diff --git a/.golangci-comprehensive.yml b/.golangci-comprehensive.yml
index 7a3d74b97..76f5403cc 100644
--- a/.golangci-comprehensive.yml
+++ b/.golangci-comprehensive.yml
@@ -37,6 +37,8 @@ run:
     - dest_s3parquet
     - enrich_asn
     - enrich_locality
+    - capture
+    - dest_file
 
 formatters:
   enable:
diff --git a/.golangci-quick.yml b/.golangci-quick.yml
index 5f0f55d18..e130f29b3 100644
--- a/.golangci-quick.yml
+++ b/.golangci-quick.yml
@@ -31,6 +31,8 @@ run:
     - dest_s3parquet
     - enrich_asn
     - enrich_locality
+    - capture
+    - dest_file
 
 formatters:
   enable:
diff --git a/.golangci.yml b/.golangci.yml
index b38645ded..406c3131d 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -28,6 +28,8 @@ run:
     - dest_s3parquet
     - enrich_asn
     - enrich_locality
+    - capture
+    - dest_file
 
 formatters:
   enable:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d7302ef8..55aa9f232 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+### Breaking
+
+- **S3 uses TLS unless told otherwise.** A bare `host:port` S3 endpoint now uses TLS (it was plaintext), and `http://` is refused at startup (exit 64) unless `-s3AllowInsecure` / `S3_ALLOW_INSECURE=true`, which logs a warning and sets `xtcp2_s3_insecure 1`. TLS 1.2 is the minimum; `-s3CAFile` / `S3_CA_FILE` adds a private CA. `ConfigService.Set` refuses a plaintext endpoint without the opt-in.
+- **Credentials on the command line.** The production (slim) flavors refuse `-s3AccessKey`, `-s3SecretKey` and the four `-listener*` secret flags with exit 64; development builds warn, now for the S3 flags too and even when the env var is also set. Use the `_FILE` variables.
+- **`_FILE` secrets are checked.** A missing or unreadable `*_FILE` path, a non-regular file, or one readable by group or others stops startup with exit 64. It used to be ignored silently (listener tokens) or logged (S3 keys), leaving the credential empty. Mount secrets mode `0400`.
+- **The debug writers are build-time opt-ins.** The netlink capture writer (`-writeFiles` / `-capturePath`) is compiled in only with `-tags capture`, which no flavor or image sets; use `nix build .#xtcp2-capture`. The `file:` destination needs `-tags dest_file` and is in the full (development) flavor only, so `xtcp2-<dest>` slim flavors and their images no longer have it. Asking for either on a binary without it exits 64 at startup with the tag to rebuild with; `ConfigService.Set` refuses it with `FailedPrecondition`. A capture build reports `+capture` in its version line, and when armed logs a warning and sets `xtcp2_debug_capture_enabled 1`.
+
 ## 0.2.1 (2026-11)
 
 Fixes for what the first fleet rollout of 0.2.0 found: the link monitor baseline, the uplink columns, and container attribution. No schema, flag-default or `XtcpConfig` change; 0.2.0 clients and consumers work unchanged.
diff --git a/cmd/xtcp2/admin_auth_test.go b/cmd/xtcp2/admin_auth_test.go
index b272f52bd..c5dba20f9 100644
--- a/cmd/xtcp2/admin_auth_test.go
+++ b/cmd/xtcp2/admin_auth_test.go
@@ -65,6 +65,9 @@ func TestEnvOverrideAdminListenerAuth(t *testing.T) {
 				FailureJitterMax:       durationpb.New(7 * time.Millisecond),
 			}}
 			envOverrideListenerAuth(c, 0)
+			if err := applyListenerSecretFiles(c); err != nil {
+				t.Fatalf("applyListenerSecretFiles: %v", err)
+			}
 			a := c.GetAdminListenerAuth()
 			got := want{a.GetMode(), a.GetRawToken(), a.GetHmacSharedKey()}
 			if got != tc.expected {
diff --git a/cmd/xtcp2/exit.go b/cmd/xtcp2/exit.go
new file mode 100644
index 000000000..1bb94ddaf
--- /dev/null
+++ b/cmd/xtcp2/exit.go
@@ -0,0 +1,30 @@
+package main
+
+import (
+	"errors"
+
+	"github.com/randomizedcoder/xtcp2/pkg/xtcp"
+)
+
+// Process exit codes. Configuration the operator must change exits with
+// exitUsage (sysexits EX_USAGE), so a supervisor can tell "fix the command
+// line" from a runtime failure (exitFailure).
