[Example issue] Gateway fails to connect to the core service

> This is an example issue meant to demonstrate the preferred way of submitting issues in this repository.
> Please note that it does not describe a real problem or request. Its purpose is to serve as a reference for formatting and providing the necessary details when opening new issues.
>
> Following this structure helps us better understand, reproduce, and resolve problems quickly.
> You can find more information about our issue submission process [in the documentation](https://docs.defguard.net/1.5/support-1/how-to-submit-an-issue).

# Description

Defguard gateway fails to connect to the core service.

# Steps to reproduce

1. Run core service:

```
defguard --enrollment-url http://10.0.0.2
```

2. Run gateway service:

```
defguard-gateway --grpc-url http://localhost:50055 --token
```

# Expected behavior

Gateway should connect to core service and apply the configuration to network interfaces.

# Actual behavior

After attempted connection gateway disconnects with an error.

# Logs and screenshots

> If the logs you collected are short and easy to read, you can paste them directly into the GitHub issue using code blocks (```).
> If the logs are long or contain a lot of detail, please attach them as a separate file instead. This keeps the issue thread readable while still giving us all the information we need.

[core.log](https://github.com/user-attachments/files/22248886/core.log)
[gateway.log](https://github.com/user-attachments/files/22248891/gateway.log)

## Core service:

```
2025-09-08T08:07:49.571772Z INFO defguard: message=Starting ... version v1.5.0+937ad7e
2025-09-08T08:07:49.571815Z DEBUG defguard: message=Using config: DefGuardConfig { log_level: "debug", log_file: None, auth_cookie_timeout: Duration(604800s), secret_key: SecretBox([REDACTED]), database_host: "localhost", database_port: 5432, database_name: "defguard", database_user: "defguard", database_password: SecretBox([REDACTED]), http_port: 8000, grpc_port: 50055, grpc_cert: None, grpc_key: None, default_admin_password: SecretBox([REDACTED]), openid_signing_key: None, webauthn_rp_id: Some("localhost"), url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8000), path: "/", query: None, fragment: None }, grpc_url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(50055), path: "/", query: None, fragment: None }, disable_stats_purge: false, stats_purge_frequency: Duration(86400s), stats_purge_threshold: Duration(2592000s), enrollment_url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv4(10.0.2.2)), port: Some(8080), path: "/", query: None, fragment: None }, enrollment_token_timeout: Duration(86400s), mfa_code_timeout: Duration(60s), session_timeout: Duration(604800s), password_reset_token_timeout: Duration(86400s), enrollment_session_timeout: Duration(600s), password_reset_session_timeout: Duration(600s), cookie_domain: Some("localhost"), cookie_insecure: false, proxy_url: None, proxy_grpc_ca: None, cmd: None, check_period: Duration(43200s), check_period_no_license: Duration(86400s), check_period_renewal_window: Duration(3600s), http_bind_address: None, grpc_bind_address: None }
2025-09-08T08:07:49.572022Z INFO defguard_core::db: message=Initializing DB pool
2025-09-08T08:07:49.572561Z DEBUG sqlx_postgres::options::pgpass: message=`.pgpass` file not found path=/home/jck/.pgpass
2025-09-08T08:07:49.627439Z DEBUG sqlx::query: summary=SELECT current_database() db.statement= rows_affected=1 rows_returned=1 elapsed=713.288µs elapsed_secs=0.000713288
2025-09-08T08:07:49.627922Z DEBUG sqlx::query: summary=SELECT pg_advisory_lock($1) db.statement= rows_affected=1 rows_returned=1 elapsed=392.556µs elapsed_secs=0.000392556
2025-09-08T08:07:49.628222Z INFO sqlx::postgres::notice: message=relation "_sqlx_migrations" already exists, skipping
2025-09-08T08:07:49.628286Z DEBUG sqlx::query: summary=CREATE TABLE IF NOT … db.statement=\n\n\nCREATE TABLE IF NOT EXISTS _sqlx_migrations (\n version BIGINT PRIMARY KEY,\n description TEXT NOT NULL,\n installed_on TIMESTAMPTZ NOT NULL DEFAULT now(),\n success BOOLEAN NOT NULL,\n checksum BYTEA NOT NULL,\n execution_time BIGINT NOT NULL\n);\n
rows_affected=0 rows_returned=0 elapsed=309.761µs elapsed_secs=0.000309761
