                                                     }
-                                                     fetchedProducts = products;
-                                                     loop.quit();
-                                                 });
-        loop.exec();
-
-        const QHash<QString, StoreKitPlanQuote> quotesByProductId = buildStoreKitQuoteMap(fetchedProducts);
-
-        for (int serviceIndex = 0; serviceIndex < services.size(); ++serviceIndex) {
-            QJsonObject serviceObject = services.at(serviceIndex).toObject();
-            if (serviceObject.value(apiDefs::key::serviceType).toString() != serviceType::amneziaPremium) {
-                continue;
-            }
-
-            QJsonObject descriptionObject = serviceObject.value(configKey::serviceDescription).toObject();
-            const QJsonArray sourcePlans = descriptionObject.value(configKey::subscriptionPlans).toArray();
-
-            QJsonArray mergedPlans;
-            double minMonthlyAmount = std::numeric_limits<double>::infinity();
-            QString minMonthlyDisplay;
-
-            for (const QJsonValue &planValue : sourcePlans) {
-                if (!planValue.isObject()) {
-                    continue;
-                }
-
-                QJsonObject planObject = planValue.toObject();
-                const QString storeProductId = planObject.value(configKey::storeProductId).toString();
-                if (storeProductId.isEmpty()) {
-                    continue;
-                }
-
-                const auto quoteIterator = quotesByProductId.constFind(storeProductId);
-                if (quoteIterator == quotesByProductId.cend()) {
-                    continue;
-                }
-
-                const bool isTrialPlan = planObject.value(configKey::isTrial).toBool();
-                const StoreKitPlanQuote &quote = *quoteIterator;
-                planObject.insert(configKey::priceLabel, quote.displayPrice);
-
-                const double months = quote.subscriptionBillingMonths;
-                if (!isTrialPlan && months > oneMonthThreshold && !quote.displayPricePerMonth.isEmpty()) {
-                    planObject.insert(
-                            configKey::subtitle,
-                            QCoreApplication::translate("ServicesCatalogController", "%1/mo",
-                                                        "IAP: price per month in plan subtitle")
-                                    .arg(quote.displayPricePerMonth));
-                }
-
-                if (!isTrialPlan && quote.priceAmount > 0.0) {
-                    const double monthsForMin = months > monthsFallbackThreshold ? months : 1.0;
-                    const double monthly = quote.priceAmount / monthsForMin;
-                    if (monthly < minMonthlyAmount - monthlyPriceEpsilon) {
-                        minMonthlyAmount = monthly;
-                        minMonthlyDisplay = !quote.displayPricePerMonth.isEmpty() ? quote.displayPricePerMonth : quote.displayPrice;
-                    }
-                }
-
-                mergedPlans.append(planObject);
-            }
-
-            descriptionObject.insert(configKey::subscriptionPlans, mergedPlans);
-            if (minMonthlyAmount < std::numeric_limits<double>::infinity() && !minMonthlyDisplay.isEmpty()) {
-                descriptionObject.insert(configKey::minPriceLabel,
-                                         QCoreApplication::translate("ServicesCatalogController", "from %1 per month",
-                                                                     "IAP: card footer minimum monthly price from StoreKit")
-                                                 .arg(minMonthlyDisplay));
-            }
-            serviceObject.insert(configKey::serviceDescription, descriptionObject);
-            services.replace(serviceIndex, serviceObject);
-        }
-        data.insert(apiDefs::key::services, services);
-    }
-#endif
-}
-
-ServicesCatalogController::ServicesCatalogController(SecureAppSettingsRepository* appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-}
-
-ErrorCode ServicesCatalogController::fillAvailableServices(QJsonObject &servicesData)
-{
-    QJsonObject apiPayload;
-    apiPayload[apiDefs::key::osVersion] = QSysInfo::productType();
-    apiPayload[apiDefs::key::appVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::cliName] = QString(APPLICATION_NAME);
-    apiPayload[apiDefs::key::appLanguage] = m_appSettingsRepository->getAppLanguage().name().split("_").first();
-
-    QByteArray responseBody;
-    ErrorCode errorCode = executeRequest(QString("%1v1/services"), apiPayload, responseBody);
-    if (errorCode == ErrorCode::NoError) {
-        if (!responseBody.contains(apiDefs::key::services.data())) {
-            errorCode = ErrorCode::ApiServicesMissingError;
-        }
-    }
-
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-
-    servicesData = QJsonDocument::fromJson(responseBody).object();
-
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-    mergeStoreKitPricesIntoPremiumPlans(servicesData);
-#endif
-
-    return ErrorCode::NoError;
-}
-
-ErrorCode ServicesCatalogController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody)
-{
-    GatewayController gatewayController(m_appSettingsRepository->getGatewayEndpoint(), m_appSettingsRepository->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
-                                        m_appSettingsRepository->isStrictKillSwitchEnabled());
-    return gatewayController.post(endpoint, apiPayload, responseBody);
-}
-
@@ -1,26 +0,0 @@
-#ifndef SERVICESCATALOGCONTROLLER_H
-#define SERVICESCATALOGCONTROLLER_H
-
-#include <QJsonObject>
-#include <QByteArray>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class ServicesCatalogController
-{
-public:
-    explicit ServicesCatalogController(SecureAppSettingsRepository* appSettingsRepository);
-
-    ErrorCode fillAvailableServices(QJsonObject &servicesData);
-
-private:
-    ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody);
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-};
-
-#endif // SERVICESCATALOGCONTROLLER_H
-
@@ -1,122 +0,0 @@
-#ifndef SUBSCRIPTIONCONTROLLER_H
-#define SUBSCRIPTIONCONTROLLER_H
-
-#include <QJsonObject>
-#include <QByteArray>
-#include <QFuture>
-#include <QList>
-#include <QVariantMap>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "core/models/serverConfig.h"
-
-class ServersController;
-
-class SubscriptionController
-{
-public:
-    struct ProtocolData
-    {
-        QString certRequest;
-        QString certPrivKey;
-        QString wireGuardClientPrivKey;
-        QString wireGuardClientPubKey;
-        QString xrayUuid;
-    };
-
-    struct GatewayRequestData
-    {
-        QString osVersion;
-        QString appVersion;
-        QString appLanguage;
-        QString installationUuid;
-        QString userCountryCode;
-        QString serverCountryCode;
-        QString serviceType;
-        QString serviceProtocol;
-        QJsonObject authData;
-
-        QJsonObject toJsonObject() const;
-    };
-
-    explicit SubscriptionController(SecureServersRepository* serversRepository,
-                                     SecureAppSettingsRepository* appSettingsRepository);
-
-    ProtocolData generateProtocolData(const QString &protocol);
-    void appendProtocolDataToApiPayload(const QString &protocol, const ProtocolData &protocolData, QJsonObject &apiPayload);
-    ErrorCode fillServerConfig(const QJsonObject &serverConfigJson, ServerConfig &serverConfig);
-
-    ErrorCode importServiceFromGateway(const QString &userCountryCode, const QString &serviceType,
-                                      const QString &serviceProtocol, const ProtocolData &protocolData,
-                                      ServerConfig &serverConfig);
-    ErrorCode importTrialFromGateway(const QString &userCountryCode, const QString &serviceType,
-                                     const QString &serviceProtocol, const QString &email,
-                                     ServerConfig &serverConfig);
-
-    ErrorCode importServiceFromAppStore(const QString &userCountryCode, const QString &serviceType,
-                                        const QString &serviceProtocol, const ProtocolData &protocolData,
-                                        const QString &transactionId, bool isTestPurchase,
-                                        ServerConfig &serverConfig,
-                                        int *duplicateServerIndex = nullptr);
-
-    ErrorCode updateServiceFromGateway(int serverIndex, const QString &newCountryCode, bool isConnectEvent);
-
-    ErrorCode deactivateDevice(int serverIndex, bool isRemoveEvent);
-
-    ErrorCode deactivateExternalDevice(int serverIndex, const QString &uuid, const QString &serverCountryCode);
-
-    ErrorCode exportNativeConfig(int serverIndex, const QString &serverCountryCode, QString &nativeConfig);
-
-    ErrorCode revokeNativeConfig(int serverIndex, const QString &serverCountryCode);
-
-    ErrorCode updateServiceFromTelegram(int serverIndex);
-
-    ErrorCode prepareVpnKeyExport(int serverIndex, QString &vpnKey);
-
-    ErrorCode validateAndUpdateConfig(int serverIndex, bool hasInstalledContainers);
-
-    void removeApiConfig(int serverIndex);
-
-    void setCurrentProtocol(int serverIndex, const QString &protocolName);
-    bool isVlessProtocol(int serverIndex) const;
-
-    ErrorCode getAccountInfo(int serverIndex, QJsonObject &accountInfo);
-    QFuture<QPair<ErrorCode, QString>> getRenewalLink(int serverIndex);
-
-    struct AppStoreRestoreResult
-    {
-        bool hasInstalledConfig = false;
-        bool duplicateConfigAlreadyPresent = false;
-        int duplicateCount = 0;
-        int duplicateServerIndex = -1;
-        ErrorCode errorCode = ErrorCode::NoError;
-    };
-
-    ErrorCode processAppStorePurchase(const QString &userCountryCode, const QString &serviceType,
-                                     const QString &serviceProtocol, const QString &productId,
-                                     ServerConfig &serverConfig,
-                                     int *duplicateServerIndex = nullptr);
-
-    AppStoreRestoreResult processAppStoreRestore(const QString &userCountryCode, const QString &serviceType,
-                                                  const QString &serviceProtocol);
-
-private:
-    ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody, bool isTestPurchase = false);
-    bool isApiKeyExpired(int serverIndex) const;
-    
-    ErrorCode extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol, 
-                                                   const ProtocolData &protocolData, QJsonObject &serverConfigJson);
-    void updateApiConfigInJson(QJsonObject &serverConfigJson, const QString &serviceType, 
-                                const QString &serviceProtocol, const QString &userCountryCode,
-                                const QByteArray &apiResponseBody);
-
-    SecureServersRepository* m_serversRepository;
-    SecureAppSettingsRepository* m_appSettingsRepository;
-};
-
-#endif // SUBSCRIPTIONCONTROLLER_H
-
@@ -1,70 +0,0 @@
-#include "appSplitTunnelingController.h"
-
-AppSplitTunnelingController::AppSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-    m_currentRouteMode = m_appSettingsRepository->appsRouteMode();
-    if (m_currentRouteMode == AppsRouteMode::VpnAllApps) { // for old split tunneling configs
-        m_currentRouteMode = AppsRouteMode::VpnAllExceptApps;
-        m_apps = m_appSettingsRepository->vpnApps(m_currentRouteMode);
-        m_appSettingsRepository->setAppsRouteMode(AppsRouteMode::VpnAllExceptApps);
-    } else {
-        m_apps = m_appSettingsRepository->vpnApps(m_currentRouteMode);
-    }
-}
-
-bool AppSplitTunnelingController::addApp(const amnezia::InstalledAppInfo &appInfo)
-{
-    if (m_apps.contains(appInfo)) {
-        return false;
-    }
-
-    m_apps.append(appInfo);
-    m_appSettingsRepository->setVpnApps(m_currentRouteMode, m_apps);
-
-    return true;
-}
-
-void AppSplitTunnelingController::removeApp(int index)
-{
-    if (index < 0 || index >= m_apps.size()) {
-        return;
-    }
-
-    m_apps.removeAt(index);
-    m_appSettingsRepository->setVpnApps(m_currentRouteMode, m_apps);
-}
-
-void AppSplitTunnelingController::clearAppsList()
-{
-    m_apps.clear();
-    m_appSettingsRepository->setVpnApps(m_currentRouteMode, m_apps);
-}
-
-void AppSplitTunnelingController::setRouteMode(AppsRouteMode routeMode)
-{
-    m_currentRouteMode = routeMode;
-    m_apps = m_appSettingsRepository->vpnApps(m_currentRouteMode);
-    m_appSettingsRepository->setAppsRouteMode(routeMode);
-}
-
-void AppSplitTunnelingController::toggleSplitTunneling(bool enabled)
-{
-    m_appSettingsRepository->setAppsSplitTunnelingEnabled(enabled);
-}
-
-AppsRouteMode AppSplitTunnelingController::getRouteMode() const
-{
-    return m_currentRouteMode;
-}
-
-bool AppSplitTunnelingController::isSplitTunnelingEnabled() const
-{
-    return m_appSettingsRepository->isAppsSplitTunnelingEnabled();
-}
-
-QVector<amnezia::InstalledAppInfo> AppSplitTunnelingController::getApps() const
-{
-    return m_apps;
-}
-
@@ -1,32 +0,0 @@
-#ifndef APPSPLITTUNNELINGCONTROLLER_H
-#define APPSPLITTUNNELINGCONTROLLER_H
-
-#include <QVector>
-
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class AppSplitTunnelingController
-{
-public:
-    explicit AppSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository);
-
-    bool addApp(const amnezia::InstalledAppInfo &appInfo);
-    void removeApp(int index);
-    void clearAppsList();
-    void setRouteMode(AppsRouteMode routeMode);
-    void toggleSplitTunneling(bool enabled);
-
-    AppsRouteMode getRouteMode() const;
-    bool isSplitTunnelingEnabled() const;
-    QVector<amnezia::InstalledAppInfo> getApps() const;
-
-private:
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    AppsRouteMode m_currentRouteMode;
-    QVector<amnezia::InstalledAppInfo> m_apps;
-};
-
-#endif // APPSPLITTUNNELINGCONTROLLER_H
-
@@ -0,0 +1,172 @@
+#include "configController.h"
+
+#include "core/models/containers/containers_defs.h"
+#include "core/models/servers/apiV1ServerConfig.h"
+#include "core/models/servers/apiV2ServerConfig.h"
+#include "core/models/servers/selfHostedServerConfig.h"
+#include "core/networkUtilities.h"
+#include "protocols/protocols_defs.h"
+#include "settings.h"
+#include "core/models/protocols/awgProtocolConfig.h"
+#include "core/models/protocols/wireguardProtocolConfig.h"
+#include "core/models/protocols/openvpnProtocolConfig.h"
+#include "core/models/protocols/shadowsocksProtocolConfig.h"
+#include "core/models/protocols/cloakProtocolConfig.h"
+
+ConfigController::ConfigController(std::shared_ptr<Settings> settings, QObject *parent)
+    : QObject(parent), m_settings(settings)
+{
+}
+
+void ConfigController::addServer(const QSharedPointer<ServerConfig> &serverConfig)
+{
+    m_settings->addServer(serverConfig->toJson());
+    emit serverAdded(m_settings->serversCount() - 1);
+}
+
+void ConfigController::editServer(const QSharedPointer<ServerConfig> &serverConfig, int serverIndex)
+{
+    updateServerInSettings(serverConfig, serverIndex);
+    emit serverEdited(serverIndex);
+}
+
+void ConfigController::removeServer(int serverIndex)
+{
+    m_settings->removeServer(serverIndex);
+    emit serverRemoved(serverIndex);
+}
+
+void ConfigController::setDefaultServer(int serverIndex)
+{
+    m_settings->setDefaultServer(serverIndex);
+    emit defaultServerChanged(serverIndex);
+}
+
+void ConfigController::setDefaultContainer(int serverIndex, int containerIndex)
+{
+    auto servers = m_settings->serversArray();
+    if (serverIndex >= servers.size()) return;
+    
+    auto serverConfig = ServerConfig::createServerConfig(servers.at(serverIndex).toObject());
+    auto container = static_cast<DockerContainer>(containerIndex);
+    serverConfig->defaultContainer = ContainerProps::containerToString(container);
+    
+    updateServerInSettings(serverConfig, serverIndex);
+    emit defaultContainerChanged(serverIndex, container);
+}
+
+bool ConfigController::isServerFromApiAlreadyExists(quint16 crc) const
+{
+    auto servers = m_settings->serversArray();
+    for (const auto &server : servers) {
+        auto serverConfig = ServerConfig::createServerConfig(server.toObject());
+        if (static_cast<quint16>(serverConfig->crc) == crc) {
+            return true;
+        }
+    }
+    return false;
+}
+
+// Removed API-specific helpers; moved to ApiConfigsController
+
+QStringList ConfigController::getAllInstalledServicesName(int serverIndex) const
+{
+    auto servers = m_settings->serversArray();
+    if (serverIndex >= servers.size()) return {};
+    
+    auto serverConfig = ServerConfig::createServerConfig(servers.at(serverIndex).toObject());
+    
+    QStringList serviceNames;
+    for (auto it = serverConfig->containerConfigs.constBegin(); 
+         it != serverConfig->containerConfigs.constEnd(); ++it) {
+        const QString &containerName = it.key();
+        serviceNames.append(containerName);
+    }
+    return serviceNames;
+}
+
+void ConfigController::clearCachedProfile(int serverIndex, DockerContainer container)
+{
+    auto servers = m_settings->serversArray();
+    if (serverIndex >= servers.size()) return;
+    
+    auto serverConfig = ServerConfig::createServerConfig(servers.at(serverIndex).toObject());
+    
+    QString containerName = ContainerProps::containerToString(container);
+    if (serverConfig->containerConfigs.contains(containerName)) {
+        auto &containerConfig = serverConfig->containerConfigs[containerName];
+        containerConfig.clearProfile();
+        updateServerInSettings(serverConfig, serverIndex);
+    }
+}
+
+void ConfigController::updateServerInSettings(const QSharedPointer<ServerConfig> &serverConfig, int serverIndex)
+{
+    m_settings->editServer(serverIndex, serverConfig->toJson());
+} 
+
+bool ConfigController::isDefaultServerDefaultContainerHasSplitTunneling() const
+{
+    int defaultServerIndex = m_settings->defaultServerIndex();
+    auto servers = m_settings->serversArray();
+    if (defaultServerIndex >= servers.size()) return false;
+
+    auto serverConfig = ServerConfig::createServerConfig(servers.at(defaultServerIndex).toObject());
+    if (!serverConfig->containerConfigs.contains(serverConfig->defaultContainer)) {
+        return false;
+    }
+
+    const auto &containerConfig = serverConfig->containerConfigs[serverConfig->defaultContainer];
+    return checkSplitTunnelingInContainer(containerConfig, serverConfig->defaultContainer);
+}
+
+bool ConfigController::checkSplitTunnelingInContainer(const ContainerConfig &containerConfig, const QString &defaultContainer) const
+{
+    const DockerContainer containerType = ContainerProps::containerFromString(defaultContainer);
+
+    auto isWireguardHasSplit = [](const QString &nativeConfig, const QStringList &allowedIps) -> bool {
+        if (nativeConfig.contains("AllowedIPs") && !nativeConfig.contains("AllowedIPs = 0.0.0.0/0, ::/0")) {
+            return true;
+        }
+        if (!allowedIps.isEmpty() && !allowedIps.contains("0.0.0.0/0")) {
+            return true;
+        }
+        return false;
+    };
+
+    if (containerType == DockerContainer::Awg || containerType == DockerContainer::WireGuard) {
+        const auto protocolConfig = containerConfig.protocolConfigs.value(defaultContainer);
+        if (!protocolConfig) return false;
+        auto variant = ProtocolConfig::getProtocolConfigVariant(protocolConfig);
+        return std::visit(
+            [&](const auto &ptr) -> bool {
+                using T = std::decay_t<decltype(ptr)>;
+                if constexpr (std::is_same_v<T, QSharedPointer<AwgProtocolConfig>> || std::is_same_v<T, QSharedPointer<WireGuardProtocolConfig>>) {
+                    return isWireguardHasSplit(ptr->clientProtocolConfig.nativeConfig,
+                                               ptr->clientProtocolConfig.wireGuardData.allowedIps);
+                }
+                return false;
+            },
+            variant);
+    }
+
+    if (containerType == DockerContainer::Cloak || containerType == DockerContainer::OpenVpn || containerType == DockerContainer::ShadowSocks) {
+        const auto &protocolConfig = containerConfig.protocolConfigs.value(ContainerProps::containerTypeToString(DockerContainer::OpenVpn));
+        if (!protocolConfig) return false;
+        auto variant = ProtocolConfig::getProtocolConfigVariant(protocolConfig);
+        return std::visit(
+            [&](const auto &ptr) -> bool {
+                using T = std::decay_t<decltype(ptr)>;
+                if constexpr (std::is_same_v<T, QSharedPointer<OpenVpnProtocolConfig>> ||
+                              std::is_same_v<T, QSharedPointer<ShadowsocksProtocolConfig>> ||
+                              std::is_same_v<T, QSharedPointer<CloakProtocolConfig>>) {
+                    const auto nativeConfig = ptr->clientProtocolConfig.nativeConfig;
+                    return (!nativeConfig.isEmpty() && !nativeConfig.contains("redirect-gateway"));
+                }
+                return false;
+            },
+            variant);
+    }
+
+    return false;
+}
@@ -0,0 +1,59 @@
+#ifndef CONFIGCONTROLLER_H
+#define CONFIGCONTROLLER_H
+
+#include <QObject>
+#include <QSharedPointer>
+
+#include "core/defs.h"
+#include "core/models/servers/serverConfig.h"
+#include "core/models/containers/containers_defs.h"
+
+class Settings;
+
+using namespace amnezia;
+
+class ConfigController : public QObject
+{
+    Q_OBJECT
+
+public:
+    explicit ConfigController(std::shared_ptr<Settings> settings, QObject *parent = nullptr);
+    virtual ~ConfigController() = default;
+
+    // Basic server management
+    virtual void addServer(const QSharedPointer<ServerConfig> &serverConfig);
+    virtual void editServer(const QSharedPointer<ServerConfig> &serverConfig, int serverIndex);
+    virtual void removeServer(int serverIndex);
+    
+    // Default settings management
+    void setDefaultServer(int serverIndex);
+    void setDefaultContainer(int serverIndex, int containerIndex);
+    
+    // API server utilities
+    bool isServerFromApiAlreadyExists(quint16 crc) const;
+    
+    // General utilities
+    QStringList getAllInstalledServicesName(int serverIndex) const;
+    void clearCachedProfile(int serverIndex, DockerContainer container);
+
+    // Split tunneling detection
+    bool isDefaultServerDefaultContainerHasSplitTunneling() const;
+
+protected:
+    std::shared_ptr<Settings> m_settings;
+    
+    // Protected helper methods for derived classes
+    void updateServerInSettings(const QSharedPointer<ServerConfig> &serverConfig, int serverIndex);
+
+    bool checkSplitTunnelingInContainer(const ContainerConfig &containerConfig, const QString &defaultContainer) const;
+
+signals:
+    // Common server management signals
+    void serverAdded(int serverIndex);
+    void serverEdited(int serverIndex);
+    void serverRemoved(int serverIndex);
+    void defaultServerChanged(int serverIndex);
+    void defaultContainerChanged(int serverIndex, DockerContainer container);
+};
+
+#endif // CONFIGCONTROLLER_H 
@@ -1,183 +1,93 @@
 #include "connectionController.h"