+const (
+	exitOK      = 0
+	exitFailure = 1
+	exitUsage   = 64
+)
+
+// exitCodeFor maps a startup error to a process exit code.
+func exitCodeFor(err error) int {
+	switch {
+	case err == nil:
+		return exitOK
+	case errors.Is(err, errUsage),
+		errors.Is(err, xtcp.ErrNotCompiledIn),
+		errors.Is(err, xtcp.ErrInsecureTransport):
+		return exitUsage
+	default:
+		return exitFailure
+	}
+}
diff --git a/cmd/xtcp2/exit_test.go b/cmd/xtcp2/exit_test.go
new file mode 100644
index 000000000..132595eb2
--- /dev/null
+++ b/cmd/xtcp2/exit_test.go
@@ -0,0 +1,107 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+	"github.com/randomizedcoder/xtcp2/pkg/xtcp"
+)
+
+func TestExitCodeFor(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		err         error
+		expected    int
+	}{
+		{"nil", "positive", "no error exits 0", nil, exitOK},
+		{"not_compiled_in", "negative", "a feature not in this build is a usage error",
+			xtcp.ErrNotCompiledIn, exitUsage},
+		{"wrapped_not_compiled_in", "boundary", "the sentinel is found through wrapping",
+			fmt.Errorf("-writeFiles 5: %w", xtcp.ErrNotCompiledIn), exitUsage},
+		{"other_error", "corner", "any other error is a plain failure",
+			errors.New("boom"), exitFailure},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := exitCodeFor(tc.err); got != tc.expected {
+				t.Errorf("%s: exit = %d, want %d", tc.description, got, tc.expected)
+			}
+		})
+	}
+}
+
+// TestRunMain_debugWritersNotCompiledIn drives the startup refusal of the
+// build-tag-gated debug writers. Each row's expectation follows what the test
+// binary was built with, so the table holds under every flavor leg: without
+// the tag the run is a usage error before the daemon starts; with it the
+// (stubbed) daemon runs.
+func TestRunMain_debugWritersNotCompiledIn(t *testing.T) {
+	fileIn := xtcp.CheckBuildSupport(&xtcp_config.XtcpConfig{Dest: "file:/x"}) == nil
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		args        []string
+		compiledIn  bool
+	}{
+		{"capture_not_compiled", "negative", "-writeFiles 5 needs -tags capture",
+			[]string{"-dest", "null", "-writeFiles", "5"}, xtcp.CaptureCompiledIn},
+		{"file_not_compiled", "negative", "-dest file: needs -tags dest_file",
+			[]string{"-dest", "file:" + filepath.Join(t.TempDir(), "out.jsonl"), "-marshal", "jsonl"}, fileIn},
+		{"writefiles_one", "boundary", "the smallest capture budget is refused too",
+			[]string{"-dest", "null", "-writeFiles", "1"}, xtcp.CaptureCompiledIn},
+		{"writefiles_zero_default", "corner", "-writeFiles 0 starts on every build",
+			[]string{"-dest", "null", "-writeFiles", "0"}, true},
+		{"stderr_dest", "positive", "the stderr destination needs no tag",
+			[]string{"-dest", "stderr", "-marshal", "jsonl"}, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			envHelperReset(t)
+			prevArgs := os.Args
+			os.Args = append([]string{"xtcp2"}, tc.args...)
+			t.Cleanup(func() { os.Args = prevArgs })
+
+			prevProm := promHandlerStarter
+			promHandlerStarter = func(context.Context, *sync.WaitGroup, promParams) error { return nil }
+			t.Cleanup(func() { promHandlerStarter = prevProm })
+
+			prevDaemon := daemonRunner
+			started := false
+			daemonRunner = func(context.Context, context.CancelFunc, *xtcp_config.XtcpConfig) { started = true }
+			t.Cleanup(func() { daemonRunner = prevDaemon })
+
+			wantRC, wantStarted := exitUsage, false
+			if tc.compiledIn {
+				wantRC, wantStarted = exitOK, true
+			}
+			captureLog(t, func() {
+				if rc := runMain(t.Context()); rc != wantRC {
+					t.Errorf("%s: rc = %d, want %d", tc.description, rc, wantRC)
+				}
+			})
+			if started != wantStarted {
+				t.Errorf("%s: daemon started = %v, want %v", tc.description, started, wantStarted)
+			}
+		})
+	}
+}
+
+// TestVersionString_captureSuffix: a binary carrying the capture writer says
+// so in its version line; every other binary does not.