2025-09-08T08:07:49.629659Z DEBUG sqlx::query: summary=SELECT version FROM _sqlx_migrations … db.statement=\n\nSELECT version FROM _sqlx_migrations WHERE success = false ORDER BY version LIMIT 1
rows_affected=0 rows_returned=0 elapsed=1.322415ms elapsed_secs=0.001322415
2025-09-08T08:07:49.630580Z DEBUG sqlx::query: summary=SELECT version, checksum FROM … db.statement=\n\nSELECT version, checksum FROM _sqlx_migrations ORDER BY version
rows_affected=80 rows_returned=80 elapsed=870.324µs elapsed_secs=0.000870324
2025-09-08T08:07:49.630985Z DEBUG sqlx::query: summary=SELECT current_database() db.statement= rows_affected=1 rows_returned=1 elapsed=146.723µs elapsed_secs=0.000146723
2025-09-08T08:07:49.631508Z DEBUG sqlx::query: summary=SELECT pg_advisory_unlock($1) db.statement= rows_affected=1 rows_returned=1 elapsed=391.357µs elapsed_secs=0.000391357
2025-09-08T08:07:49.631585Z INFO defguard: message=Using HMAC OpenID signing key
2025-09-08T08:07:49.631792Z DEBUG defguard_core::db::models::user: message=Checking if some admin user already exists and creating one if not...
2025-09-08T08:07:49.633535Z DEBUG sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=852.25µs elapsed_secs=0.00085225
2025-09-08T08:07:49.634563Z DEBUG sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=4 rows_returned=4 elapsed=966.363µs elapsed_secs=0.000966363
2025-09-08T08:07:49.636383Z DEBUG sqlx::query: summary=SELECT u.id, u.username, u.password_hash, … db.statement=\n\n\n SELECT u.id, u.username, u.password_hash, u.last_name, u.first_name, u.email, u.phone, u.mfa_enabled, u.totp_enabled, u.email_mfa_enabled, u.totp_secret, u.email_mfa_secret, u.mfa_method "mfa_method: _", u.recovery_codes, u.is_active, u.openid_sub, from_ldap, ldap_pass_randomized, ldap_rdn, ldap_user_path FROM "user" u WHERE EXISTS (SELECT 1 FROM group_user gu LEFT JOIN "group" g ON gu.group_id = g.id WHERE is_admin = true AND user_id = u.id) AND u.is_active = true
rows_affected=1 rows_returned=1 elapsed=4.342116ms elapsed_secs=0.004342116
2025-09-08T08:07:49.636452Z DEBUG defguard_core::db::models::user: message=Admin users already exists, skipping creation of the default admin user
2025-09-08T08:07:49.636508Z INFO defguard_core::db::models::settings: message=Initializing default settings
2025-09-08T08:07:49.637343Z DEBUG sqlx::query: summary=UPDATE settings SET enrollment_welcome_email … db.statement=\n\nUPDATE settings SET enrollment_welcome_email = $1 WHERE enrollment_welcome_email IS NULL
rows_affected=0 rows_returned=0 elapsed=614.602µs elapsed_secs=0.000614602
2025-09-08T08:07:49.687623Z DEBUG sqlx::query: summary=UPDATE settings SET enrollment_welcome_message … db.statement=\n\nUPDATE settings SET enrollment_welcome_message = $1 WHERE enrollment_welcome_message IS NULL
rows_affected=0 rows_returned=0 elapsed=1.269417ms elapsed_secs=0.001269417
2025-09-08T08:07:49.688473Z DEBUG sqlx::query: summary=UPDATE settings SET enrollment_welcome_email_subject … db.statement=\n\nUPDATE settings SET enrollment_welcome_email_subject = $1 WHERE enrollment_welcome_email_subject IS NULL
rows_affected=0 rows_returned=0 elapsed=551.54µs elapsed_secs=0.00055154
2025-09-08T08:07:49.688536Z DEBUG defguard_core::db::models::settings: message=Initializing global settings struct
2025-09-08T08:07:49.690003Z DEBUG sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=743.261µs elapsed_secs=0.000743261
2025-09-08T08:07:49.691006Z DEBUG sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=891.342µs elapsed_secs=0.000891342
2025-09-08T08:07:49.691355Z DEBUG sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=219.087µs elapsed_secs=0.000219087
2025-09-08T08:07:49.691687Z DEBUG sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=2 rows_returned=2 elapsed=269.229µs elapsed_secs=0.000269229
2025-09-08T08:07:49.691945Z DEBUG sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=190.261µs elapsed_secs=0.000190261
2025-09-08T08:07:49.692249Z DEBUG sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=247.091µs elapsed_secs=0.000247091
