feat: gateway v2

backend/src/@types/fastify.d.ts

@@ -16,6 +16,7 @@ import { TEventBusService } from "@app/ee/services/event/event-bus-service";
 import { TServerSentEventsService } from "@app/ee/services/event/event-sse-service";
 import { TExternalKmsServiceFactory } from "@app/ee/services/external-kms/external-kms-service";
 import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
+import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TGithubOrgSyncServiceFactory } from "@app/ee/services/github-org-sync/github-org-sync-service";
 import { TGroupServiceFactory } from "@app/ee/services/group/group-service";
 import { TIdentityAuthTemplateServiceFactory } from "@app/ee/services/identity-auth-template";
@@ -32,6 +33,7 @@ import { TPitServiceFactory } from "@app/ee/services/pit/pit-service";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-types";
 import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-types";
 import { RateLimitConfiguration, TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-types";
+import { TRelayServiceFactory } from "@app/ee/services/relay/relay-service";
 import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-types";
 import { TScimServiceFactory } from "@app/ee/services/scim/scim-types";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
@@ -296,6 +298,8 @@ declare module "fastify" {
       secretRotationV2: TSecretRotationV2ServiceFactory;
       microsoftTeams: TMicrosoftTeamsServiceFactory;
       assumePrivileges: TAssumePrivilegeServiceFactory;
+      relay: TRelayServiceFactory;
+      gatewayV2: TGatewayV2ServiceFactory;
       githubOrgSync: TGithubOrgSyncServiceFactory;
       folderCommit: TFolderCommitServiceFactory;
       pit: TPitServiceFactory;

backend/src/@types/knex.d.ts

@@ -101,6 +101,9 @@ import {
   TGateways,
   TGatewaysInsert,
   TGatewaysUpdate,
+  TGatewaysV2,
+  TGatewaysV2Insert,
+  TGatewaysV2Update,
   TGitAppInstallSessions,
   TGitAppInstallSessionsInsert,
   TGitAppInstallSessionsUpdate,
@@ -179,6 +182,9 @@ import {
   TIncidentContacts,
   TIncidentContactsInsert,
   TIncidentContactsUpdate,
+  TInstanceRelayConfig,
+  TInstanceRelayConfigInsert,
+  TInstanceRelayConfigUpdate,
   TIntegrationAuths,
   TIntegrationAuthsInsert,
   TIntegrationAuthsUpdate,
@@ -233,9 +239,15 @@ import {
   TOrgGatewayConfig,
   TOrgGatewayConfigInsert,
   TOrgGatewayConfigUpdate,
+  TOrgGatewayConfigV2,
+  TOrgGatewayConfigV2Insert,
+  TOrgGatewayConfigV2Update,
   TOrgMemberships,
   TOrgMembershipsInsert,
   TOrgMembershipsUpdate,
+  TOrgRelayConfig,
+  TOrgRelayConfigInsert,
+  TOrgRelayConfigUpdate,
   TOrgRoles,
   TOrgRolesInsert,
   TOrgRolesUpdate,
@@ -293,6 +305,9 @@ import {
   TRateLimit,
   TRateLimitInsert,
   TRateLimitUpdate,
+  TRelays,
+  TRelaysInsert,
+  TRelaysUpdate,
   TResourceMetadata,
   TResourceMetadataInsert,
   TResourceMetadataUpdate,
@@ -1241,6 +1256,17 @@ declare module "knex/types/tables" {
       TSecretScanningResourcesInsert,
       TSecretScanningResourcesUpdate
     >;
+    [TableName.InstanceRelayConfig]: KnexOriginal.CompositeTableType<
+      TInstanceRelayConfig,
+      TInstanceRelayConfigInsert,
+      TInstanceRelayConfigUpdate
+    >;
+    [TableName.OrgRelayConfig]: KnexOriginal.CompositeTableType<
+      TOrgRelayConfig,
+      TOrgRelayConfigInsert,
+      TOrgRelayConfigUpdate
+    >;
+    [TableName.Relay]: KnexOriginal.CompositeTableType<TRelays, TRelaysInsert, TRelaysUpdate>;
     [TableName.SecretScanningScan]: KnexOriginal.CompositeTableType<
       TSecretScanningScans,
       TSecretScanningScansInsert,
@@ -1262,6 +1288,12 @@ declare module "knex/types/tables" {
       TRemindersRecipientsInsert,
       TRemindersRecipientsUpdate
     >;
+    [TableName.OrgGatewayConfigV2]: KnexOriginal.CompositeTableType<
+      TOrgGatewayConfigV2,
+      TOrgGatewayConfigV2Insert,
+      TOrgGatewayConfigV2Update
+    >;
+    [TableName.GatewayV2]: KnexOriginal.CompositeTableType<TGatewaysV2, TGatewaysV2Insert, TGatewaysV2Update>;
     [TableName.UserNotifications]: KnexOriginal.CompositeTableType<
       TUserNotifications,
       TUserNotificationsInsert,

backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts

@@ -0,0 +1,150 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.InstanceRelayConfig))) {
+    await knex.schema.createTable(TableName.InstanceRelayConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+
+      // Root CA for relay PKI
+      t.binary("encryptedRootRelayPkiCaPrivateKey").notNullable();
+      t.binary("encryptedRootRelayPkiCaCertificate").notNullable();
+
+      // Instance CA for relay PKI
+      t.binary("encryptedInstanceRelayPkiCaPrivateKey").notNullable();
+      t.binary("encryptedInstanceRelayPkiCaCertificate").notNullable();
+      t.binary("encryptedInstanceRelayPkiCaCertificateChain").notNullable();
+
+      // Instance client/server intermediates for relay PKI
+      t.binary("encryptedInstanceRelayPkiClientCaPrivateKey").notNullable();
+      t.binary("encryptedInstanceRelayPkiClientCaCertificate").notNullable();
+      t.binary("encryptedInstanceRelayPkiClientCaCertificateChain").notNullable();
+      t.binary("encryptedInstanceRelayPkiServerCaPrivateKey").notNullable();
+      t.binary("encryptedInstanceRelayPkiServerCaCertificate").notNullable();
+      t.binary("encryptedInstanceRelayPkiServerCaCertificateChain").notNullable();
+
+      // Org Parent CAs for relay
+      t.binary("encryptedOrgRelayPkiCaPrivateKey").notNullable();
+      t.binary("encryptedOrgRelayPkiCaCertificate").notNullable();
+      t.binary("encryptedOrgRelayPkiCaCertificateChain").notNullable();
+
+      // Instance SSH CAs for relay
+      t.binary("encryptedInstanceRelaySshClientCaPrivateKey").notNullable();
+      t.binary("encryptedInstanceRelaySshClientCaPublicKey").notNullable();
+      t.binary("encryptedInstanceRelaySshServerCaPrivateKey").notNullable();
+      t.binary("encryptedInstanceRelaySshServerCaPublicKey").notNullable();
+    });
+
+    await createOnUpdateTrigger(knex, TableName.InstanceRelayConfig);
+  }
+
+  // Org-level relay configuration (one-to-one with organization)
+  if (!(await knex.schema.hasTable(TableName.OrgRelayConfig))) {
+    await knex.schema.createTable(TableName.OrgRelayConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+
+      // Org-scoped relay PKI (client + server)
+      t.binary("encryptedRelayPkiClientCaPrivateKey").notNullable();
+      t.binary("encryptedRelayPkiClientCaCertificate").notNullable();
+      t.binary("encryptedRelayPkiClientCaCertificateChain").notNullable();
+      t.binary("encryptedRelayPkiServerCaPrivateKey").notNullable();
+      t.binary("encryptedRelayPkiServerCaCertificate").notNullable();
+      t.binary("encryptedRelayPkiServerCaCertificateChain").notNullable();
+
+      // Org-scoped relay SSH (client + server)
+      t.binary("encryptedRelaySshClientCaPrivateKey").notNullable();
+      t.binary("encryptedRelaySshClientCaPublicKey").notNullable();
+      t.binary("encryptedRelaySshServerCaPrivateKey").notNullable();
+      t.binary("encryptedRelaySshServerCaPublicKey").notNullable();
+    });
+
+    await createOnUpdateTrigger(knex, TableName.OrgRelayConfig);
+  }
+
+  if (!(await knex.schema.hasTable(TableName.OrgGatewayConfigV2))) {
+    await knex.schema.createTable(TableName.OrgGatewayConfigV2, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("orgId").notNullable().unique();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.timestamps(true, true, true);
+      t.binary("encryptedRootGatewayCaPrivateKey").notNullable();