+func TestVersionString_captureSuffix(t *testing.T) {
+	if got := strings.HasSuffix(versionString(), "+capture"); got != xtcp.CaptureCompiledIn {
+		t.Errorf("version %q: +capture suffix = %v, want %v", versionString(), got, xtcp.CaptureCompiledIn)
+	}
+}
diff --git a/cmd/xtcp2/secrets.go b/cmd/xtcp2/secrets.go
new file mode 100644
index 000000000..e27ae5988
--- /dev/null
+++ b/cmd/xtcp2/secrets.go
@@ -0,0 +1,157 @@
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+// flavorProduction is "true" in the production (slim) flavors, set at link
+// time by the Nix flavor matrix: -X main.flavorProduction=true. It is a
+// build-time property, not a flag, so a deployment cannot switch it off.
+var flavorProduction string
+
+// productionBuild reports whether this binary is a production flavor.
+func productionBuild() bool { return flavorProduction == "true" }
+
+// errUsage marks configuration the operator must change; exit 64.
+var errUsage = errors.New("usage")
+
+// secretFlag pairs a flag that carries a credential with the _FILE env var
+// that should carry it instead.
+type secretFlag struct {
+	flag    string
+	fileEnv string
+}
+
+// secretFlags is every flag whose value is a credential. A value given this
+// way is visible in ps, /proc/<pid>/cmdline and docker inspect.
+var secretFlags = []secretFlag{
+	{"s3AccessKey", "S3_ACCESS_KEY_FILE"},
+	{"s3SecretKey", "S3_SECRET_KEY_FILE"},
+	{"listenerRawToken", "LISTENER_RAW_TOKEN_FILE"},
+	{"listenerHMACSharedKey", "LISTENER_HMAC_SHARED_KEY_FILE"},
+	{"listenerAdminRawToken", "LISTENER_ADMIN_RAW_TOKEN_FILE"},
+	{"listenerAdminHMACSharedKey", "LISTENER_ADMIN_HMAC_SHARED_KEY_FILE"},
+}
+
+// checkSecretFlags looks at the flags actually given on the command line,
+// whatever the environment also says. A production build refuses a non-empty
+// credential flag; any other build warns once per flag.
+func checkSecretFlags(fs *flag.FlagSet, production bool) error {
+	byName := make(map[string]secretFlag, len(secretFlags))
+	for _, s := range secretFlags {
+		byName[s.flag] = s
+	}
+	var given []secretFlag
+	fs.Visit(func(f *flag.Flag) {
+		if s, ok := byName[f.Name]; ok && f.Value.String() != "" {
+			given = append(given, s)
+		}
+	})
+	for _, s := range given {
+		if production {
+			return fmt.Errorf("%w: -%s puts a secret on the command line, where ps, /proc/<pid>/cmdline and "+
+				"docker inspect show it, and this production build refuses it. Put the value in a file "+
+				"readable only by xtcp2 and set %s to its path", errUsage, s.flag, s.fileEnv)
+		}
+		log.Printf("WARNING: -%s puts a secret on the command line (visible in ps, /proc/<pid>/cmdline, "+
+			"docker inspect); set %s instead. Production builds refuse this.", s.flag, s.fileEnv)
+	}
+	return nil
+}
+
+// secretFileModeMask is the permission bits a secret file must not have:
+// any access for group or others.
+const secretFileModeMask = 0o077
+
+// readSecretFile reads a credential from the file a _FILE env var names. A
+// missing, unreadable, non-regular or group/world-accessible file is an
+// error: a credential the operator pointed at but xtcp2 cannot safely use
+// must stop startup, not leave the listener or upload unauthenticated.
+// Surrounding whitespace (a trailing newline) is trimmed.