2025-09-08T08:07:49.693284Z DEBUG sqlx::query: summary=SELECT openid_enabled, wireguard_enabled, webhooks_enabled, … db.statement=\n\nSELECT openid_enabled, wireguard_enabled, webhooks_enabled, worker_enabled, challenge_template, instance_name, main_logo_url, nav_logo_url, smtp_server, smtp_port, smtp_encryption "smtp_encryption: _", smtp_user, smtp_password "smtp_password?: SecretStringWrapper", smtp_sender, enrollment_vpn_step_optional, enrollment_welcome_message, enrollment_welcome_email, enrollment_welcome_email_subject, enrollment_use_welcome_message_as_email, uuid, ldap_url, ldap_bind_username, ldap_bind_password "ldap_bind_password?: SecretStringWrapper", ldap_group_search_base, ldap_user_search_base, ldap_user_obj_class, ldap_group_obj_class, ldap_username_attr, ldap_groupname_attr, ldap_group_member_attr, ldap_member_attr, openid_create_account, license, gateway_disconnect_notifications_enabled, ldap_use_starttls, ldap_tls_verify_cert, gateway_disconnect_notifications_inactivity_threshold, gateway_disconnect_notifications_reconnect_notification_enabled, ldap_sync_status "ldap_sync_status: SyncStatus", ldap_enabled, ldap_sync_enabled, ldap_is_authoritative, ldap_sync_interval, ldap_user_auxiliary_obj_classes, ldap_uses_ad, ldap_user_rdn_attr, ldap_sync_groups, openid_username_handling "openid_username_handling: OpenidUsernameHandling" FROM "settings" WHERE id = 1
rows_affected=1 rows_returned=1 elapsed=4.540296ms elapsed_secs=0.004540296
2025-09-08T08:07:49.693410Z DEBUG defguard_core::enterprise::limits: message=Updating device, user, and wireguard network counts.
2025-09-08T08:07:49.696268Z DEBUG sqlx::query: summary=SELECT (SELECT count(*) FROM … db.statement=\n\nSELECT (SELECT count(*) FROM "user") "users!", (SELECT count(*) FROM device WHERE device_type = 'user') "user_devices!", (SELECT count(*) FROM device WHERE device_type = 'network') "network_devices!",\n (SELECT count(*) FROM wireguard_network) "wireguard_networks!"\n
rows_affected=1 rows_returned=1 elapsed=2.650851ms elapsed_secs=0.002650851
2025-09-08T08:07:49.696380Z DEBUG defguard_core::enterprise::limits: message=Updated device, user, and wireguard network counts stored in memory, new counts: Counts { user: 1, user_device: 0, network_device: 0, wireguard_network: 1 }
2025-09-08T08:07:49.696412Z DEBUG defguard: message=Checking enterprise license status
2025-09-08T08:07:49.696458Z DEBUG defguard_core::enterprise::license: message=No license key found in the database
2025-09-08T08:07:49.696609Z INFO run_periodic_peer_disconnect: defguard_core::wireguard_peer_disconnect: message=Starting periodic disconnect of inactive devices in MFA-protected locations
2025-09-08T08:07:49.696644Z DEBUG run_periodic_peer_disconnect: defguard_core::wireguard_peer_disconnect: message=Starting periodic inactive device disconnect
2025-09-08T08:07:49.696796Z INFO run_periodic_stats_purge: defguard_core::wireguard_stats_purge: message=Starting periodic purge of stats older than 30days every 1day
2025-09-08T08:07:49.696831Z DEBUG run_periodic_stats_purge: defguard_core::wireguard_stats_purge: message=Checking if stats purge should be executed
2025-09-08T08:07:49.696858Z DEBUG run_periodic_stats_purge: defguard_core::db::models::wireguard_peer_stats: message=Checking time since last stats purge
2025-09-08T08:07:49.696964Z INFO run_periodic_license_check: defguard_core::enterprise::license: message=Starting periodic license renewal check every 12h
2025-09-08T08:07:49.696997Z DEBUG run_periodic_license_check: defguard_core::enterprise::license: message=Checking the license status...
2025-09-08T08:07:49.697038Z DEBUG run_periodic_license_check: defguard_core::enterprise::license: message=No license found, skipping license check
2025-09-08T08:07:49.697097Z DEBUG run_utility_thread: defguard_core::enterprise: message=Checking if enterprise features should be enabled
2025-09-08T08:07:49.697127Z DEBUG run_utility_thread: defguard_core::enterprise::limits: message=Checking if current object counts (Counts { user: 1, user_device: 0, network_device: 0, wireguard_network: 1 }) exceed default limits
2025-09-08T08:07:49.697157Z DEBUG run_utility_thread: defguard_core::enterprise: message=User is not over limit, allowing enterprise features
2025-09-08T08:07:49.697209Z DEBUG run_utility_thread:directory_sync_task: defguard_core::enterprise: message=Checking if enterprise features should be enabled