+      t.binary("encryptedRootGatewayCaCertificate").notNullable();
+      t.binary("encryptedGatewayServerCaPrivateKey").notNullable();
+      t.binary("encryptedGatewayServerCaCertificate").notNullable();
+      t.binary("encryptedGatewayServerCaCertificateChain").notNullable();
+      t.binary("encryptedGatewayClientCaPrivateKey").notNullable();
+      t.binary("encryptedGatewayClientCaCertificate").notNullable();
+      t.binary("encryptedGatewayClientCaCertificateChain").notNullable();
+    });
+
+    await createOnUpdateTrigger(knex, TableName.OrgGatewayConfigV2);
+  }
+
+  if (!(await knex.schema.hasTable(TableName.Relay))) {
+    await knex.schema.createTable(TableName.Relay, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+
+      t.uuid("orgId");
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+
+      t.uuid("identityId");
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+
+      t.string("name").notNullable();
+      t.string("host").notNullable();
+
+      t.unique(["orgId", "name"]);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.Relay);
+  }
+
+  if (!(await knex.schema.hasTable(TableName.GatewayV2))) {
+    await knex.schema.createTable(TableName.GatewayV2, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+
+      t.uuid("identityId").notNullable().unique();
+      t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
+
+      t.uuid("relayId");
+      t.foreign("relayId").references("id").inTable(TableName.Relay).onDelete("SET NULL");
+
+      t.string("name").notNullable();
+
+      t.unique(["orgId", "name"]);
+
+      t.dateTime("heartbeat");
+    });
+
+    await createOnUpdateTrigger(knex, TableName.GatewayV2);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await dropOnUpdateTrigger(knex, TableName.OrgRelayConfig);
+  await knex.schema.dropTableIfExists(TableName.OrgRelayConfig);
+
+  await dropOnUpdateTrigger(knex, TableName.InstanceRelayConfig);
+  await knex.schema.dropTableIfExists(TableName.InstanceRelayConfig);
+
+  await dropOnUpdateTrigger(knex, TableName.OrgGatewayConfigV2);
+  await knex.schema.dropTableIfExists(TableName.OrgGatewayConfigV2);
+
+  await dropOnUpdateTrigger(knex, TableName.GatewayV2);
+  await knex.schema.dropTableIfExists(TableName.GatewayV2);
+
+  await dropOnUpdateTrigger(knex, TableName.Relay);
+  await knex.schema.dropTableIfExists(TableName.Relay);
+}

backend/src/db/migrations/20250901091637_add-gateway-v2-id-columns.ts

@@ -0,0 +1,33 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn(TableName.DynamicSecret, "gatewayV2Id"))) {
+    await knex.schema.alterTable(TableName.DynamicSecret, (table) => {
+      table.uuid("gatewayV2Id");
+      table.foreign("gatewayV2Id").references("id").inTable(TableName.GatewayV2).onDelete("SET NULL");
+    });
+  }
+
+  if (!(await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "gatewayV2Id"))) {
+    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (table) => {
+      table.uuid("gatewayV2Id");
+      table.foreign("gatewayV2Id").references("id").inTable(TableName.GatewayV2).onDelete("SET NULL");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.DynamicSecret, "gatewayV2Id")) {
+    await knex.schema.alterTable(TableName.DynamicSecret, (table) => {
+      table.dropColumn("gatewayV2Id");
+    });
+  }
+
+  if (await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "gatewayV2Id")) {
+    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (table) => {
+      table.dropColumn("gatewayV2Id");
+    });
+  }
+}