+func readSecretFile(env, path string) (string, error) {
+	fi, err := os.Stat(path) // follows symlinks, as Kubernetes secret mounts need
+	if err != nil {
+		return "", fmt.Errorf("%w: %s=%q: %w", errUsage, env, path, err)
+	}
+	if !fi.Mode().IsRegular() {
+		return "", fmt.Errorf("%w: %s=%q is not a regular file", errUsage, env, path)
+	}
+	if perm := fi.Mode().Perm(); perm&secretFileModeMask != 0 {
+		return "", fmt.Errorf("%w: %s=%q has mode %04o; a secret file must not be accessible by group or "+
+			"others (chmod 0400; Kubernetes secret defaultMode: 0400)", errUsage, env, path, perm)
+	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("%w: %s=%q: %w", errUsage, env, path, err)
+	}
+	return strings.TrimSpace(string(b)), nil
+}
+
+// secretFileTarget is one _FILE env var and where its value goes.
+type secretFileTarget struct {
+	env string
+	set func(*xtcp_config.XtcpConfig, string)
+}
+
+func listenerAuth(c *xtcp_config.XtcpConfig) *xtcp_config.ListenerAuth {
+	if c.ListenerAuth == nil {
+		c.ListenerAuth = &xtcp_config.ListenerAuth{}
+	}
+	return c.ListenerAuth
+}
+
+func adminListenerAuth(c *xtcp_config.XtcpConfig) *xtcp_config.ListenerAuth {
+	if c.AdminListenerAuth == nil {
+		c.AdminListenerAuth = &xtcp_config.ListenerAuth{}
+	}
+	return c.AdminListenerAuth
+}
+
+var listenerSecretFiles = []secretFileTarget{
+	{"LISTENER_RAW_TOKEN_FILE", func(c *xtcp_config.XtcpConfig, v string) { listenerAuth(c).RawToken = v }},
+	{"LISTENER_HMAC_SHARED_KEY_FILE", func(c *xtcp_config.XtcpConfig, v string) { listenerAuth(c).HmacSharedKey = v }},
+	{"LISTENER_ADMIN_RAW_TOKEN_FILE", func(c *xtcp_config.XtcpConfig, v string) { adminListenerAuth(c).RawToken = v }},
+	{"LISTENER_ADMIN_HMAC_SHARED_KEY_FILE", func(c *xtcp_config.XtcpConfig, v string) { adminListenerAuth(c).HmacSharedKey = v }},
+}
+
+var s3SecretFiles = []secretFileTarget{
+	{"S3_ACCESS_KEY_FILE", func(c *xtcp_config.XtcpConfig, v string) { c.S3AccessKey = v }},
+	{"S3_SECRET_KEY_FILE", func(c *xtcp_config.XtcpConfig, v string) { c.S3SecretKey = v }},
+}
+
+// applySecretFileTargets reads each set _FILE env var into c. Applied after
+// the inline env overrides, so a file wins over the inline variable.
+func applySecretFileTargets(c *xtcp_config.XtcpConfig, targets []secretFileTarget) error {
+	for _, t := range targets {
+		path, ok := os.LookupEnv(t.env)
+		if !ok || path == "" {
+			continue
+		}
+		v, err := readSecretFile(t.env, path)
+		if err != nil {
+			return err
+		}
+		t.set(c, v)
+	}
+	return nil
+}
+
+// applyListenerSecretFiles reads the listener credential _FILE variables.
+func applyListenerSecretFiles(c *xtcp_config.XtcpConfig) error {
+	return applySecretFileTargets(c, listenerSecretFiles)
+}
+
+// applySecretFiles reads every credential _FILE variable into c.
+func applySecretFiles(c *xtcp_config.XtcpConfig) error {
+	if err := applySecretFileTargets(c, listenerSecretFiles); err != nil {
+		return err
+	}
+	return applySecretFileTargets(c, s3SecretFiles)
+}
diff --git a/cmd/xtcp2/secrets_test.go b/cmd/xtcp2/secrets_test.go
new file mode 100644
index 000000000..a06f5963a
--- /dev/null
+++ b/cmd/xtcp2/secrets_test.go
@@ -0,0 +1,186 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"flag"
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+// secretTestFlagSet registers the credential flags on a private FlagSet.
+func secretTestFlagSet(args ...string) (*flag.FlagSet, error) {
+	fs := flag.NewFlagSet("xtcp2", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	for _, s := range secretFlags {
+		fs.String(s.flag, "", "")
+	}
+	fs.String("dest", "null", "")
+	return fs, fs.Parse(args)
+}
+
+// TestCheckSecretFlags is Test FB's command-line half: a credential flag
+// warns on a development build and is refused, exit 64, on a production one.