2025-09-08T08:07:49.697240Z DEBUG run_utility_thread:directory_sync_task: defguard_core::enterprise::limits: message=Checking if current object counts (Counts { user: 1, user_device: 0, network_device: 0, wireguard_network: 1 }) exceed default limits
2025-09-08T08:07:49.697271Z DEBUG run_utility_thread:directory_sync_task: defguard_core::enterprise: message=User is not over limit, allowing enterprise features
2025-09-08T08:07:49.697376Z INFO defguard_event_router: message=Starting main event router service
2025-09-08T08:07:49.697433Z INFO defguard_event_logger: message=Starting activity log event logger service
2025-09-08T08:07:49.697478Z INFO run_activity_log_stream_manager: defguard_core::enterprise::activity_log_stream::activity_log_stream_manager: message=Starting activity log stream manager
2025-09-08T08:07:49.697509Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise: message=Checking if enterprise features should be enabled
2025-09-08T08:07:49.697537Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise::limits: message=Checking if current object counts (Counts { user: 1, user_device: 0, network_device: 0, wireguard_network: 1 }) exceed default limits
2025-09-08T08:07:49.697566Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise: message=User is not over limit, allowing enterprise features
2025-09-08T08:07:49.697595Z INFO run_activity_log_stream_manager: defguard_core::enterprise::activity_log_stream::activity_log_stream_manager: message=Starting all configured activity log streams
2025-09-08T08:07:49.698259Z DEBUG run_grpc_server: os_info::imp::lsb_release: message=lsb_release command failed with Os { code: 2, kind: NotFound, message: "No such file or directory" } log.target=os_info::imp::lsb_release log.module_path=os_info::imp::lsb_release log.file=/home/jck/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/os_info-3.12.0/src/linux/lsb_release.rs log.line=76
2025-09-08T08:07:49.699904Z DEBUG run_grpc_server: defguard_core::grpc: message=Starting gRPC services
2025-09-08T08:07:49.703759Z DEBUG run_web_server: os_info::imp::lsb_release: message=lsb_release command failed with Os { code: 2, kind: NotFound, message: "No such file or directory" } log.target=os_info::imp::lsb_release log.module_path=os_info::imp::lsb_release log.file=/home/jck/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/os_info-3.12.0/src/linux/lsb_release.rs log.line=76
2025-09-08T08:07:49.711277Z INFO run_web_server: defguard_core: message=Started web services
2025-09-08T08:07:49.711582Z INFO run_mail_handler: defguard_core::mail: message=Starting mail sending service
2025-09-08T08:07:49.713411Z DEBUG run_periodic_stats_purge: sqlx::query: summary=SELECT MAX(started_at) FROM wireguard_stats_purge db.statement= rows_affected=1 rows_returned=1 elapsed=1.468255ms elapsed_secs=0.001468255
2025-09-08T08:07:49.713628Z DEBUG run_periodic_stats_purge: defguard_core::db::models::wireguard_peer_stats: message=Time since last stats purge: 39m 39s 703ms 676us 750ns
2025-09-08T08:07:49.713716Z DEBUG run_periodic_stats_purge: defguard_core::wireguard_stats_purge: message=Sleeping until next iteration
2025-09-08T08:07:49.765613Z DEBUG run_periodic_peer_disconnect: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=51.409188ms elapsed_secs=0.051409188
2025-09-08T08:07:49.815141Z DEBUG run_periodic_peer_disconnect: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=49.332655ms elapsed_secs=0.049332655
2025-09-08T08:07:49.815962Z DEBUG run_periodic_peer_disconnect: sqlx::query: summary=SELECT id, name, address, … db.statement=\n\nSELECT id, name, address, port, pubkey, prvkey, endpoint, dns, allowed_ips, connected_at, keepalive_interval, peer_disconnect_threshold, acl_enabled, acl_default_allow, location_mfa_mode "location_mfa_mode: LocationMfaMode" FROM wireguard_network WHERE location_mfa_mode != 'disabled'::location_mfa_mode
rows_affected=0 rows_returned=0 elapsed=104.193032ms elapsed_secs=0.104193032
2025-09-08T08:07:49.816091Z DEBUG run_periodic_peer_disconnect: defguard_core::wireguard_peer_disconnect: message=Sleeping until next iteration
2025-09-08T08:07:49.818129Z DEBUG run_utility_thread:directory_sync_task: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=1.300377ms elapsed_secs=0.001300377