-#include <QJsonDocument>
+#include <QtConcurrent>

-#include "core/configurators/configuratorBase.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/utils/utilities.h"
-#include "core/utils/networkUtilities.h"
-#include "version.h"
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/models/serverConfig.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocolConfig.h"
+#include "core/controllers/vpnConfigurationController.h"
+#include "core/controllers/selfhosted/serverController.h"
+#include "core/models/containers/containers_defs.h"
+#include "core/models/containers/containerConfig.h"
+#include "settings.h"
+#include "logger.h"
+#include "utilities.h"

-using namespace amnezia;
-using namespace ProtocolUtils;
-
-ConnectionController::ConnectionController(SecureServersRepository* serversRepository,
-                                         SecureAppSettingsRepository* appSettingsRepository,
-                                         VpnConnection* vpnConnection,
-                                         QObject* parent)
-    : QObject(parent),
-      m_serversRepository(serversRepository),
-      m_appSettingsRepository(appSettingsRepository),
-      m_vpnConnection(vpnConnection)
+namespace
 {
-    connect(m_vpnConnection, &VpnConnection::connectionStateChanged, this, &ConnectionController::connectionStateChanged);
-    connect(this, &ConnectionController::openConnectionRequested, m_vpnConnection, &VpnConnection::connectToVpn, Qt::QueuedConnection);
-    connect(this, &ConnectionController::closeConnectionRequested, m_vpnConnection, &VpnConnection::disconnectFromVpn, Qt::QueuedConnection);
-    connect(this, &ConnectionController::setConnectionStateRequested, m_vpnConnection, &VpnConnection::setConnectionState, Qt::QueuedConnection);
-    connect(this, &ConnectionController::killSwitchModeChangedRequested, m_vpnConnection, &VpnConnection::onKillSwitchModeChanged, Qt::QueuedConnection);
-#ifdef Q_OS_ANDROID
-    connect(this, &ConnectionController::restoreConnectionRequested, m_vpnConnection, &VpnConnection::restoreConnection, Qt::QueuedConnection);
-#endif
+    Logger logger("ConnectionController");
 }

-bool ConnectionController::isConnected() const
+ConnectionController::ConnectionController(const QSharedPointer<VpnConnection> &vpnConnection,
+                                           std::shared_ptr<Settings> settings,
+                                           QObject *parent)
+    : QObject(parent), m_vpnConnection(vpnConnection), m_settings(settings)
 {
-    return m_vpnConnection && m_vpnConnection->connectionState() == Vpn::ConnectionState::Connected;
 }

-void ConnectionController::setConnectionState(Vpn::ConnectionState state)
+QFuture<QJsonObject> ConnectionController::prepareVpnConfiguration(const QSharedPointer<ServerConfig> &serverConfig,
+                                                                  DockerContainer container,
+                                                                  const QPair<QString, QString> &dns) const
 {
-    if (m_vpnConnection) {
-        emit setConnectionStateRequested(state);
-    }
-}
+    return QtConcurrent::run([this, serverConfig, container, dns]() -> QJsonObject {
+        logger.info() << "Preparing VPN configuration for container" << ContainerProps::containerToString(container);
+        
+        QSharedPointer<ServerController> serverController(new ServerController(m_settings));
+        VpnConfigurationsController vpnConfigurationController(m_settings, serverController);