+func TestCheckSecretFlags(t *testing.T) {
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		args        []string
+		env         map[string]string
+		production  bool
+		expected    string // "ok", "warn", "refuse"
+	}{
+		{"no_secret_flags", "positive", "no credential on the command line", []string{"-dest", "null"}, nil, true, "ok"},
+		{"dev_s3_secret_warns", "negative", "dev build warns for the S3 flags (silent before)", []string{"-s3SecretKey", "x"}, nil, false, "warn"},
+		{"prod_s3_secret_refused", "negative", "production refuses -s3SecretKey", []string{"-s3SecretKey", "x"}, nil, true, "refuse"},
+		{"prod_listener_token_refused", "negative", "production refuses a listener token flag", []string{"-listenerRawToken", "t"}, nil, true, "refuse"},
+		{"empty_value", "boundary", "an explicitly empty flag carries no secret", []string{"-s3AccessKey", ""}, nil, true, "ok"},
+		{"flag_and_env_both", "corner", "the env var being set too no longer hides the flag", []string{"-listenerRawToken", "t"},
+			map[string]string{"LISTENER_RAW_TOKEN": "t"}, false, "warn"},
+		{"env_only", "corner", "a credential from the environment alone is fine", nil,
+			map[string]string{"S3_SECRET_KEY": "x"}, true, "ok"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			for k, v := range tc.env {
+				t.Setenv(k, v)
+			}
+			fs, err := secretTestFlagSet(tc.args...)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var buf bytes.Buffer
+			prev := log.Writer()
+			log.SetOutput(&buf)
+			t.Cleanup(func() { log.SetOutput(prev) })
+
+			err = checkSecretFlags(fs, tc.production)
+			got := "ok"
+			switch {
+			case err != nil:
+				got = "refuse"
+			case strings.Contains(buf.String(), "WARNING"):
+				got = "warn"
+			}
+			if got != tc.expected {
+				t.Fatalf("%s: got %s, want %s (err %v, log %q)", tc.description, got, tc.expected, err, buf.String())
+			}
+			if err != nil {
+				if exitCodeFor(err) != exitUsage {
+					t.Errorf("%s: exit %d, want %d", tc.description, exitCodeFor(err), exitUsage)
+				}
+				if !strings.Contains(err.Error(), "_FILE") {
+					t.Errorf("%s: error does not name the _FILE variable: %v", tc.description, err)
+				}
+			}
+		})
+	}
+}
+
+// TestReadSecretFile covers the _FILE reader: trimmed contents on success,
+// and a usage error (fatal at startup) for a file it cannot safely use.
+func TestReadSecretFile(t *testing.T) {
+	dir := t.TempDir()
+	mk := func(name, body string, mode os.FileMode) string {
+		p := filepath.Join(dir, name)
+		if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Chmod(p, mode); err != nil {
+			t.Fatal(err)
+		}
+		return p
+	}
+	good := mk("good", "tok\n", 0o400)
+	link := filepath.Join(dir, "link")
+	if err := os.Symlink(good, link); err != nil {
+		t.Fatal(err)
+	}
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		path        string
+		expected    string // trimmed value, or "" with an error
+		wantErr     bool
+	}{
+		{"owner_only", "positive", "mode 0400 is read and trimmed", good, "tok", false},
+		{"owner_rw", "positive", "mode 0600 is fine", mk("rw", "  k  ", 0o600), "k", false},
+		{"secret_file_mode", "negative", "mode 0644 (world-readable) is refused", mk("wr", "k", 0o644), "", true},
+		{"group_readable", "boundary", "mode 0640: one group bit is enough to refuse", mk("gr", "k", 0o640), "", true},
+		{"secret_file_missing", "negative", "a missing file is fatal (was silent)", filepath.Join(dir, "nope"), "", true},
+		{"directory", "corner", "a directory is not a secret file", dir, "", true},
+		{"symlink", "corner", "a symlink to a 0400 file is followed (Kubernetes mounts)", link, "tok", false},
+		{"empty_file", "corner", "an empty 0400 file yields an empty value", mk("empty", "", 0o400), "", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			got, err := readSecretFile("TEST_FILE", tc.path)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("%s: err = %v, want error %v", tc.description, err, tc.wantErr)
+			}
+			if err != nil && !errors.Is(err, errUsage) {
+				t.Errorf("%s: error is not a usage error: %v", tc.description, err)
+			}
+			if got != tc.expected {
+				t.Errorf("%s: value = %q, want %q", tc.description, got, tc.expected)
+			}
+		})
+	}
+}
+
+// TestApplySecretFiles: a bad _FILE stops startup instead of leaving the
+// credential empty, and a good one wins over the inline variable.