2025-09-08T08:07:49.818361Z DEBUG run_activity_log_stream_manager: sqlx::query: summary=SELECT id, "name","stream_type" "stream_type: … db.statement=\n\nSELECT id, "name","stream_type" "stream_type: _","config" FROM "activity_log_stream"
rows_affected=0 rows_returned=0 elapsed=1.688285ms elapsed_secs=0.001688285
2025-09-08T08:07:49.818443Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise::activity_log_stream::activity_log_stream_manager: message=Found 0 configured activity log streams
2025-09-08T08:07:49.818492Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise: message=Checking if enterprise features should be enabled
2025-09-08T08:07:49.818522Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise::limits: message=Checking if current object counts (Counts { user: 1, user_device: 0, network_device: 0, wireguard_network: 1 }) exceed default limits
2025-09-08T08:07:49.818569Z DEBUG run_activity_log_stream_manager: defguard_core::enterprise: message=User is not over limit, allowing enterprise features
2025-09-08T08:07:49.819381Z DEBUG run_utility_thread:directory_sync_task: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=1.141628ms elapsed_secs=0.001141628
2025-09-08T08:07:49.819740Z DEBUG run_utility_thread:directory_sync_task: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=257.201µs elapsed_secs=0.000257201
2025-09-08T08:07:49.820047Z DEBUG run_utility_thread:directory_sync_task: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=217.939µs elapsed_secs=0.000217939
2025-09-08T08:07:49.820864Z DEBUG run_utility_thread:directory_sync_task: sqlx::query: summary=SELECT id, name, base_url, … db.statement=\n\nSELECT id, name, base_url, client_id, client_secret, display_name, google_service_account_key, google_service_account_email, admin_email, directory_sync_enabled, directory_sync_interval, directory_sync_user_behavior "directory_sync_user_behavior: DirectorySyncUserBehavior", directory_sync_admin_behavior "directory_sync_admin_behavior: DirectorySyncUserBehavior", directory_sync_target "directory_sync_target: DirectorySyncTarget", okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key FROM openidprovider LIMIT 1
rows_affected=0 rows_returned=0 elapsed=5.320146ms elapsed_secs=0.005320146
2025-09-08T08:07:49.820970Z DEBUG run_utility_thread:directory_sync_task: defguard_core::enterprise::directory_sync: message=Checking if directory sync is enabled
2025-09-08T08:07:49.821021Z DEBUG run_utility_thread:directory_sync_task: defguard_core::enterprise::directory_sync: message=No openid provider found, directory sync is disabled
2025-09-08T08:07:49.821052Z DEBUG run_utility_thread:directory_sync_task: defguard_core::enterprise::directory_sync: message=Directory sync is disabled, skipping performing directory sync
2025-09-08T08:07:49.821118Z DEBUG run_utility_thread:count_update_task: defguard_core::enterprise::limits: message=Updating device, user, and wireguard network counts.
2025-09-08T08:07:49.821661Z DEBUG run_utility_thread:count_update_task: sqlx::query: summary=SELECT (SELECT count(*) FROM … db.statement=\n\nSELECT (SELECT count(*) FROM "user") "users!", (SELECT count(*) FROM device WHERE device_type = 'user') "user_devices!", (SELECT count(*) FROM device WHERE device_type = 'network') "network_devices!",\n (SELECT count(*) FROM wireguard_network) "wireguard_networks!"\n
rows_affected=1 rows_returned=1 elapsed=251.425µs elapsed_secs=0.000251425
2025-09-08T08:07:49.821742Z DEBUG run_utility_thread:count_update_task: defguard_core::enterprise::limits: message=Updated device, user, and wireguard network counts stored in memory, new counts: Counts { user: 1, user_device: 0, network_device: 0, wireguard_network: 1 }
2025-09-08T08:07:49.821810Z DEBUG run_utility_thread:updates_check_task: defguard_core::updates: message=Checking for new version of Defguard.
2025-09-08T08:07:49.858931Z DEBUG run_utility_thread:updates_check_task: reqwest::connect: message=starting new connection: https://pkgs.defguard.net/ log.target=reqwest::connect log.module_path=reqwest::connect log.file=/home/jck/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.23/src/connect.rs log.line=882
2025-09-08T08:07:49.859612Z DEBUG run_utility_thread:updates_check_task: hyper_util::client::legacy::connect::http: message=connecting to 185.33.37.43:443