-ErrorCode ConnectionController::prepareConnection(int serverIndex,
-                                                 QJsonObject& vpnConfiguration,
-                                                 DockerContainer& container)
-{
-    if (!isServiceReady()) {
-        return ErrorCode::AmneziaServiceNotRunning;
-    }
+        QString containerName = ContainerProps::containerToString(container);
+        const ContainerConfig &containerConfig = serverConfig->containerConfigs.value(containerName);

-    ServerConfig serverConfigModel = m_serversRepository->server(serverIndex);
-    container = serverConfigModel.defaultContainer();
-
-    if (!isContainerSupported(container)) {
-        return ErrorCode::NotSupportedOnThisPlatform;
-    }
-
-    ContainerConfig containerConfigModel = m_serversRepository->containerConfig(serverIndex, container);
-
-    auto dns = serverConfigModel.getDnsPair(m_appSettingsRepository->useAmneziaDns(),
-                                            m_appSettingsRepository->primaryDns(),
-                                            m_appSettingsRepository->secondaryDns());
-
-    vpnConfiguration = createConnectionConfiguration(dns, serverConfigModel, containerConfigModel, container);
-
-    return ErrorCode::NoError;
-}
-
-ErrorCode ConnectionController::openConnection(int serverIndex)
-{
-    QJsonObject vpnConfiguration;
-    DockerContainer container;
-
-    ErrorCode errorCode = prepareConnection(serverIndex, vpnConfiguration, container);
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-
-    emit openConnectionRequested(serverIndex, container, vpnConfiguration);
-    return ErrorCode::NoError;
-}
-
-void ConnectionController::closeConnection()
-{
-    if (m_vpnConnection) {
-        emit closeConnectionRequested();
-    }
-}
-
-#ifdef Q_OS_ANDROID
-void ConnectionController::restoreConnection()
-{
-    if (m_vpnConnection) {
-        emit restoreConnectionRequested();
-    }
-}
-#endif
-
-void ConnectionController::onKillSwitchModeChanged(bool enabled)
-{
-    if (m_vpnConnection) {
-        emit killSwitchModeChangedRequested(enabled);
-    }
-}
-
-ErrorCode ConnectionController::lastConnectionError() const
-{
-    return m_vpnConnection->lastError();
-}
-
-QJsonObject ConnectionController::createConnectionConfiguration(const QPair<QString, QString> &dns,
-                                                              const ServerConfig &serverConfig,
-                                                              const ContainerConfig &containerConfig,
-                                                              DockerContainer container)
-{
-    QJsonObject vpnConfiguration {};
-
-    if (ContainerUtils::containerService(container) == ServiceType::Other) {
+        auto vpnConfiguration = vpnConfigurationController.createVpnConfiguration(dns,
+                                                                                 serverConfig,
+                                                                                 containerConfig,
+                                                                                 container);
+        
+        emit configurationPrepared(vpnConfiguration);
        return vpnConfiguration;
-    }
-
-    Proto proto = ContainerUtils::defaultProtocol(container);
-
-    ConnectionSettings connectionSettings = {
-        { dns.first, dns.second },
-        serverConfig.isApiConfig(),
-        {
-            m_appSettingsRepository->isSitesSplitTunnelingEnabled(),
-            m_appSettingsRepository->routeMode()
-        }
-    };
-
-    auto configurator = ConfiguratorBase::create(proto, nullptr);
-    ProtocolConfig processedConfig = configurator->processConfigWithLocalSettings(connectionSettings,
-                                                                                  containerConfig.protocolConfig);
-
-    QJsonObject vpnConfigData = processedConfig.getClientConfigJson();
-    if (ContainerUtils::isAwgContainer(container) || container == DockerContainer::WireGuard) {
-        if (vpnConfigData[configKey::mtu].toString().isEmpty()) {
-            vpnConfigData[configKey::mtu] =
-                    ContainerUtils::isAwgContainer(container) ? protocols::awg::defaultMtu :
-                    protocols::wireguard::defaultMtu;
-        }
-    }
-
-    vpnConfiguration.insert(ProtocolUtils::key_proto_config_data(proto), vpnConfigData);
-    vpnConfiguration[configKey::vpnProto] = ProtocolUtils::protoToString(proto);
-
-    vpnConfiguration[configKey::dns1] = dns.first;
-    vpnConfiguration[configKey::dns2] = dns.second;
-
-    vpnConfiguration[configKey::hostName] = serverConfig.hostName();
-    vpnConfiguration[configKey::description] = serverConfig.description();
-
-    vpnConfiguration[configKey::configVersion] = serverConfig.configVersion();
-
-    return vpnConfiguration;
+    });
 }

-bool ConnectionController::isServiceReady() const
+QFuture<ErrorCode> ConnectionController::openConnection(const int serverIndex,
+                                                        const QSharedPointer<ServerConfig> &serverConfig,
+                                                        const DockerContainer container,
+                                                        const ServerCredentials &credentials,
+                                                        const QPair<QString, QString> &dns)
 {
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
-    return Utils::processIsRunning(Utils::executable(SERVICE_NAME, false), true);
-#else
-    return true;
-#endif
+    return QtConcurrent::run([this, serverIndex, serverConfig, container, credentials, dns]() -> ErrorCode {
+        if (!isServerSupported(container)) {
+            emit connectionError(ErrorCode::NotSupportedOnThisPlatform);
+            return ErrorCode::NotSupportedOnThisPlatform;
+        }
+
+        QSharedPointer<ServerController> serverController(new ServerController(m_settings));
+        VpnConfigurationsController vpnConfigurationController(m_settings, serverController);
+
+        const QString containerName = ContainerProps::containerToString(container);
+        const ContainerConfig &containerConfig = serverConfig->containerConfigs.value(containerName);
+        auto vpnConfiguration = vpnConfigurationController.createVpnConfiguration(dns, serverConfig, containerConfig, container);
+        emit connectionProgress(QString("Connecting to %1...").arg(ContainerProps::containerToString(container)));
+
+        QMetaObject::invokeMethod(m_vpnConnection.get(), "connectToVpn", Qt::QueuedConnection,
+                                  Q_ARG(int, serverIndex),
+                                  Q_ARG(ServerCredentials, credentials),
+                                  Q_ARG(DockerContainer, container),
+                                  Q_ARG(QJsonObject, vpnConfiguration));
+        return ErrorCode::NoError;
+    });
 }

-bool ConnectionController::isContainerSupported(DockerContainer container) const
+QFuture<ErrorCode> ConnectionController::closeConnection()
 {
-    return ContainerUtils::isSupportedByCurrentPlatform(container);
+    return QtConcurrent::run([this]() -> ErrorCode {
+        QMetaObject::invokeMethod(m_vpnConnection.get(), "disconnectFromVpn", Qt::QueuedConnection);
+        return ErrorCode::NoError;
+    });
+}
+
+bool ConnectionController::isServerSupported(DockerContainer container) const
+{
+    return ContainerProps::isSupportedByCurrentPlatform(container);
+}
+
+ErrorCode ConnectionController::getLastConnectionError() const
+{
+    return m_vpnConnection ? m_vpnConnection->lastError() : ErrorCode::NoError;
 }
@@ -2,20 +2,18 @@
 #define CONNECTIONCONTROLLER_H

 #include <QObject>
-#include <QJsonObject>
-#include <QPair>
-#include <memory>
+#include <QFuture>
+#include <QSharedPointer>

-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "core/protocols/vpnProtocol.h"
-#include "vpnConnection.h"
+#include "core/defs.h"
+#include "core/models/containers/containers_defs.h"
+#include "core/models/servers/serverConfig.h"
+#include "protocols/vpnprotocol.h"
+#include "vpnconnection.h"
+
+class Settings;
+class ServerController;
+class VpnConfigurationsController;

 using namespace amnezia;

@@ -24,55 +22,36 @@ class ConnectionController : public QObject
    Q_OBJECT

 public:
-    explicit ConnectionController(SecureServersRepository* serversRepository,
-                                 SecureAppSettingsRepository* appSettingsRepository,
-                                 VpnConnection* vpnConnection,
-                                 QObject* parent = nullptr);
-    ~ConnectionController() = default;
+    explicit ConnectionController(const QSharedPointer<VpnConnection> &vpnConnection,
+                                  std::shared_ptr<Settings> settings,
+                                  QObject *parent = nullptr);

-    ErrorCode prepareConnection(int serverIndex,
-                               QJsonObject& vpnConfiguration,
-                               DockerContainer& container);
+    QFuture<QJsonObject> prepareVpnConfiguration(const QSharedPointer<ServerConfig> &serverConfig,
+                                                DockerContainer container,
+                                                const QPair<QString, QString> &dns) const;

-    ErrorCode openConnection(int serverIndex);
+    QFuture<ErrorCode> openConnection(const int serverIndex,
+                                      const QSharedPointer<ServerConfig> &serverConfig,
+                                      const DockerContainer container,
+                                      const ServerCredentials &credentials,
+                                      const QPair<QString, QString> &dns);

-    void closeConnection();
+    QFuture<ErrorCode> closeConnection();

-#ifdef Q_OS_ANDROID
-    void restoreConnection();
-#endif
-
-    void onKillSwitchModeChanged(bool enabled);
-
-    ErrorCode lastConnectionError() const;
-
-    bool isConnected() const;
-    void setConnectionState(Vpn::ConnectionState state);
-
-    QJsonObject createConnectionConfiguration(const QPair<QString, QString> &dns,
-                                             const ServerConfig &serverConfig,
-                                             const ContainerConfig &containerConfig,
-                                             DockerContainer container);
-
-    bool isServiceReady() const;
-
-    bool isContainerSupported(DockerContainer container) const;
+    ErrorCode getLastConnectionError() const;

 signals:
-    void connectionStateChanged(Vpn::ConnectionState state);
-    void openConnectionRequested(int serverIndex, DockerContainer container, const QJsonObject &vpnConfiguration);
-    void closeConnectionRequested();
-    void setConnectionStateRequested(Vpn::ConnectionState state);
-    void killSwitchModeChangedRequested(bool enabled);
-
-#ifdef Q_OS_ANDROID
-    void restoreConnectionRequested();
-#endif
+    void configurationPrepared(const QJsonObject &vpnConfiguration);
+    void connectionEstablished();
+    void connectionTerminated();
+    void connectionError(ErrorCode errorCode);
+    void connectionProgress(const QString &message);

 private:
-    SecureServersRepository* m_serversRepository;
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    VpnConnection* m_vpnConnection;
+    bool isServerSupported(DockerContainer container) const;
+
+    QSharedPointer<VpnConnection> m_vpnConnection;
+    std::shared_ptr<Settings> m_settings;
 };

-#endif
+#endif // CONNECTIONCONTROLLER_H 
@@ -2,18 +2,11 @@

 #include <QDirIterator>
 #include <QTranslator>
-#include <QTimer>

-#include "core/utils/selfhosted/sshSession.h"
-#include "core/controllers/selfhosted/installController.h"
-#include "core/controllers/selfhosted/importController.h"
-#include "core/controllers/coreSignalHandlers.h"
-#include "core/models/serverConfig.h"
-#include "logger.h"
-#include "secureQSettings.h"
+#include "core/models/clientInfo.h"

 #if defined(Q_OS_ANDROID)
-    #include "core/utils/installedAppsImageProvider.h"
+    #include "core/installedAppsImageProvider.h"
    #include "platforms/android/android_controller.h"
 #endif

@@ -22,196 +15,214 @@
    #include <AmneziaVPN-Swift.h>
 #endif

-CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
+CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, const std::shared_ptr<Settings> &settings,
                               QQmlApplicationEngine *engine, QObject *parent)
    : QObject(parent), m_vpnConnection(vpnConnection), m_settings(settings), m_engine(engine)
 {
-    initRepositories();
    initCoreControllers();
    initModels();
-    initControllers();
+    initUIControllers();
    initSignalHandlers();

    initAndroidController();
    initAppleController();
-    initLogging();

-    m_translator = new QTranslator(this);
-    if (m_appSettingsRepository) {
-        updateTranslator(m_appSettingsRepository->getAppLanguage());
-    }
-}
+    initNotificationHandler();

-void CoreController::setQmlContextProperty(const QString &name, QObject *value)
-{
-    if (m_engine) {
-        m_engine->rootContext()->setContextProperty(name, value);
-    }
+    auto locale = m_settings->getAppLanguage();
+    m_translator.reset(new QTranslator());
+    updateTranslator(locale);
 }

 void CoreController::initModels()
 {
-    m_containersModel = new ContainersModel(this);
-    setQmlContextProperty("ContainersModel", m_containersModel);
+    m_containersModel.reset(new ContainersModel(this));
+    m_engine->rootContext()->setContextProperty("ContainersModel", m_containersModel.get());

-    m_defaultServerContainersModel = new ContainersModel(this);
-    setQmlContextProperty("DefaultServerContainersModel", m_defaultServerContainersModel);
+    m_defaultServerContainersModel.reset(new ContainersModel(this));
+    m_engine->rootContext()->setContextProperty("DefaultServerContainersModel", m_defaultServerContainersModel.get());