+func TestApplySecretFiles(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "tok")
+	if err := os.WriteFile(good, []byte("from-file\n"), 0o400); err != nil {
+		t.Fatal(err)
+	}
+	bad := filepath.Join(dir, "open")
+	if err := os.WriteFile(bad, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(bad, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		env         map[string]string
+		expected    string // listener raw token after apply; "ERR" for an error
+	}{
+		{"file_wins", "positive", "the file replaces the inline value", map[string]string{"LISTENER_RAW_TOKEN_FILE": good}, "from-file"},
+		{"unset", "boundary", "no _FILE leaves the inline value", map[string]string{}, "inline"},
+		{"empty_path", "corner", "an empty _FILE value is ignored", map[string]string{"LISTENER_RAW_TOKEN_FILE": ""}, "inline"},
+		{"bad_mode", "negative", "a world-readable file stops startup", map[string]string{"LISTENER_RAW_TOKEN_FILE": bad}, "ERR"},
+		{"s3_missing", "negative", "a missing S3 key file stops startup", map[string]string{"S3_SECRET_KEY_FILE": filepath.Join(dir, "none")}, "ERR"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			for _, s := range append(listenerSecretFiles, s3SecretFiles...) {
+				t.Setenv(s.env, "")
+			}
+			for k, v := range tc.env {
+				t.Setenv(k, v)
+			}
+			c := &xtcp_config.XtcpConfig{ListenerAuth: &xtcp_config.ListenerAuth{RawToken: "inline"}}
+			err := applySecretFiles(c)
+			got := c.GetListenerAuth().GetRawToken()
+			if err != nil {
+				got = "ERR"
+			}
+			if got != tc.expected {
+				t.Errorf("%s: got %q (err %v), want %q", tc.description, got, err, tc.expected)
+			}
+		})
+	}
+}
diff --git a/cmd/xtcp2/testdata/defineflags-golden.txt b/cmd/xtcp2/testdata/defineflags-golden.txt
index 504359b64..360e36675 100644
--- a/cmd/xtcp2/testdata/defineflags-golden.txt
+++ b/cmd/xtcp2/testdata/defineflags-golden.txt
@@ -102,8 +102,10 @@ pyroscopeUrl		Pyroscope server URL (e.g. http://127.0.0.1:4040). Empty disables
 reconcileBeforePoll	true	Reconcile namespaces immediately before each poll cycle, so a newly-appeared namespace is entered within ~1 poll interval. Ties discovery cadence to poll cadence.
 reconcileFrequency	6h0m0s	Period of the background namespace-reconcile ticker (Method B /proc scan). With -reconcileBeforePoll carrying discovery this is a rare safety-net expected to find nothing (watch mapReconciler dels/stores in Prometheus); default is long (6h). 0 disables it (startup reconcile still runs once).
 resolveContainerId	false	resolve each socket's owning container id from its cgroup into container_id/container_runtime; needs /sys/fs/cgroup readable (mount it + --cgroupns=host in a container). Falls back to CONTAINER_ID_RESOLVE env.
-s3AccessKey		s3parquet: S3 access key. Falls back to S3_ACCESS_KEY env, or S3_ACCESS_KEY_FILE (path to a file holding the key). Never logged.
+s3AccessKey		s3parquet: S3 access key. Prefer S3_ACCESS_KEY_FILE (path to a file, mode 0400, holding the key): a flag value shows in ps and docker inspect, warns, and is refused by production builds. Never logged.
+s3AllowInsecure	false	s3parquet: allow a plaintext http:// endpoint. The credential and every object cross the network unencrypted; for local test fixtures only. A bare host:port and https:// use TLS. Falls back to S3_ALLOW_INSECURE env.
 s3Bucket		s3parquet: target bucket name. Falls back to S3_BUCKET env. Bucket must already exist; daemon does not auto-create.