2025-09-08T08:07:49.897359Z DEBUG run_utility_thread:updates_check_task: hyper_util::client::legacy::connect::http: message=connected to 185.33.37.43:443
2025-09-08T08:07:50.122127Z DEBUG run_utility_thread:updates_check_task: hyper_util::client::legacy::pool: message=pooling idle connection for ("https", pkgs.defguard.net)
2025-09-08T08:07:50.122506Z DEBUG run_utility_thread:updates_check_task: defguard_core::updates: message=New version check done. You are using the latest version of Defguard.
2025-09-08T08:07:50.122623Z DEBUG run_utility_thread:ldap_sync_task: defguard_core::enterprise::ldap: message=Starting LDAP sync, if enabled
2025-09-08T08:07:50.122667Z DEBUG run_utility_thread:ldap_sync_task: defguard_core::enterprise::ldap: message=LDAP is disabled, not performing LDAP sync
2025-09-08T08:07:50.125338Z DEBUG run_utility_thread:expired_acl_rules_task: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=352.921µs elapsed_secs=0.000352921
2025-09-08T08:07:50.125847Z DEBUG run_utility_thread:expired_acl_rules_task: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=5 rows_returned=5 elapsed=382.945µs elapsed_secs=0.000382945
2025-09-08T08:07:50.126544Z DEBUG run_utility_thread:expired_acl_rules_task: sqlx::query: summary=UPDATE aclrule SET state … db.statement=\n\nUPDATE aclrule SET state = 'expired'::aclrule_state WHERE state = 'applied'::aclrule_state AND expires < NOW() RETURNING id, parent_id, state AS "state: RuleState", name, allow_all_users, deny_all_users, allow_all_network_devices, deny_all_network_devices, all_networks, destination, ports, protocols, enabled, expires
rows_affected=0 rows_returned=0 elapsed=3.147297ms elapsed_secs=0.003147297
2025-09-08T08:07:50.126654Z DEBUG run_utility_thread:expired_acl_rules_task: defguard_core::utility_thread: message=Marked 0 ACL rules as expired. Sending firewall config updates to affected locations.
2025-09-08T08:07:50.126697Z DEBUG run_utility_thread:expired_acl_rules_task: defguard_core::utility_thread: message=0 locations affected by expired ACL rules. Sending gateway firewall update events for each location
2025-09-08T08:07:55.128531Z DEBUG run_utility_thread: sqlx::query: summary=SELECT id, name, base_url, … db.statement=\n\nSELECT id, name, base_url, client_id, client_secret, display_name, google_service_account_key, google_service_account_email, admin_email, directory_sync_enabled, directory_sync_interval, directory_sync_user_behavior "directory_sync_user_behavior: DirectorySyncUserBehavior", directory_sync_admin_behavior "directory_sync_admin_behavior: DirectorySyncUserBehavior", directory_sync_target "directory_sync_target: DirectorySyncTarget", okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key FROM openidprovider LIMIT 1
rows_affected=0 rows_returned=0 elapsed=325.393µs elapsed_secs=0.000325393
2025-09-08T08:08:00.134621Z DEBUG run_utility_thread: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=1.345385ms elapsed_secs=0.001345385
2025-09-08T08:08:00.136409Z DEBUG run_utility_thread: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=1.377757ms elapsed_secs=0.001377757
2025-09-08T08:08:00.137987Z DEBUG run_utility_thread: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=1.178379ms elapsed_secs=0.001178379
2025-09-08T08:08:00.139663Z DEBUG run_utility_thread: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=1.234495ms elapsed_secs=0.001234495
2025-09-08T08:08:00.144342Z DEBUG run_utility_thread: sqlx::query: summary=SELECT id, name, base_url, … db.statement=\n\nSELECT id, name, base_url, client_id, client_secret, display_name, google_service_account_key, google_service_account_email, admin_email, directory_sync_enabled, directory_sync_interval, directory_sync_user_behavior "directory_sync_user_behavior: DirectorySyncUserBehavior", directory_sync_admin_behavior "directory_sync_admin_behavior: DirectorySyncUserBehavior", directory_sync_target "directory_sync_target: DirectorySyncTarget", okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key FROM openidprovider LIMIT 1
rows_affected=0 rows_returned=0 elapsed=13.040304ms elapsed_secs=0.013040304
2025-09-08T08:08:03.300075Z ERROR defguard_version::server::grpc: message=gateway version 1.4.1 is not supported. Minimal supported gateway version is 1.5.0. [1.5.0+937ad7e NixOS 25.11.0 x86_64]