-    m_serversModel = new ServersModel(this);
-    setQmlContextProperty("ServersModel", m_serversModel);
+    m_serversModel.reset(new ServersModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("ServersModel", m_serversModel.get());

-    m_languageModel = new LanguageModel(this);
-    setQmlContextProperty("LanguageModel", m_languageModel);
+    m_openVpnConfigModel = QSharedPointer<OpenVpnConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("OpenVpnConfigModel", m_openVpnConfigModel.get());

-    m_ipSplitTunnelingModel = new IpSplitTunnelingModel(this);
-    setQmlContextProperty("IpSplitTunnelingModel", m_ipSplitTunnelingModel);
+    m_shadowSocksConfigModel = QSharedPointer<ShadowSocksConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("ShadowSocksConfigModel", m_shadowSocksConfigModel.get());

-    m_allowedDnsModel = new AllowedDnsModel(this);
-    setQmlContextProperty("AllowedDnsModel", m_allowedDnsModel);
+    m_cloakConfigModel = QSharedPointer<CloakConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("CloakConfigModel", m_cloakConfigModel.get());

-    m_appSplitTunnelingModel = new AppSplitTunnelingModel(this);
-    setQmlContextProperty("AppSplitTunnelingModel", m_appSplitTunnelingModel);
+    m_wireGuardConfigModel = QSharedPointer<WireGuardConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("WireGuardConfigModel", m_wireGuardConfigModel.get());

-    m_protocolsModel = new ProtocolsModel(this);
-    setQmlContextProperty("ProtocolsModel", m_protocolsModel);
+    m_awgConfigModel = QSharedPointer<AwgConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("AwgConfigModel", m_awgConfigModel.get());

-    m_openVpnConfigModel = new OpenVpnConfigModel(this);
-    setQmlContextProperty("OpenVpnConfigModel", m_openVpnConfigModel);
-
-    m_wireGuardConfigModel = new WireGuardConfigModel(this);
-    setQmlContextProperty("WireGuardConfigModel", m_wireGuardConfigModel);
-
-    m_awgConfigModel = new AwgConfigModel(this);
-    setQmlContextProperty("AwgConfigModel", m_awgConfigModel);
-
-    m_xrayConfigModel = new XrayConfigModel(this);
-    setQmlContextProperty("XrayConfigModel", m_xrayConfigModel);
-
-    m_torConfigModel = new TorConfigModel(this);
-    setQmlContextProperty("TorConfigModel", m_torConfigModel);
+    m_xrayConfigModel = QSharedPointer<XrayConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("XrayConfigModel", m_xrayConfigModel.get());

 #ifdef Q_OS_WINDOWS
-    m_ikev2ConfigModel = new Ikev2ConfigModel(this);
-    setQmlContextProperty("Ikev2ConfigModel", m_ikev2ConfigModel);
+    m_ikev2ConfigModel = QSharedPointer<Ikev2ConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("Ikev2ConfigModel", m_ikev2ConfigModel.get());
 #endif

-    m_sftpConfigModel = new SftpConfigModel(this);
-    setQmlContextProperty("SftpConfigModel", m_sftpConfigModel);
+    m_sftpConfigModel = QSharedPointer<SftpConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("SftpConfigModel", m_sftpConfigModel.get());

-    m_socks5ConfigModel = new Socks5ProxyConfigModel(this);
-    setQmlContextProperty("Socks5ProxyConfigModel", m_socks5ConfigModel);
+    m_socks5ConfigModel = QSharedPointer<Socks5ProxyConfigModel>::create(this);
+    m_engine->rootContext()->setContextProperty("Socks5ProxyConfigModel", m_socks5ConfigModel.get());

-    m_clientManagementModel = new ClientManagementModel(this);
-    setQmlContextProperty("ClientManagementModel", m_clientManagementModel);
+    m_protocolsModel.reset(new ProtocolsModel(m_openVpnConfigModel, m_shadowSocksConfigModel, m_cloakConfigModel, m_wireGuardConfigModel,
+                                              m_awgConfigModel, m_xrayConfigModel,
+#ifdef Q_OS_WINDOWS
+                                              m_ikev2ConfigModel,
+#endif
+                                              m_sftpConfigModel, m_socks5ConfigModel, this));
+    m_engine->rootContext()->setContextProperty("ProtocolsModel", m_protocolsModel.get());

-    m_apiServicesModel = new ApiServicesModel(this);
-    setQmlContextProperty("ApiServicesModel", m_apiServicesModel);
+    auto clientManagementController = QSharedPointer<ClientManagementController>::create(m_settings, this);
+    m_clientManagementModel.reset(new ClientManagementModel(clientManagementController, this));

-    m_apiCountryModel = new ApiCountryModel(this);
-    setQmlContextProperty("ApiCountryModel", m_apiCountryModel);
+    m_clientManagementUIController.reset(new ClientManagementUIController(clientManagementController, this));
+    m_engine->rootContext()->setContextProperty("ClientManagementUIController", m_clientManagementUIController.get());
+    m_engine->rootContext()->setContextProperty("ClientManagementModel", m_clientManagementModel.get());

-    m_apiSubscriptionPlansModel = new ApiSubscriptionPlansModel(this);
-    setQmlContextProperty("ApiSubscriptionPlansModel", m_apiSubscriptionPlansModel);
+    m_apiServicesModel.reset(new ApiServicesModel(this));
+    m_engine->rootContext()->setContextProperty("ApiServicesModel", m_apiServicesModel.get());

-    m_apiBenefitsModel = new ApiBenefitsModel(this);
-    setQmlContextProperty("ApiBenefitsModel", m_apiBenefitsModel);
+    m_apiCountryModel.reset(new ApiCountryModel(this));
+    m_engine->rootContext()->setContextProperty("ApiCountryModel", m_apiCountryModel.get());

-    m_apiAccountInfoModel = new ApiAccountInfoModel(this);
-    setQmlContextProperty("ApiAccountInfoModel", m_apiAccountInfoModel);
+    m_apiAccountInfoModel.reset(new ApiAccountInfoModel(this));
+    m_engine->rootContext()->setContextProperty("ApiAccountInfoModel", m_apiAccountInfoModel.get());

-    m_apiDevicesModel = new ApiDevicesModel(this);
-    setQmlContextProperty("ApiDevicesModel", m_apiDevicesModel);
+    m_apiDevicesModel.reset(new ApiDevicesModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("ApiDevicesModel", m_apiDevicesModel.get());

-    m_newsModel = new NewsModel(m_appSettingsRepository, this);
-    setQmlContextProperty("NewsModel", m_newsModel);
-}
+    m_sitesModel.reset(new SitesModel(m_splitTunnelingController, this));
+    m_engine->rootContext()->setContextProperty("SitesModel", m_sitesModel.get());

-void CoreController::initRepositories()
-{
-    m_serversRepository = new SecureServersRepository(m_settings, this);
-    m_appSettingsRepository = new SecureAppSettingsRepository(m_settings, this);
+    m_allowedDnsModel.reset(new AllowedDnsModel(m_dnsController, this));
+    m_engine->rootContext()->setContextProperty("AllowedDnsModel", m_allowedDnsModel.get());

-    if (m_vpnConnection) {
-        m_vpnConnection->setRepositories(m_serversRepository, m_appSettingsRepository);
-    }
+    m_appSplitTunnelingModel.reset(new AppSplitTunnelingModel(m_splitTunnelingController, this));
+    m_engine->rootContext()->setContextProperty("AppSplitTunnelingModel", m_appSplitTunnelingModel.get());
+
+    m_languageModel.reset(new LanguageModel(m_settingsController, this));
+    m_engine->rootContext()->setContextProperty("LanguageModel", m_languageModel.get());
 }

 void CoreController::initCoreControllers()
 {
-    m_serversController = new ServersController(m_serversRepository, m_appSettingsRepository, this);
-    m_appSplitTunnelingController = new AppSplitTunnelingController(m_appSettingsRepository);
-    m_usersController = new UsersController(m_serversRepository, this);
-    m_ipSplitTunnelingController = new IpSplitTunnelingController(m_appSettingsRepository, this);
-    m_allowedDnsController = new AllowedDnsController(m_appSettingsRepository);
-    m_servicesCatalogController = new ServicesCatalogController(m_appSettingsRepository);
-    m_subscriptionController = new SubscriptionController(m_serversRepository, m_appSettingsRepository);
-    m_newsController = new NewsController(m_appSettingsRepository, m_serversController);
-    
-    m_installController = new InstallController(m_serversRepository, m_appSettingsRepository, this);
-    m_exportController = new ExportController(m_serversRepository, m_appSettingsRepository, this);
-    m_importCoreController = new ImportController(m_serversRepository, m_appSettingsRepository, this);
-    m_connectionController = new ConnectionController(m_serversRepository, m_appSettingsRepository, m_vpnConnection.get(), this);
-    m_settingsController = new SettingsController(m_serversRepository, m_appSettingsRepository, this);
+    m_settingsController = QSharedPointer<SettingsController>::create(m_settings, this);
+    m_dnsController = QSharedPointer<DnsController>::create(m_settings, this);
+    m_splitTunnelingController = QSharedPointer<SplitTunnelingController>::create(m_settings, m_vpnConnection, this);
+    m_exportController = QSharedPointer<ExportController>::create(m_settings, this);
+    m_installController = QSharedPointer<InstallController>::create(m_settings, this);
 }

-void CoreController::initControllers()
+void CoreController::initUIControllers()
 {
-    m_connectionUiController = new ConnectionUiController(m_connectionController, m_serversController, this);
-    setQmlContextProperty("ConnectionController", m_connectionUiController);
+    auto coreConnectionController = QSharedPointer<ConnectionController>::create(m_vpnConnection, m_settings, this);
+    m_connectionController.reset(
+            new ConnectionUIController(m_serversModel, m_containersModel, m_clientManagementModel, coreConnectionController));
+    m_engine->rootContext()->setContextProperty("ConnectionController", m_connectionController.get());

-    if (m_engine) {
-        m_focusController = new FocusController(m_engine, this);
-        setQmlContextProperty("FocusController", m_focusController);
-    }
+    m_pageController.reset(new PageController(m_serversModel, m_settingsController));
+    m_engine->rootContext()->setContextProperty("PageController", m_pageController.get());

-    m_installUiController = new InstallUiController(m_installController, m_serversController, m_settingsController, m_protocolsModel, m_usersController, 
-                                                     m_awgConfigModel, m_wireGuardConfigModel, m_openVpnConfigModel, m_xrayConfigModel, m_torConfigModel,
-#ifdef Q_OS_WINDOWS
-                                                     m_ikev2ConfigModel,
-#endif
-                                                     m_sftpConfigModel, m_socks5ConfigModel, this);
-    setQmlContextProperty("InstallController", m_installUiController);
+    m_focusController.reset(new FocusController(m_engine, this));
+    m_engine->rootContext()->setContextProperty("FocusController", m_focusController.get());

-    m_importController = new ImportUiController(m_importCoreController, this);
-    setQmlContextProperty("ImportController", m_importController);
+    auto clientManagementController = m_clientManagementUIController->getClientManagementController();
+    m_exportUIController.reset(new ExportUIController(m_serversModel, m_containersModel, m_clientManagementModel, m_exportController, clientManagementController));
+    m_engine->rootContext()->setContextProperty("ExportController", m_exportUIController.get());

-    m_exportUiController = new ExportUiController(m_exportController, this);
-    setQmlContextProperty("ExportController", m_exportUiController);
+    m_installUIController.reset(new InstallUIController(m_serversModel, m_containersModel, m_protocolsModel, m_clientManagementModel, m_installController, m_apiConfigsCoreController, clientManagementController));
+    m_engine->rootContext()->setContextProperty("InstallController", m_installUIController.get());

-    m_languageUiController = new LanguageUiController(m_settingsController, m_languageModel, this);
-    setQmlContextProperty("LanguageUiController", m_languageUiController);
+    connect(m_installUIController.get(), &InstallUIController::currentContainerUpdated, m_connectionController.get(),
+            &ConnectionUIController::onCurrentContainerUpdated);

-    m_settingsUiController = new SettingsUiController(m_settingsController, m_serversController, m_languageUiController, this);
-    setQmlContextProperty("SettingsController", m_settingsUiController);
+    m_importController.reset(new ImportController(m_serversModel, m_containersModel, m_settingsController));
+    m_engine->rootContext()->setContextProperty("ImportController", m_importController.get());

-    m_pageController = new PageController(m_serversController, m_settingsController, this);
-    setQmlContextProperty("PageController", m_pageController);
+    m_settingsUIController.reset(
+            new SettingsUIController(m_serversModel, m_containersModel, m_languageModel, m_sitesModel, m_appSplitTunnelingModel, m_settingsController));
+    m_engine->rootContext()->setContextProperty("SettingsController", m_settingsUIController.get());

-    m_serversUiController = new ServersUiController(m_serversController, m_settingsController, m_serversModel, m_containersModel, m_defaultServerContainersModel, this);
-    setQmlContextProperty("ServersUiController", m_serversUiController);
+    m_siteSplitUIController.reset(new SiteSplitUIController(m_splitTunnelingController, m_sitesModel));
+    m_engine->rootContext()->setContextProperty("SitesController", m_siteSplitUIController.get());