backend/src/db/schemas/dynamic-secrets.ts

@@ -29,7 +29,8 @@ export const DynamicSecretsSchema = z.object({
   encryptedInput: zodBuffer,
   projectGatewayId: z.string().uuid().nullable().optional(),
   gatewayId: z.string().uuid().nullable().optional(),
-  usernameTemplate: z.string().nullable().optional()
+  usernameTemplate: z.string().nullable().optional(),
+  gatewayV2Id: z.string().uuid().nullable().optional()
 });
 
 export type TDynamicSecrets = z.infer<typeof DynamicSecretsSchema>;

backend/src/db/schemas/gateways-v2.ts

@@ -0,0 +1,23 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const GatewaysV2Schema = z.object({
+  id: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  orgId: z.string().uuid(),
+  identityId: z.string().uuid(),
+  relayId: z.string().uuid().nullable().optional(),
+  name: z.string(),
+  heartbeat: z.date().nullable().optional()
+});
+
+export type TGatewaysV2 = z.infer<typeof GatewaysV2Schema>;
+export type TGatewaysV2Insert = Omit<z.input<typeof GatewaysV2Schema>, TImmutableDBKeys>;
+export type TGatewaysV2Update = Partial<Omit<z.input<typeof GatewaysV2Schema>, TImmutableDBKeys>>;

backend/src/db/schemas/identity-kubernetes-auths.ts

@@ -32,7 +32,8 @@ export const IdentityKubernetesAuthsSchema = z.object({
   encryptedKubernetesCaCertificate: zodBuffer.nullable().optional(),
   gatewayId: z.string().uuid().nullable().optional(),
   accessTokenPeriod: z.coerce.number().default(0),
-  tokenReviewMode: z.string().default("api")
+  tokenReviewMode: z.string().default("api"),
+  gatewayV2Id: z.string().uuid().nullable().optional()
 });
 
 export type TIdentityKubernetesAuths = z.infer<typeof IdentityKubernetesAuthsSchema>;

backend/src/db/schemas/index.ts

@@ -31,6 +31,7 @@ export * from "./folder-commits";
 export * from "./folder-tree-checkpoint-resources";
 export * from "./folder-tree-checkpoints";
 export * from "./gateways";
+export * from "./gateways-v2";
 export * from "./git-app-install-sessions";
 export * from "./git-app-org";
 export * from "./github-org-sync-configs";
@@ -57,6 +58,7 @@ export * from "./identity-token-auths";
 export * from "./identity-ua-client-secrets";
 export * from "./identity-universal-auths";
 export * from "./incident-contacts";
+export * from "./instance-relay-config";
 export * from "./integration-auths";
 export * from "./integrations";
 export * from "./internal-certificate-authorities";
@@ -76,7 +78,9 @@ export * from "./models";
 export * from "./oidc-configs";
 export * from "./org-bots";
 export * from "./org-gateway-config";
+export * from "./org-gateway-config-v2";
 export * from "./org-memberships";
+export * from "./org-relay-config";
 export * from "./org-roles";
 export * from "./organizations";
 export * from "./pki-alerts";
@@ -97,6 +101,7 @@ export * from "./project-user-additional-privilege";
 export * from "./project-user-membership-roles";
 export * from "./projects";
 export * from "./rate-limit";
+export * from "./relays";
 export * from "./resource-metadata";
 export * from "./saml-configs";
 export * from "./scim-tokens";