feat(dgw): make agent tunnel always available

[irvingouj@Devolutions (irvingoujAtDevolution)]

Promotes the QUIC agent tunnel to a supported, always-on Gateway capability.

Gateway now starts the listener on UDP 4433 and exposes enrollment and management APIs without unstable mode. The UDP port remains configurable. Startup fails if the tunnel CA cannot initialize or the listener cannot bind.

The stable endpoints are included in the Gateway OpenAPI contract and generated .NET and TypeScript clients.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[irvingouj@Devolutions (irvingoujAtDevolution)]

Implementation notes:

• Gateway always initializes the Agent Tunnel; AgentTunnel now contains only ListenPort, which defaults to UDP 4433 and rejects port 0.
• /jet/tunnel enrollment and management routes are mounted without __debug__.enable_unstable; their existing token and management-scope checks are unchanged.
• The stable routes, request and response models, and enrollment-token security scheme are published in the Gateway OpenAPI document and generated .NET and TypeScript clients.
• Tunnel CA initialization and UDP binding remain fail-fast, so a tunnel that cannot start prevents Gateway startup.
• The JSON schema, README, and PowerShell configuration module expose the same port-only contract.
• Testsuite-generated Gateway configurations allocate an ephemeral UDP port for each always-on tunnel to avoid parallel test collisions.

Validation:

• cargo +nightly fmt --all -- --check
• cargo clippy --workspace --tests -- -D warnings
• cargo test --workspace: 928 passed, 15 ignored
• Targeted real Gateway/Agent tunnel integration test passed
• Generated .NET and TypeScript/Angular OpenAPI clients built successfully
• PowerShell module build and port-only AgentTunnel validation passed
• CI was green before the OpenAPI follow-up; a new run will validate the pushed commit

Operational change: Gateway configurations can no longer disable Agent Tunnel. Remove any existing AgentTunnel.Enabled value because it no longer controls startup. Configure another ListenPort before upgrading when UDP 4433 is unavailable.

Note

Human-tuned, LLM-assisted content.

[Copilot]

Pull request overview

Enables the QUIC agent tunnel by default and promotes its configuration and APIs to stable Gateway functionality.

Changes:

• Defaults the tunnel listener to UDP 4433.
• Exposes tunnel APIs without unstable mode.
• Adds documentation, schema, PowerShell support, and tests.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents agent tunnel settings.
config_schema.json	Adds the tunnel configuration schema.
devolutions-gateway/src/api/mod.rs	Makes tunnel routes stable.
devolutions-gateway/src/config.rs	Enables the tunnel by default.
devolutions-gateway/tests/config.rs	Tests configuration defaults.
powershell/DevolutionsGateway/DevolutionsGateway.psd1	Exports the new PowerShell constructor.
powershell/DevolutionsGateway/Public/DGateway.ps1	Adds PowerShell tunnel configuration support.
powershell/pester/Config.Tests.ps1	Tests PowerShell configuration handling.
testsuite/src/dgw_config.rs	Disables the listener by default in test configurations.
testsuite/tests/cli/agent/tunnel.rs	Removes unstable-mode requirements.
testsuite/tests/cli/agent/up.rs	Removes unstable-mode requirements.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.