-    m_ipSplitTunnelingUiController = new IpSplitTunnelingUiController(m_ipSplitTunnelingController, m_ipSplitTunnelingModel, this);
-    setQmlContextProperty("IpSplitTunnelingController", m_ipSplitTunnelingUiController);
+    m_allowedDnsUIController.reset(new AllowedDnsUIController(m_dnsController, m_allowedDnsModel));
+    m_engine->rootContext()->setContextProperty("AllowedDnsController", m_allowedDnsUIController.get());

-    m_allowedDnsUiController = new AllowedDnsUiController(m_allowedDnsController, m_allowedDnsModel, this);
-    setQmlContextProperty("AllowedDnsController", m_allowedDnsUiController);
+    m_appSplitUIController.reset(new AppSplitUIController(m_splitTunnelingController, m_appSplitTunnelingModel));
+    m_engine->rootContext()->setContextProperty("AppSplitTunnelingController", m_appSplitUIController.get());

-    m_appSplitTunnelingUiController = new AppSplitTunnelingUiController(m_appSplitTunnelingController, m_appSplitTunnelingModel, this);
-    setQmlContextProperty("AppSplitTunnelingController", m_appSplitTunnelingUiController);
+    m_systemController.reset(new SystemController());
+    m_engine->rootContext()->setContextProperty("SystemController", m_systemController.get());

-    m_systemController = new SystemController(this);
-    setQmlContextProperty("SystemController", m_systemController);
+    m_apiSettingsCoreController = QSharedPointer<ApiSettingsController>::create(m_serversModel, m_apiAccountInfoModel, m_apiCountryModel, m_apiDevicesModel, m_settings);
+    m_apiConfigsCoreController = QSharedPointer<ApiConfigsController>::create(m_serversModel, m_apiServicesModel, m_settings);
+    m_apiPremV1MigrationCoreController = QSharedPointer<ApiPremV1MigrationController>::create(m_serversModel, m_settings, this);

-    m_servicesCatalogUiController = new ServicesCatalogUiController(m_servicesCatalogController, m_apiServicesModel, this);
-    setQmlContextProperty("ServicesCatalogUiController", m_servicesCatalogUiController);
+    m_apiSettingsUIController.reset(new ApiSettingsUIController(m_serversModel, m_apiAccountInfoModel, m_apiCountryModel, m_apiDevicesModel, m_apiSettingsCoreController));
+    m_engine->rootContext()->setContextProperty("ApiSettingsController", m_apiSettingsUIController.get());

-    m_subscriptionUiController = new SubscriptionUiController(m_serversController, m_apiServicesModel, m_servicesCatalogController, m_subscriptionController,
-                                                              m_apiSubscriptionPlansModel, m_apiBenefitsModel, m_apiAccountInfoModel,
-                                                              m_apiCountryModel, m_apiDevicesModel, m_settingsController, this);
-    setQmlContextProperty("SubscriptionUiController", m_subscriptionUiController);
+    m_apiConfigUIController.reset(new ApiConfigUIController(m_serversModel, m_apiServicesModel, m_apiConfigsCoreController));
+    m_engine->rootContext()->setContextProperty("ApiConfigsController", m_apiConfigUIController.get());

-    m_apiNewsUiController = new ApiNewsUiController(m_newsModel, m_newsController, this);
-    setQmlContextProperty("ApiNewsController", m_apiNewsUiController);
+    m_apiPremV1MigrationUIController.reset(new ApiPremV1MigrationUIController(m_serversModel, m_apiPremV1MigrationCoreController));
+    m_engine->rootContext()->setContextProperty("ApiPremV1MigrationController", m_apiPremV1MigrationUIController.get());
+    
+    setupControllerSignalConnections();
+}
+
+void CoreController::setupControllerSignalConnections()
+{
+    auto clientManagementController = m_clientManagementUIController->getClientManagementController();
+    
+    connect(m_exportController.data(), &ExportController::clientAppendRequested,
+            clientManagementController.data(), 
+            [clientManagementController](const DockerContainer container, const ServerCredentials &credentials, 
+                                       const ContainerConfig &containerConfig, const QString &clientName, 
+                                       const QSharedPointer<ServerController> &serverController) {
+                QList<ClientInfo> clientsList;
+                ErrorCode result = clientManagementController->appendClient(container, credentials, containerConfig, 
+                                                                           clientName, serverController, clientsList);
+                emit clientManagementController->clientAppendCompleted(result);
+            });
+    
+    connect(m_exportController.data(), &ExportController::nativeConfigClientAppendRequested,
+            clientManagementController.data(),
+            [clientManagementController](const QSharedPointer<ProtocolConfig> &protocolConfig, const QString &clientName,
+                                       const DockerContainer container, const ServerCredentials &credentials,
+                                       const QSharedPointer<ServerController> &serverController) {
+                QList<ClientInfo> clientsList;
+                auto nonConstProtocolConfig = QSharedPointer<ProtocolConfig>(protocolConfig);
+                ErrorCode result = clientManagementController->appendClient(nonConstProtocolConfig, clientName, container,
+                                                                           credentials, serverController, clientsList);
+                emit clientManagementController->nativeConfigClientAppendCompleted(result);
+            });
+    
+    connect(clientManagementController.data(), &ClientManagementController::clientAppendCompleted,
+            m_exportController.data(), &ExportController::onClientAppendCompleted);
+    
+    connect(clientManagementController.data(), &ClientManagementController::nativeConfigClientAppendCompleted,
+            m_exportController.data(), &ExportController::onNativeConfigClientAppendCompleted);
+            
+    connect(m_installController.data(), &InstallController::clientAppendRequested,
+            clientManagementController.data(),
+            [clientManagementController](const DockerContainer container, const ServerCredentials &credentials,
+                                       const ContainerConfig &containerConfig, const QString &clientName,
+                                       const QSharedPointer<ServerController> &serverController) {
+                QList<ClientInfo> clientsList;
+                clientManagementController->appendClient(container, credentials, containerConfig,
+                                                        clientName, serverController, clientsList);
+            });
 }

 void CoreController::initAndroidController()
@@ -220,16 +231,33 @@ void CoreController::initAndroidController()
    if (!AndroidController::initLogging()) {
        qFatal("Android logging initialization failed");
    }
-    AndroidController::instance()->setSaveLogs(m_appSettingsRepository->isSaveLogs());
-    AndroidController::instance()->setScreenshotsEnabled(m_appSettingsRepository->isScreenshotsEnabled());
+    AndroidController::instance()->setSaveLogs(m_settings->isSaveLogs());
+    connect(m_settings.get(), &Settings::saveLogsChanged, AndroidController::instance(), &AndroidController::setSaveLogs);

+    AndroidController::instance()->setScreenshotsEnabled(m_settings->isScreenshotsEnabled());
+    connect(m_settings.get(), &Settings::screenshotsEnabledChanged, AndroidController::instance(), &AndroidController::setScreenshotsEnabled);
+
+    connect(m_settings.get(), &Settings::serverRemoved, AndroidController::instance(), &AndroidController::resetLastServer);
+
+    connect(m_settings.get(), &Settings::settingsCleared, []() { AndroidController::instance()->resetLastServer(-1); });
+
+    connect(AndroidController::instance(), &AndroidController::initConnectionState, this, [this](Vpn::ConnectionState state) {
+        m_connectionController->onConnectionStateChanged(state);
+        if (m_vpnConnection)
+            m_vpnConnection->restoreConnection();
+    });
    if (!AndroidController::instance()->initialize()) {
        qFatal("Android controller initialization failed");
    }

-    if (m_engine) {
-        m_engine->addImageProvider(QLatin1String("installedAppImage"), new InstalledAppsImageProvider);
-    }
+    connect(AndroidController::instance(), &AndroidController::importConfigFromOutside, this, [this](QString data) {
+        emit m_pageController->goToPageHome();
+        m_importController->extractConfigFromData(data);
+        data.clear();
+        emit m_pageController->goToPageViewConfig();
+    });
+
+    m_engine->addImageProvider(QLatin1String("installedAppImage"), new InstalledAppsImageProvider);
 #endif
 }

@@ -237,36 +265,62 @@ void CoreController::initAppleController()
 {
 #ifdef Q_OS_IOS
    IosController::Instance()->initialize();
-    QTimer::singleShot(0, this, [this]() { AmneziaVPN::toggleScreenshots(m_appSettingsRepository->isScreenshotsEnabled()); });
-#endif
-}
+    connect(IosController::Instance(), &IosController::importConfigFromOutside, this, [this](QString data) {
+        emit m_pageController->goToPageHome();
+        m_importController->extractConfigFromData(data);
+        emit m_pageController->goToPageViewConfig();
+    });

-void CoreController::initLogging()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    bool enabled = m_appSettingsRepository->isSaveLogs();
-    if (enabled) {
-        if (!Logger::init(false)) {
-            qWarning() << "Initialization of debug subsystem failed";
-        }
-    }
-    Logger::setServiceLogsEnabled(enabled);
+    connect(IosController::Instance(), &IosController::importBackupFromOutside, this, [this](QString filePath) {
+        emit m_pageController->goToPageHome();
+        m_pageController->goToPageSettingsBackup();
+        emit m_settingsUIController->importBackupFromOutside(filePath);
+    });
+
+    QTimer::singleShot(0, this, [this]() { AmneziaVPN::toggleScreenshots(m_settings->isScreenshotsEnabled()); });
+
+    connect(m_settings.get(), &Settings::screenshotsEnabledChanged, [](bool enabled) { AmneziaVPN::toggleScreenshots(enabled); });
 #endif
 }

 void CoreController::initSignalHandlers()
 {
-    m_signalHandlers = new CoreSignalHandlers(this, this);
-    m_signalHandlers->initAllHandlers();
-    
-    // Trigger initial update after handlers are connected
-    m_serversUiController->updateModel();
+    initErrorMessagesHandler();
+
+    initApiCountryModelUpdateHandler();
+    initContainerModelUpdateHandler();
+    initAdminConfigRevokedHandler();
+    initPassphraseRequestHandler();
+    initTranslationsUpdatedHandler();
+    initAutoConnectHandler();
+    initAmneziaDnsToggledHandler();
+    initPrepareConfigHandler();
+    initImportPremiumV2VpnKeyHandler();
+    initShowMigrationDrawerHandler();
+    initStrictKillSwitchHandler();
+}
+
+void CoreController::initNotificationHandler()
+{
+#ifndef Q_OS_ANDROID
+    m_notificationHandler.reset(NotificationHandler::create(nullptr));
+
+    connect(m_vpnConnection.get(), &VpnConnection::connectionStateChanged, m_notificationHandler.get(),
+            &NotificationHandler::setConnectionState);
+
+    connect(m_notificationHandler.get(), &NotificationHandler::raiseRequested, m_pageController.get(), &PageController::raiseMainWindow);
+    connect(m_notificationHandler.get(), &NotificationHandler::connectRequested, m_connectionController.get(),
+            static_cast<void (ConnectionUIController::*)()>(&ConnectionUIController::openConnection));
+    connect(m_notificationHandler.get(), &NotificationHandler::disconnectRequested, m_connectionController.get(),
+            &ConnectionUIController::closeConnection);
+    connect(this, &CoreController::translationsUpdated, m_notificationHandler.get(), &NotificationHandler::onTranslationsUpdated);
+#endif
 }

 void CoreController::updateTranslator(const QLocale &locale)
 {
    if (!m_translator->isEmpty()) {
-        QCoreApplication::removeTranslator(m_translator);
+        QCoreApplication::removeTranslator(m_translator.get());
    }

    QStringList availableTranslations;
@@ -275,7 +329,6 @@ void CoreController::updateTranslator(const QLocale &locale)
        availableTranslations << it.next();
    }

-    // This code allow to load translation for the language only, without country code
    const QString lang = locale.name().split("_").first();
    const QString translationFilePrefix = QString(":/translations/amneziavpn_") + lang;
    QString strFileName = QString(":/translations/amneziavpn_%1.qm").arg(locale.name());
@@ -287,52 +340,125 @@ void CoreController::updateTranslator(const QLocale &locale)
    }

    if (m_translator->load(strFileName)) {
-        QCoreApplication::installTranslator(m_translator);
-    } else {
-        if (m_translator->load(QString(":/translations/amneziavpn_en.qm"))) {
-            QCoreApplication::installTranslator(m_translator);
+        if (QCoreApplication::installTranslator(m_translator.get())) {
+            m_settings->setAppLanguage(locale);
        }
+    } else {
+        m_settings->setAppLanguage(QLocale::English);
    }