2025-09-08T08:08:03.302012Z ERROR defguard_version::server::grpc: message=gateway version 1.4.1 is not supported. Minimal supported gateway version is 1.5.0. [1.5.0+937ad7e NixOS 25.11.0 x86_64]
2025-09-08T08:08:05.147400Z DEBUG run_utility_thread: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=264.368µs elapsed_secs=0.000264368
2025-09-08T08:08:05.147814Z DEBUG run_utility_thread: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=266.235µs elapsed_secs=0.000266235
2025-09-08T08:08:05.148139Z DEBUG run_utility_thread: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=209.944µs elapsed_secs=0.000209944
2025-09-08T08:08:05.148436Z DEBUG run_utility_thread: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=210.404µs elapsed_secs=0.000210404
2025-09-08T08:08:05.149293Z DEBUG run_utility_thread: sqlx::query: summary=SELECT id, name, base_url, … db.statement=\n\nSELECT id, name, base_url, client_id, client_secret, display_name, google_service_account_key, google_service_account_email, admin_email, directory_sync_enabled, directory_sync_interval, directory_sync_user_behavior "directory_sync_user_behavior: DirectorySyncUserBehavior", directory_sync_admin_behavior "directory_sync_admin_behavior: DirectorySyncUserBehavior", directory_sync_target "directory_sync_target: DirectorySyncTarget", okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key FROM openidprovider LIMIT 1
rows_affected=0 rows_returned=0 elapsed=2.72145ms elapsed_secs=0.00272145
2025-09-08T08:08:10.152361Z DEBUG run_utility_thread: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=973.025µs elapsed_secs=0.000973025
2025-09-08T08:08:10.153644Z DEBUG run_utility_thread: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=1.168621ms elapsed_secs=0.001168621
2025-09-08T08:08:10.153982Z DEBUG run_utility_thread: sqlx::query: summary=SELECT oid::regtype::text, typtype, typcategory, … db.statement=\n\nSELECT oid::regtype::text, typtype, typcategory, typrelid, typelem, typbasetype FROM pg_catalog.pg_type WHERE oid = $1
rows_affected=1 rows_returned=1 elapsed=241.34µs elapsed_secs=0.00024134
2025-09-08T08:08:10.154308Z DEBUG run_utility_thread: sqlx::query: summary=SELECT enumlabel FROM pg_catalog.pg_enum … db.statement=\n\n\nSELECT enumlabel\nFROM pg_catalog.pg_enum\nWHERE enumtypid = $1\nORDER BY enumsortorder\n
rows_affected=3 rows_returned=3 elapsed=239.404µs elapsed_secs=0.000239404
2025-09-08T08:08:10.155334Z DEBUG run_utility_thread: sqlx::query: summary=SELECT id, name, base_url, … db.statement=\n\nSELECT id, name, base_url, client_id, client_secret, display_name, google_service_account_key, google_service_account_email, admin_email, directory_sync_enabled, directory_sync_interval, directory_sync_user_behavior "directory_sync_user_behavior: DirectorySyncUserBehavior", directory_sync_admin_behavior "directory_sync_admin_behavior: DirectorySyncUserBehavior", directory_sync_target "directory_sync_target: DirectorySyncTarget", okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key FROM openidprovider LIMIT 1
rows_affected=0 rows_returned=0 elapsed=4.606649ms elapsed_secs=0.004606649
2025-09-08T08:08:13.304393Z ERROR defguard_version::server::grpc: message=gateway version 1.4.1 is not supported. Minimal supported gateway version is 1.5.0. [1.5.0+937ad7e NixOS 25.11.0 x86_64]
2025-09-08T08:08:13.306051Z ERROR defguard_version::server::grpc: message=gateway version 1.4.1 is not supported. Minimal supported gateway version is 1.5.0. [1.5.0+937ad7e NixOS 25.11.0 x86_64]
2025-09-08T08:08:15.158533Z DEBUG run_utility_thread: sqlx::query: summary=SELECT id, name, base_url, … db.statement=\n\nSELECT id, name, base_url, client_id, client_secret, display_name, google_service_account_key, google_service_account_email, admin_email, directory_sync_enabled, directory_sync_interval, directory_sync_user_behavior "directory_sync_user_behavior: DirectorySyncUserBehavior", directory_sync_admin_behavior "directory_sync_admin_behavior: DirectorySyncUserBehavior", directory_sync_target "directory_sync_target: DirectorySyncTarget", okta_private_jwk, okta_dirsync_client_id, directory_sync_group_match, jumpcloud_api_key FROM openidprovider LIMIT 1
rows_affected=0 rows_returned=0 elapsed=361.613µs elapsed_secs=0.000361613
```