-    if (m_engine) {
-        m_engine->retranslate();
-    }
+    m_engine->retranslate();

    emit translationsUpdated();
-    if (m_languageUiController) {
-        emit websiteUrlChanged(m_languageUiController->getCurrentSiteUrl());
-    }
+}
+
+void CoreController::initErrorMessagesHandler()
+{
+    connect(m_connectionController.get(), &ConnectionUIController::connectionErrorOccurred, this, [this](ErrorCode errorCode) {
+        emit m_pageController->showErrorMessage(errorCode);
+        emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Disconnected);
+    });
+
+    connect(m_apiConfigUIController.get(), &ApiConfigUIController::errorOccurred, m_pageController.get(),
+            qOverload<ErrorCode>(&PageController::showErrorMessage));
 }

 void CoreController::setQmlRoot()
 {
-    if (m_engine && m_systemController) {
-        m_systemController->setQmlRoot(m_engine->rootObjects().value(0));
+    m_systemController->setQmlRoot(m_engine->rootObjects().value(0));
+}
+
+void CoreController::initApiCountryModelUpdateHandler()
+{
+    connect(m_serversModel.get(), &ServersModel::updateApiCountryModel, this, [this]() {
+        m_apiCountryModel->updateModel(m_serversModel->getProcessedServerData("apiAvailableCountries").toJsonArray(),
+                                       m_serversModel->getProcessedServerData("apiServerCountryCode").toString());
+    });
+}
+
+void CoreController::initContainerModelUpdateHandler()
+{
+    connect(m_serversModel.get(), &ServersModel::containersUpdated, m_containersModel.get(), &ContainersModel::updateModel);
+    connect(m_serversModel.get(), &ServersModel::defaultServerContainersUpdated, m_defaultServerContainersModel.get(),
+            &ContainersModel::updateModel);
+    m_serversModel->resetModel();
+}
+
+void CoreController::initAdminConfigRevokedHandler()
+{
+    connect(m_clientManagementModel.get(), &ClientManagementModel::adminConfigRevoked, m_serversModel.get(),
+            &ServersModel::clearCachedProfile);
+}
+
+void CoreController::initPassphraseRequestHandler()
+{
+    
+}
+
+void CoreController::initTranslationsUpdatedHandler()
+{
+    connect(m_languageModel.get(), &LanguageModel::updateTranslations, this, &CoreController::updateTranslator);
+    connect(this, &CoreController::translationsUpdated, m_languageModel.get(), &LanguageModel::translationsUpdated);
+    connect(this, &CoreController::translationsUpdated, m_connectionController.get(), &ConnectionUIController::onTranslationsUpdated);
+}
+
+void CoreController::initAutoConnectHandler()
+{
+    if (m_settingsUIController->isAutoConnectEnabled() && m_serversModel->getDefaultServerIndex() >= 0) {
+        QTimer::singleShot(1000, this, [this]() { m_connectionController->openConnection(); });
    }
 }

-PageController* CoreController::pageController() const
+void CoreController::initAmneziaDnsToggledHandler()
+{
+    connect(m_settingsUIController.get(), &SettingsUIController::amneziaDnsToggled, m_serversModel.get(), &ServersModel::toggleAmneziaDns);
+}
+
+void CoreController::initPrepareConfigHandler()
+{
+    connect(m_connectionController.get(), &ConnectionUIController::prepareConfig, this, [this]() {
+        emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Preparing);
+
+        if (!m_apiConfigUIController->isConfigValid()) {
+            emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Disconnected);
+            return;
+        }
+
+        if (!m_installController->isConfigValid(m_serversModel->getProcessedServerCredentials())) {
+            emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Disconnected);
+            return;
+        }
+
+        m_connectionController->openConnection();
+    });
+}
+
+void CoreController::initImportPremiumV2VpnKeyHandler()
+{
+    connect(m_apiPremV1MigrationUIController.get(), &ApiPremV1MigrationUIController::importPremiumV2VpnKey, this, [this](const QString &vpnKey) {
+        m_importController->extractConfigFromData(vpnKey);
+        m_importController->importConfig();
+
+        emit m_apiPremV1MigrationUIController->migrationFinished();
+    });
+}
+
+void CoreController::initShowMigrationDrawerHandler()
+{
+    QTimer::singleShot(1000, this, [this]() {
+        if (m_apiPremV1MigrationUIController->isPremV1MigrationReminderActive() && m_apiPremV1MigrationUIController->hasConfigsToMigration()) {
+            m_apiPremV1MigrationUIController->showMigrationDrawer();
+        }
+    });
+}
+
+void CoreController::initStrictKillSwitchHandler()
+{
+    connect(m_settingsUIController.get(), &SettingsUIController::strictKillSwitchEnabledChanged, m_vpnConnection.get(),
+            &VpnConnection::onKillSwitchModeChanged);
+}
+
+QSharedPointer<PageController> CoreController::pageController() const
 {
    return m_pageController;
 }
-
-void CoreController::openConnectionByIndex(int serverIndex)
-{
-    if (m_serversModel) {
-        m_serversModel->setProcessedServerIndex(serverIndex);
-    }
-    if (m_serversController) {
-        m_serversController->setDefaultServerIndex(serverIndex);
-    }
-    m_connectionUiController->toggleConnection();
-}
-
-void CoreController::importConfigFromData(const QString &data)
-{
-    if (!m_importController)
-        return;
-
-    if (m_importController->extractConfigFromData(data)) {
-        m_importController->importConfig();
-    }
-}
@@ -5,209 +5,166 @@
 #include <QQmlContext>
 #include <QThread>

-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    #include "ui/utils/systemTrayNotificationHandler.h"
-#endif
-
-#include "ui/controllers/api/subscriptionUiController.h"
-#include "ui/controllers/api/apiNewsUiController.h"
-#include "ui/controllers/appSplitTunnelingUiController.h"
-#include "ui/controllers/allowedDnsUiController.h"
-#include "ui/controllers/connectionUiController.h"
-#include "ui/controllers/selfhosted/exportUiController.h"
+#include "ui/controllers/api/apiConfigUIController.h"
+#include "ui/controllers/api/apiSettingsUIController.h"
+#include "ui/controllers/api/apiPremV1MigrationUIController.h"
+#include "core/controllers/api/apiConfigController.h"
+#include "core/controllers/api/apiSettingsController.h"
+#include "core/controllers/api/apiPremV1MigrationController.h"
+#include "core/controllers/selfhosted/clientManagementController.h"
+#include "ui/controllers/appSplitUIController.h"
+#include "ui/controllers/allowedDnsUIController.h"
+#include "ui/controllers/connectionUIController.h"
 #include "core/controllers/selfhosted/exportController.h"
-#include "ui/controllers/qml/focusController.h"
-#include "ui/controllers/importUiController.h"
-#include "core/controllers/selfhosted/importController.h"
-#include "ui/controllers/selfhosted/installUiController.h"
-#include "ui/controllers/qml/pageController.h"
-#include "ui/controllers/settingsUiController.h"
-#include "ui/controllers/serversUiController.h"
-#include "ui/controllers/ipSplitTunnelingUiController.h"
-#include "ui/controllers/systemController.h"
-#include "ui/controllers/languageUiController.h"
-#include "ui/controllers/api/servicesCatalogUiController.h"
-
-#include "core/controllers/serversController.h"
-#include "core/controllers/selfhosted/usersController.h"
-#include "core/controllers/appSplitTunnelingController.h"
-#include "core/controllers/ipSplitTunnelingController.h"
-#include "core/controllers/allowedDnsController.h"
-#include "core/controllers/api/servicesCatalogController.h"
-#include "core/controllers/api/subscriptionController.h"
-#include "core/controllers/api/newsController.h"
 #include "core/controllers/selfhosted/installController.h"
+#include "ui/controllers/selfhosted/exportUIController.h"
+#include "ui/controllers/focusController.h"
+#include "ui/controllers/importController.h"
+#include "ui/controllers/selfhosted/installUIController.h"
+#include "ui/controllers/pageController.h"
+#include "ui/controllers/settingsUIController.h"
+#include "ui/controllers/siteSplitUIController.h"
+#include "ui/controllers/systemController.h"
+#include "core/utils/fileUtils.h"
 #include "core/controllers/settingsController.h"
+#include "core/controllers/dnsController.h"
 #include "core/controllers/connectionController.h"
+#include "core/controllers/splitTunnelingController.h"

-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "secureQSettings.h"
-
-#include "ui/models/allowedDnsModel.h"
-#include "ui/models/containersModel.h"
+#include "ui/models/allowed_dns_model.h"
+#include "ui/models/containers_model.h"
 #include "ui/models/languageModel.h"
+#include "ui/models/protocols/cloakConfigModel.h"
 #ifdef Q_OS_WINDOWS
    #include "ui/models/protocols/ikev2ConfigModel.h"
 #endif
 #include "ui/models/api/apiAccountInfoModel.h"
-#include "ui/models/api/apiBenefitsModel.h"
 #include "ui/models/api/apiCountryModel.h"
 #include "ui/models/api/apiDevicesModel.h"
 #include "ui/models/api/apiServicesModel.h"
-#include "ui/models/api/apiSubscriptionPlansModel.h"
 #include "ui/models/appSplitTunnelingModel.h"
-#include "ui/models/clientManagementModel.h"
+#include "ui/models/selfhosted/clientManagementModel.h"
+#include "ui/controllers/selfhosted/clientManagementUIController.h"
 #include "ui/models/protocols/awgConfigModel.h"
 #include "ui/models/protocols/openvpnConfigModel.h"
+#include "ui/models/protocols/shadowsocksConfigModel.h"
 #include "ui/models/protocols/wireguardConfigModel.h"
 #include "ui/models/protocols/xrayConfigModel.h"
-#include "ui/models/protocolsModel.h"
-#include "ui/models/services/torConfigModel.h"
-#include "ui/models/serversModel.h"
+#include "ui/models/protocols_model.h"
+#include "ui/models/servers_model.h"
 #include "ui/models/services/sftpConfigModel.h"
 #include "ui/models/services/socks5ProxyConfigModel.h"
-#include "ui/models/ipSplitTunnelingModel.h"
-#include "ui/models/newsModel.h"
+#include "ui/models/sites_model.h"

-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    #include "ui/utils/notificationHandler.h"
+#ifndef Q_OS_ANDROID
+    #include "ui/notificationhandler.h"
 #endif

-class CoreSignalHandlers;
-class TestMultipleImports;
-class TestAdminSelfHostedExport;
-class TestServerEdit;
-class TestDefaultServerChange;
-class TestServerEdgeCases;
-class TestSignalOrder;
-class TestServersModelSync;
-class TestGatewayStacks;
-class TestComplexOperations;
-class TestSettingsSignals;
-class TestUiServersModelAndController;
-class TestSelfHostedServerSetup;
-
 class CoreController : public QObject
 {
    Q_OBJECT
-    friend class CoreSignalHandlers;
-    friend class TestMultipleImports;
-    friend class TestAdminSelfHostedExport;
-    friend class TestServerEdit;
-    friend class TestDefaultServerChange;
-    friend class TestServerEdgeCases;
-    friend class TestSignalOrder;
-    friend class TestServersModelSync;
-    friend class TestGatewayStacks;
-    friend class TestComplexOperations;
-    friend class TestSettingsSignals;
-    friend class TestUiServersModelAndController;
-    friend class TestSelfHostedServerSetup;

 public:
-    explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
+    explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, const std::shared_ptr<Settings> &settings,
                            QQmlApplicationEngine *engine, QObject *parent = nullptr);

-    PageController* pageController() const;
+    QSharedPointer<PageController> pageController() const;
    void setQmlRoot();

-    void openConnectionByIndex(int serverIndex);
-    void importConfigFromData(const QString &data);
-    void updateTranslator(const QLocale &locale);
-
 signals:
    void translationsUpdated();
-    void websiteUrlChanged(const QString &newUrl);

 private:
-    void initRepositories();
-    void initCoreControllers();
    void initModels();
-    void initControllers();
+    void initCoreControllers();
+    void initUIControllers();
+    void initSignalHandlers();
    void initAndroidController();
    void initAppleController();
-    void initLogging();
-    void initSignalHandlers();
-    void setQmlContextProperty(const QString &name, QObject *value);
+    void setupControllerSignalConnections();

-    QQmlApplicationEngine *m_engine {}; // TODO use parent child system here?
-    SecureQSettings* m_settings;
+    void initNotificationHandler();
+
+    void updateTranslator(const QLocale &locale);
+
+    void initErrorMessagesHandler();
+
+    void initApiCountryModelUpdateHandler();
+    void initContainerModelUpdateHandler();
+    void initAdminConfigRevokedHandler();
+    void initPassphraseRequestHandler();
+    void initTranslationsUpdatedHandler();
+    void initAutoConnectHandler();
+    void initAmneziaDnsToggledHandler();
+    void initPrepareConfigHandler();
+    void initImportPremiumV2VpnKeyHandler();
+    void initShowMigrationDrawerHandler();
+    void initStrictKillSwitchHandler();
+
+    QQmlApplicationEngine *m_engine {};
+    std::shared_ptr<Settings> m_settings;
    QSharedPointer<VpnConnection> m_vpnConnection;
-    QTranslator* m_translator;
+    QSharedPointer<QTranslator> m_translator;

-    SecureServersRepository* m_serversRepository;
-    SecureAppSettingsRepository* m_appSettingsRepository;
-
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    NotificationHandler* m_notificationHandler;
+#ifndef Q_OS_ANDROID
+    QScopedPointer<NotificationHandler> m_notificationHandler;
 #endif

    QMetaObject::Connection m_reloadConfigErrorOccurredConnection;

-    ConnectionUiController* m_connectionUiController;
-    FocusController* m_focusController;
-    PageController* m_pageController;
-    InstallUiController* m_installUiController;
-    ImportUiController* m_importController;
-    ImportController* m_importCoreController;
-    ExportUiController* m_exportUiController;
-    SettingsUiController* m_settingsUiController;
-    ServersUiController* m_serversUiController;
-    IpSplitTunnelingUiController* m_ipSplitTunnelingUiController;
-    SystemController* m_systemController;
-    AppSplitTunnelingUiController* m_appSplitTunnelingUiController;
-    AllowedDnsUiController* m_allowedDnsUiController;
-    LanguageUiController* m_languageUiController;
+    QScopedPointer<ConnectionUIController> m_connectionController;
+    QScopedPointer<FocusController> m_focusController;
+    QSharedPointer<PageController> m_pageController;
+    QSharedPointer<ExportController> m_exportController;
+    QSharedPointer<InstallController> m_installController;
+    QScopedPointer<ExportUIController> m_exportUIController;
+    QScopedPointer<InstallUIController> m_installUIController;
+    QScopedPointer<ImportController> m_importController;
+    QScopedPointer<SettingsUIController> m_settingsUIController;
+    QScopedPointer<SiteSplitUIController> m_siteSplitUIController;
+    QScopedPointer<SystemController> m_systemController;
+    QScopedPointer<AppSplitUIController> m_appSplitUIController;
+    QScopedPointer<AllowedDnsUIController> m_allowedDnsUIController;

-    SubscriptionUiController* m_subscriptionUiController;
-    ApiNewsUiController* m_apiNewsUiController;
-    
-    ServicesCatalogUiController* m_servicesCatalogUiController;
+    QSharedPointer<ApiSettingsController> m_apiSettingsCoreController;
+    QSharedPointer<ApiConfigsController> m_apiConfigsCoreController;
+    QSharedPointer<ApiPremV1MigrationController> m_apiPremV1MigrationCoreController;

-    ServersController* m_serversController;
-    UsersController* m_usersController;
-    AppSplitTunnelingController* m_appSplitTunnelingController;
-    IpSplitTunnelingController* m_ipSplitTunnelingController;
-    AllowedDnsController* m_allowedDnsController;
-    ServicesCatalogController* m_servicesCatalogController;
-    SubscriptionController* m_subscriptionController;
-    NewsController* m_newsController;
-    InstallController* m_installController;
-    ExportController* m_exportController;
-    ConnectionController* m_connectionController;
-    SettingsController* m_settingsController;
+    QScopedPointer<ApiSettingsUIController> m_apiSettingsUIController;
+    QScopedPointer<ApiConfigUIController> m_apiConfigUIController;
+    QScopedPointer<ApiPremV1MigrationUIController> m_apiPremV1MigrationUIController;

-    ContainersModel* m_containersModel;
-    ContainersModel* m_defaultServerContainersModel;
-    ServersModel* m_serversModel;
-    LanguageModel* m_languageModel;
-    ProtocolsModel* m_protocolsModel;
-    IpSplitTunnelingModel* m_ipSplitTunnelingModel;
-    NewsModel* m_newsModel;
-    AllowedDnsModel* m_allowedDnsModel;
-    AppSplitTunnelingModel* m_appSplitTunnelingModel;
-    ClientManagementModel* m_clientManagementModel;
+    QSharedPointer<SettingsController> m_settingsController;
+    QSharedPointer<DnsController> m_dnsController;
+    QSharedPointer<SplitTunnelingController> m_splitTunnelingController;

-    ApiServicesModel* m_apiServicesModel;
-    ApiSubscriptionPlansModel* m_apiSubscriptionPlansModel;
-    ApiBenefitsModel* m_apiBenefitsModel;
-    ApiCountryModel* m_apiCountryModel;
-    ApiAccountInfoModel* m_apiAccountInfoModel;
-    ApiDevicesModel* m_apiDevicesModel;
+    QSharedPointer<ContainersModel> m_containersModel;
+    QSharedPointer<ContainersModel> m_defaultServerContainersModel;
+    QSharedPointer<ServersModel> m_serversModel;
+    QSharedPointer<LanguageModel> m_languageModel;
+    QSharedPointer<ProtocolsModel> m_protocolsModel;
+    QSharedPointer<SitesModel> m_sitesModel;
+    QSharedPointer<AllowedDnsModel> m_allowedDnsModel;
+    QSharedPointer<AppSplitTunnelingModel> m_appSplitTunnelingModel;
+    QSharedPointer<ClientManagementModel> m_clientManagementModel;
+    QSharedPointer<ClientManagementUIController> m_clientManagementUIController;

-    OpenVpnConfigModel* m_openVpnConfigModel;
-    XrayConfigModel* m_xrayConfigModel;
-    TorConfigModel* m_torConfigModel;
-    WireGuardConfigModel* m_wireGuardConfigModel;
-    AwgConfigModel* m_awgConfigModel;
+    QSharedPointer<ApiServicesModel> m_apiServicesModel;
+    QSharedPointer<ApiCountryModel> m_apiCountryModel;
+    QSharedPointer<ApiAccountInfoModel> m_apiAccountInfoModel;
+    QSharedPointer<ApiDevicesModel> m_apiDevicesModel;
+
+    QSharedPointer<OpenVpnConfigModel> m_openVpnConfigModel;
+    QSharedPointer<ShadowSocksConfigModel> m_shadowSocksConfigModel;
+    QSharedPointer<CloakConfigModel> m_cloakConfigModel;
+    QSharedPointer<XrayConfigModel> m_xrayConfigModel;
+    QSharedPointer<WireGuardConfigModel> m_wireGuardConfigModel;
+    QSharedPointer<AwgConfigModel> m_awgConfigModel;
 #ifdef Q_OS_WINDOWS
-    Ikev2ConfigModel* m_ikev2ConfigModel;
+    QSharedPointer<Ikev2ConfigModel> m_ikev2ConfigModel;
 #endif
-    SftpConfigModel* m_sftpConfigModel;
-    Socks5ProxyConfigModel* m_socks5ConfigModel;
-
-    CoreSignalHandlers* m_signalHandlers;
+    QSharedPointer<SftpConfigModel> m_sftpConfigModel;
+    QSharedPointer<Socks5ProxyConfigModel> m_socks5ConfigModel;
 };