## Gateway service

```
2025-09-08T08:00:20.634073Z DEBUG defguard_gateway::gateway: message=Preparing gRPC client configuration log.target=defguard_gateway::gateway log.module_path=defguard_gateway::gateway log.file=src/gateway.rs log.line=546
2025-09-08T08:00:20.650396Z DEBUG rustls::webpki::anchors: message=add_parsable_certificates processed 146 valid and 0 invalid certs log.target=rustls::webpki::anchors log.module_path=rustls::webpki::anchors log.file=/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.23.31/src/webpki/anchors.rs log.line=54
2025-09-08T08:00:20.650741Z DEBUG os_info::imp::lsb_release: message=lsb_release command failed with Os { code: 2, kind: NotFound, message: "No such file or directory" } log.target=os_info::imp::lsb_release log.module_path=os_info::imp::lsb_release log.file=/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/os_info-3.12.0/src/linux/lsb_release.rs log.line=76
2025-09-08T08:00:20.652221Z DEBUG defguard_gateway::gateway: message=gRPC client configuration done log.target=defguard_gateway::gateway log.module_path=defguard_gateway::gateway log.file=src/gateway.rs log.line=572
2025-09-08T08:00:20.652348Z INFO defguard_gateway::gateway: message=Starting Defguard gateway version 1.4.1 with configuration: Config { log_level: "debug", token: "***", name: None, grpc_url: "http://localhost:50055", userspace: false, grpc_ca: None, stats_period: 30, ifname: "wg0", pidfile: None, use_syslog: false, syslog_facility: "LOG_USER", syslog_socket: "/var/run/log", config_path: None, pre_up: None, post_up: None, pre_down: None, post_down: None, health_port: None, masquerade: false, fw_priority: None, disable_firewall_management: false, http_bind_address: None } log.target=defguard_gateway::gateway log.module_path=defguard_gateway::gateway log.file=/home/jck/workspace/work/teonite/defguard/gateway/src/gateway.rs log.line=689
2025-09-08T08:00:20.652455Z DEBUG defguard_wireguard_rs::wgapi_linux: message=Creating interface wg0 log.target=defguard_wireguard_rs::wgapi_linux log.module_path=defguard_wireguard_rs::wgapi_linux log.file=/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/defguard_wireguard_rs-0.7.6/src/wgapi_linux.rs log.line=16
2025-09-08T08:00:20.652581Z DEBUG defguard_wireguard_rs::wgapi_linux: message=Interface wg0 created successfully log.target=defguard_wireguard_rs::wgapi_linux log.module_path=defguard_wireguard_rs::wgapi_linux log.file=/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/defguard_wireguard_rs-0.7.6/src/wgapi_linux.rs log.line=18
2025-09-08T08:00:20.652608Z INFO defguard_gateway::gateway: message=Trying to connect to http://localhost:50055 and obtain the gateway configuration from Defguard. log.target=defguard_gateway::gateway log.module_path=defguard_gateway::gateway log.file=/home/jck/workspace/work/teonite/defguard/gateway/src/gateway.rs log.line=710
2025-09-08T08:00:20.652638Z DEBUG defguard_gateway::gateway: message=Connecting to Defguard gRPC endpoint: http://localhost:50055 log.target=defguard_gateway::gateway log.module_path=defguard_gateway::gateway log.file=/home/jck/workspace/work/teonite/defguard/gateway/src/gateway.rs log.line=485
2025-09-08T08:00:20.653636Z DEBUG hyper_util::client::legacy::connect::http: message=connecting to [::1]:50055
2025-09-08T08:00:20.653782Z DEBUG hyper_util::client::legacy::connect::http: message=connecting to 127.0.0.1:50055
2025-09-08T08:00:20.653924Z DEBUG hyper_util::client::legacy::connect::http: message=connected to 127.0.0.1:50055
2025-09-08T08:00:20.654104Z DEBUG tower::buffer::worker: service.ready=true message=processing request
2025-09-08T08:00:20.657098Z DEBUG tower::buffer::worker: service.ready=true message=processing request
2025-09-08T08:00:20.658613Z ERROR defguard_gateway::gateway: message=Couldn't retrieve gateway configuration from the core. Using gRPC URL: http://localhost:50055. Retrying in 10s. Error: status: 'The system is not in a state required for the operation's execution', self: "Version 1.4.1 not supported", metadata: {"content-type": "application/grpc", "date": "Mon, 08 Sep 2025 08:00:20 GMT"} log.target=defguard_gateway::gateway log.module_path=defguard_gateway::gateway log.file=/home/jck/workspace/work/teonite/defguard/gateway/src/gateway.rs log.line=527 [1.4.1 NixOS 25.11.0 x86_64]
2025-09-08T08:00:23.491257Z DEBUG tonic::transport::channel::service::connection: message=connection task error: hyper::Error(Io, Custom { kind: BrokenPipe, error: "connection closed because of a broken pipe" })
```