 #endif // CORECONTROLLER_H
@@ -1,412 +0,0 @@
-#include "coreSignalHandlers.h"
-
-#include <QTimer>
-
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/controllers/coreController.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "vpnConnection.h"
-#include "ui/controllers/qml/pageController.h"
-#include "ui/controllers/connectionUiController.h"
-#include "ui/controllers/settingsUiController.h"
-#include "ui/controllers/serversUiController.h"
-#include "ui/controllers/ipSplitTunnelingUiController.h"
-#include "ui/controllers/allowedDnsUiController.h"
-#include "ui/controllers/appSplitTunnelingUiController.h"
-#include "ui/controllers/languageUiController.h"
-#include "ui/controllers/selfhosted/installUiController.h"
-#include "ui/controllers/importUiController.h"
-#include "ui/controllers/api/subscriptionUiController.h"
-#include "ui/models/serversModel.h"
-#include "core/controllers/serversController.h"
-#include "core/controllers/ipSplitTunnelingController.h"
-#include "core/controllers/appSplitTunnelingController.h"
-#include "core/controllers/selfhosted/usersController.h"
-#include "core/controllers/settingsController.h"
-#include "core/controllers/selfhosted/installController.h"
-#include "core/controllers/selfhosted/exportController.h"
-#include "core/controllers/connectionController.h"
-#include "ui/models/clientManagementModel.h"
-#include "ui/controllers/api/apiNewsUiController.h"
-#include "ui/models/api/apiCountryModel.h"
-#include "ui/models/containersModel.h"
-#include "core/utils/containerEnum.h"
-
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    #include "ui/utils/notificationHandler.h"
-    #include "ui/utils/systemTrayNotificationHandler.h"
-#endif
-
-#ifdef Q_OS_ANDROID
-    #include "platforms/android/android_controller.h"
-#endif
-
-#ifdef Q_OS_IOS
-    #include "platforms/ios/ios_controller.h"
-    #include <AmneziaVPN-Swift.h>
-#endif
-
-CoreSignalHandlers::CoreSignalHandlers(CoreController* coreController, QObject* parent)
-    : QObject(parent),
-      m_coreController(coreController)
-{
-}
-
-void CoreSignalHandlers::initAllHandlers()
-{
-    initErrorMessagesHandler();
-    initSettingsSplitTunnelingHandler();
-    initInstallControllerHandler();
-    initExportControllerHandler();
-    initImportControllerHandler();
-    initApiCountryModelUpdateHandler();
-    initSubscriptionRefreshHandler();
-    initContainerModelUpdateHandler();
-    initAdminConfigRevokedHandler();
-    initPassphraseRequestHandler();
-    initTranslationsUpdatedHandler();
-    initLanguageHandler();
-    initAutoConnectHandler();
-    initAmneziaDnsToggledHandler();
-    initServersModelUpdateHandler();
-    initClientManagementModelUpdateHandler();
-    initSitesModelUpdateHandler();
-    initAllowedDnsModelUpdateHandler();
-    initAppSplitTunnelingModelUpdateHandler();
-    initPrepareConfigHandler();
-    initStrictKillSwitchHandler();
-    initAndroidSettingsHandler();
-    initAndroidConnectionHandler();
-    initIosImportHandler();
-    initIosSettingsHandler();
-    initNotificationHandler();
-}
-
-void CoreSignalHandlers::initErrorMessagesHandler()
-{
-    connect(m_coreController->m_connectionUiController, &ConnectionUiController::connectionErrorOccurred, this, [this](ErrorCode errorCode) {
-        emit m_coreController->m_pageController->showErrorMessage(errorCode);
-        m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-    });
-
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::errorOccurred, m_coreController->m_pageController,
-            qOverload<ErrorCode>(&PageController::showErrorMessage));
-
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::errorOccurred, m_coreController->m_pageController,
-            qOverload<ErrorCode>(&PageController::showErrorMessage));
-}
-
-void CoreSignalHandlers::initSettingsSplitTunnelingHandler()
-{
-    connect(m_coreController->m_settingsController, &SettingsController::siteSplitTunnelingRouteModeChanged, this, [this](RouteMode mode) {
-        m_coreController->m_ipSplitTunnelingController->setRouteMode(mode);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::siteSplitTunnelingToggled, this, [this](bool enabled) {
-        m_coreController->m_ipSplitTunnelingController->toggleSplitTunneling(enabled);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::appSplitTunnelingRouteModeChanged, this, [this](AppsRouteMode mode) {
-        m_coreController->m_appSplitTunnelingController->setRouteMode(mode);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::appSplitTunnelingToggled, this, [this](bool enabled) {
-        m_coreController->m_appSplitTunnelingController->toggleSplitTunneling(enabled);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::appSplitTunnelingClearAppsList, this, [this]() {
-        m_coreController->m_appSplitTunnelingController->clearAppsList();
-    });
-}
-
-void CoreSignalHandlers::initInstallControllerHandler()
-{
-    connect(m_coreController->m_installController, &InstallController::serverIsBusy, m_coreController->m_installUiController, &InstallUiController::serverIsBusy);
-    connect(m_coreController->m_installUiController, &InstallUiController::cancelInstallation, m_coreController->m_installController, &InstallController::cancelInstallation);
-    connect(m_coreController->m_installUiController, &InstallUiController::currentContainerUpdated, m_coreController->m_connectionUiController,
-            &ConnectionUiController::onCurrentContainerUpdated);
-    connect(m_coreController->m_serversUiController, &ServersUiController::processedServerIndexChanged,
-        m_coreController->m_installUiController, [this](int index) {
-        if (index >= 0) {
-            m_coreController->m_installUiController->clearProcessedServerCredentials();
-        }
-    });
-}
-
-void CoreSignalHandlers::initExportControllerHandler()
-{
-    connect(m_coreController->m_exportController, &ExportController::appendClientRequested, this,
-            [this](int serverIndex, const QString &clientId, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->appendClient(serverIndex, clientId, clientName, container);
-            });
-    connect(m_coreController->m_exportController, &ExportController::updateClientsRequested, this,
-            [this](int serverIndex, DockerContainer container) {
-                m_coreController->m_usersController->updateClients(serverIndex, container);
-            });
-    connect(m_coreController->m_exportController, &ExportController::revokeClientRequested, this,
-            [this](int serverIndex, int row, DockerContainer container) {
-                m_coreController->m_usersController->revokeClient(serverIndex, row, container);
-            });
-    connect(m_coreController->m_exportController, &ExportController::renameClientRequested, this,
-            [this](int serverIndex, int row, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->renameClient(serverIndex, row, clientName, container);
-            });
-}
-
-void CoreSignalHandlers::initImportControllerHandler()
-{
-    connect(m_coreController->m_importCoreController, &ImportController::importFinished, this, [this]() {
-        if (!m_coreController->m_connectionController->isConnected()) {
-            int newServerIndex = m_coreController->m_serversController->getServersCount() - 1;
-            m_coreController->m_serversController->setDefaultServerIndex(newServerIndex);
-            if (m_coreController->m_serversUiController) {
-                m_coreController->m_serversUiController->setProcessedServerIndex(newServerIndex);
-            }
-        }
-    });
-}
-
-void CoreSignalHandlers::initApiCountryModelUpdateHandler()
-{
-    connect(m_coreController->m_serversUiController, &ServersUiController::updateApiCountryModel, this, [this]() {
-        int processedIndex = m_coreController->m_serversUiController->getProcessedServerIndex();
-        if (processedIndex < 0 || processedIndex >= m_coreController->m_serversRepository->serversCount()) {
-            return;
-        }
-        
-        ServerConfig server = m_coreController->m_serversRepository->server(processedIndex);
-        QJsonArray availableCountries;
-        QString serverCountryCode;
-        
-        if (server.isApiV2()) {
-            const ApiV2ServerConfig* apiV2 = server.as<ApiV2ServerConfig>();
-            if (apiV2) {
-                availableCountries = apiV2->apiConfig.availableCountries;
-                serverCountryCode = apiV2->apiConfig.serverCountryCode;
-            }
-        }
-        
-        m_coreController->m_apiCountryModel->updateModel(availableCountries, serverCountryCode);
-    });
-}
-
-void CoreSignalHandlers::initSubscriptionRefreshHandler()
-{
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::subscriptionRefreshNeeded, this, [this]() {
-        const int defaultServerIndex = m_coreController->m_serversController->getDefaultServerIndex();
-        if (defaultServerIndex >= 0) {
-            m_coreController->m_subscriptionUiController->getAccountInfo(defaultServerIndex, false);
-        }
-    });
-}
-
-void CoreSignalHandlers::initContainerModelUpdateHandler()
-{
-    connect(m_coreController->m_serversController, &ServersController::gatewayStacksExpanded, this, [this]() {
-        if (m_coreController->m_serversUiController->hasServersFromGatewayApi()) {
-            m_coreController->m_apiNewsUiController->fetchNews(false);
-        }
-    });
-}
-
-void CoreSignalHandlers::initAdminConfigRevokedHandler()
-{
-    connect(m_coreController->m_installController, &InstallController::clientRevocationRequested, this,
-            [this](int serverIndex, const ContainerConfig &containerConfig, DockerContainer container) {
-                m_coreController->m_usersController->revokeClient(serverIndex, containerConfig, container);
-            });
-
-    connect(m_coreController->m_installController, &InstallController::clientAppendRequested, this,
-            [this](int serverIndex, const QString &clientId, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->appendClient(serverIndex, clientId, clientName, container);
-            });
-
-    connect(m_coreController->m_usersController, &UsersController::adminConfigRevoked, m_coreController->m_serversController,
-            &ServersController::clearCachedProfile);
-}
-
-void CoreSignalHandlers::initPassphraseRequestHandler()
-{
-    connect(m_coreController->m_installUiController, &InstallUiController::passphraseRequestStarted, m_coreController->m_pageController,
-            &PageController::showPassphraseRequestDrawer);
-    connect(m_coreController->m_pageController, &PageController::passphraseRequestDrawerClosed, m_coreController->m_installUiController,
-            &InstallUiController::setEncryptedPassphrase);
-}
-
-void CoreSignalHandlers::initTranslationsUpdatedHandler()
-{
-    connect(m_coreController->m_languageUiController, &LanguageUiController::updateTranslations, m_coreController, &CoreController::updateTranslator);
-    connect(m_coreController, &CoreController::translationsUpdated, m_coreController->m_languageUiController, &LanguageUiController::translationsUpdated);
-    connect(m_coreController, &CoreController::translationsUpdated, m_coreController->m_connectionUiController, &ConnectionUiController::onTranslationsUpdated);
-}
-
-void CoreSignalHandlers::initLanguageHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appLanguageChanged, m_coreController->m_languageUiController, &LanguageUiController::onAppLanguageChanged);
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::resetLanguageToSystem, m_coreController->m_languageUiController, [this]() {
-        m_coreController->m_languageUiController->changeLanguage(m_coreController->m_languageUiController->getSystemLanguageEnum());
-    });
-}
-
-void CoreSignalHandlers::initAutoConnectHandler()
-{
-    if (m_coreController->m_settingsUiController->isAutoConnectEnabled() && m_coreController->m_serversController->getDefaultServerIndex() >= 0) {
-        QTimer::singleShot(1000, this, [this]() { m_coreController->m_connectionUiController->openConnection(); });
-    }
-}
-
-void CoreSignalHandlers::initAmneziaDnsToggledHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::useAmneziaDnsChanged, m_coreController->m_serversUiController, &ServersUiController::updateModel);
-}
-
-void CoreSignalHandlers::initServersModelUpdateHandler()
-{
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverAdded,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverEdited,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::defaultServerChanged,
-            m_coreController->m_serversUiController, &ServersUiController::onDefaultServerChanged);
-    
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverAdded,
-            m_coreController->m_serversController, &ServersController::recomputeGatewayStacks);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverEdited,
-            m_coreController->m_serversController, &ServersController::recomputeGatewayStacks);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved,
-            m_coreController->m_serversController, &ServersController::recomputeGatewayStacks);
-    
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::restoreBackupFinished,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-}
-
-void CoreSignalHandlers::initClientManagementModelUpdateHandler()
-{
-    connect(m_coreController->m_usersController, &UsersController::clientsUpdated,
-            m_coreController->m_clientManagementModel, &ClientManagementModel::updateModel);
-    connect(m_coreController->m_usersController, &UsersController::clientRenamed,
-            m_coreController->m_clientManagementModel, &ClientManagementModel::updateClientName);
-}
-
-void CoreSignalHandlers::initSitesModelUpdateHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::sitesChanged, m_coreController->m_ipSplitTunnelingUiController, &IpSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::sitesSplitTunnelingEnabledChanged, m_coreController->m_ipSplitTunnelingUiController, &IpSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::routeModeChanged, m_coreController->m_ipSplitTunnelingUiController, &IpSplitTunnelingUiController::updateModel);
-}
-
-void CoreSignalHandlers::initAllowedDnsModelUpdateHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::allowedDnsServersChanged, m_coreController->m_allowedDnsUiController, &AllowedDnsUiController::updateModel);
-}
-
-void CoreSignalHandlers::initAppSplitTunnelingModelUpdateHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appsChanged, m_coreController->m_appSplitTunnelingUiController, &AppSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appsSplitTunnelingEnabledChanged, m_coreController->m_appSplitTunnelingUiController, &AppSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appsRouteModeChanged, m_coreController->m_appSplitTunnelingUiController, &AppSplitTunnelingUiController::updateModel);
-}
-
-void CoreSignalHandlers::initPrepareConfigHandler()
-{
-    connect(m_coreController->m_connectionUiController, &ConnectionUiController::prepareConfig, this, [this]() {
-        m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Preparing);
-
-        m_coreController->m_subscriptionUiController->validateConfig();
-    });
-
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::configValidated, this, [this](bool isValid) {
-        if (!isValid) {
-            m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-            return;
-        }
-
-        m_coreController->m_installUiController->validateConfig();
-    });
-
-    connect(m_coreController->m_installUiController, &InstallUiController::configValidated, this, [this](bool isValid) {
-        if (!isValid) {
-            m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-            return;
-        }
-
-        m_coreController->m_connectionUiController->openConnection();
-    });
-}
-
-void CoreSignalHandlers::initStrictKillSwitchHandler()
-{
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::strictKillSwitchEnabledChanged, m_coreController->m_connectionController,
-            &ConnectionController::onKillSwitchModeChanged);
-}
-
-void CoreSignalHandlers::initAndroidSettingsHandler()
-{
-#ifdef Q_OS_ANDROID
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::saveLogsChanged, AndroidController::instance(), &AndroidController::setSaveLogs);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::screenshotsEnabledChanged, AndroidController::instance(), &AndroidController::setScreenshotsEnabled);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved, AndroidController::instance(), &AndroidController::resetLastServer);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::settingsCleared, []() { AndroidController::instance()->resetLastServer(-1); });
-#endif
-}
-
-void CoreSignalHandlers::initAndroidConnectionHandler()
-{
-#ifdef Q_OS_ANDROID
-    connect(AndroidController::instance(), &AndroidController::initConnectionState, this, [this](Vpn::ConnectionState state) {
-        m_coreController->m_connectionUiController->onConnectionStateChanged(state);
-        m_coreController->m_connectionController->restoreConnection();
-    });
-    connect(AndroidController::instance(), &AndroidController::importConfigFromOutside, this, [this](QString data) {
-        emit m_coreController->m_pageController->goToPageHome();
-        m_coreController->m_importController->extractConfigFromData(data);
-        data.clear();
-        emit m_coreController->m_pageController->goToPageViewConfig();
-    });
-#endif
-}
-
-void CoreSignalHandlers::initIosImportHandler()
-{
-#ifdef Q_OS_IOS
-    connect(IosController::Instance(), &IosController::importConfigFromOutside, this, [this](QString data) {
-        emit m_coreController->m_pageController->goToPageHome();
-        m_coreController->m_importController->extractConfigFromData(data);
-        emit m_coreController->m_pageController->goToPageViewConfig();
-    });
-    connect(IosController::Instance(), &IosController::importBackupFromOutside, this, [this](QString filePath) {
-        emit m_coreController->m_pageController->goToPageHome();
-        m_coreController->m_pageController->goToPageSettingsBackup();
-        emit m_coreController->m_settingsUiController->importBackupFromOutside(filePath);
-    });
-#endif
-}
-
-void CoreSignalHandlers::initIosSettingsHandler()
-{
-#ifdef Q_OS_IOS
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::screenshotsEnabledChanged, [](bool enabled) { AmneziaVPN::toggleScreenshots(enabled); });
-#endif
-}
-
-void CoreSignalHandlers::initNotificationHandler()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    m_coreController->m_notificationHandler = NotificationHandler::create(m_coreController);
-
-    connect(m_coreController->m_connectionController, &ConnectionController::connectionStateChanged, m_coreController->m_notificationHandler,
-            &NotificationHandler::setConnectionState);
-
-    connect(m_coreController->m_notificationHandler, &NotificationHandler::raiseRequested, m_coreController->m_pageController, &PageController::raiseMainWindow);
-    connect(m_coreController->m_notificationHandler, &NotificationHandler::connectRequested, m_coreController->m_connectionUiController,
-            static_cast<void (ConnectionUiController::*)()>(&ConnectionUiController::openConnection));
-    connect(m_coreController->m_notificationHandler, &NotificationHandler::disconnectRequested, m_coreController->m_connectionUiController,
-            &ConnectionUiController::closeConnection);
-    connect(m_coreController, &CoreController::translationsUpdated, m_coreController->m_notificationHandler, &NotificationHandler::onTranslationsUpdated);
-
-    auto* trayHandler = qobject_cast<SystemTrayNotificationHandler*>(m_coreController->m_notificationHandler);
-    connect(m_coreController, &CoreController::websiteUrlChanged, trayHandler, &SystemTrayNotificationHandler::updateWebsiteUrl);
-#endif    
-}
-
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
vladimir.kuznetsov	1f68c8ed80	refactoring: still total mess	2025-08-10 21:22:40 +08:00
vladimir.kuznetsov	153f96fc61	refactoring: build fixes	2025-08-09 20:45:06 +08:00
vladimir.kuznetsov	0dbab0e84b	refactoring: separated api controllers	2025-08-08 21:58:52 +08:00
vladimir.kuznetsov	1b6442079a	refactoring: keep moving	2025-08-08 14:16:01 +08:00
vladimir.kuznetsov	6b0c543fd2	refactoring: remove json usuage from cinfugurators	2025-08-04 16:10:31 +08:00
vladimir.kuznetsov	76413ec2df	refactoring: cli management separation	2025-08-01 10:52:30 +08:00
vladimir.kuznetsov	9f0d4aaba1	refactoring: separated split tunneling and dns controllers and models	2025-07-31 23:17:46 +08:00
vladimir.kuznetsov	abb9ffe1b7	refactoring: separete settings controller	2025-07-31 13:00:01 +08:00
vladimir.kuznetsov	5012cd90e2	refactoring: attempting to move to MVVM (part 2)	2025-07-30 21:02:10 +08:00
vladimir.kuznetsov	39374075c5	refactoring: attempting to move to MVVM	2025-07-29 22:11:24 +08:00
vladimir.kuznetsov	c0fcb23b66	Merge branch 'dev' of github.com:amnezia-vpn/amnezia-client into HEAD	2025-07-29 12:56:49 +08:00
vladimir.kuznetsov	d766a001e3	refactoring: all protocol models now work with c++ classes	2025-07-03 10:20:01 +08:00
vladimir.kuznetsov	65f60ab922	refactoring: replaced part of the code to work with new config classes	2025-06-26 09:57:29 +08:00
vladimir.kuznetsov	2d22a74b22	refactoring: added classes for working with server configs	2025-06-20 22:18:47 +08:00