+s3CAFile		s3parquet: PEM bundle of CA certificates to trust for the S3 endpoint, on top of the system roots. Falls back to S3_CA_FILE env.
 s3Endpoint		s3parquet: S3-compatible endpoint URL (e.g. http://127.0.0.1:9000 for MinIO). Falls back to S3_ENDPOINT env, or the address after `s3parquet:` in -dest. Required when -dest s3parquet:...
 s3FlushInterval	0s	s3parquet: staleness ceiling — force-flush the in-memory Parquet object after this long even if under the byte cap. 0 = derive as max(-frequency, 30m).
 s3FlushJitterPct	20	s3parquet: jitter as a percent (0-100) of -s3FlushInterval, applied to the timed flush so the fleet doesn't ceiling-flush in lockstep. 0 disables.
@@ -111,7 +113,7 @@ s3FlushThresholdJitterPct	20	s3parquet: per-object downward jitter as a percent
 s3ParquetFlushBytes	0	s3parquet: soft cap on the in-memory Parquet builder's uncompressed row bytes before finalize+upload. 0 = daemon default (63 MiB).
 s3Prefix		s3parquet: optional key prefix within the bucket. Combined with Hive-style partitioning host=…/date=…/hour=…/<file>.parquet.
 s3Region		s3parquet: S3 region. Defaults to 'us-east-1' when empty; required by AWS, ignored by most MinIO setups.
-s3SecretKey		s3parquet: S3 secret key. Falls back to S3_SECRET_KEY env, or S3_SECRET_KEY_FILE (path to a file holding the key). Never logged.
+s3SecretKey		s3parquet: S3 secret key. Prefer S3_SECRET_KEY_FILE (path to a file, mode 0400, holding the key): a flag value shows in ps and docker inspect, warns, and is refused by production builds. Never logged.
 s3SkipBucketProbe	false	s3parquet: skip the startup BucketExists probe (a HeadBucket needing s3:ListBucket). Set true for a write-only, s3:PutObject-only credential. Falls back to S3_SKIP_BUCKET_PROBE env.
 s3UploadBackoffCap	0s	s3parquet: cap on a single upload retry's backoff window (full jitter draws in [0,window]). 0 = derive as clamp(-frequency/10, 1s, 1h).
 s3UploadMaxAttempts	10	s3parquet: max upload attempts (original + retries) before dropping the object. Retries use full-jitter exponential backoff.
@@ -121,5 +123,5 @@ topic	xtcp	Kafka or NSQ topic
 uplinkCount	2	number of uplink slots to populate for LLDP/NIC enrichment (hosts are typically dual-homed = 2; max 2). Falls back to UPLINK_COUNT env.
 uplinkInterfaces		comma-separated explicit uplink interface names (e.g. "eth0,eth1") overriding default-route auto-detection for -enrichLldp/-enrichNic. Falls back to UPLINK_INTERFACES env.
 v	false	show version
-writeFiles	0	Write netlink packets to writeFiles number of files ( to generate test data ) per netlinker
+writeFiles	0	Write netlink packets to writeFiles number of files ( to generate test data ) per netlinker. Debugging only: needs a binary built with -tags capture
 xtcpProtoFile	/xtcp_flat_record.proto	xtcpProtoFile for registering with the schema registry
diff --git a/cmd/xtcp2/testdata/printflags-golden.txt b/cmd/xtcp2/testdata/printflags-golden.txt
index 343217b96..fda436cf9 100644
--- a/cmd/xtcp2/testdata/printflags-golden.txt
+++ b/cmd/xtcp2/testdata/printflags-golden.txt
@@ -19,6 +19,8 @@
 *s3Prefix: s3Prefix-v
 *s3Region: s3Region-v
 *s3SkipBucketProbe: true
+*s3AllowInsecure: true
+*s3CAFile: s3CAFile-v
 *s3ParquetFlushBytes: 113
 *pollJitterPct: 114
 *s3FlushInterval: 115ms
diff --git a/cmd/xtcp2/xtcp2.go b/cmd/xtcp2/xtcp2.go
index eb50a07fd..6ecaec731 100644
--- a/cmd/xtcp2/xtcp2.go
+++ b/cmd/xtcp2/xtcp2.go
@@ -275,6 +275,8 @@ type mainFlags struct {
 	s3SecretKey         *string
 	s3Region            *string
 	s3SkipBucketProbe   *bool
+	s3AllowInsecure     *bool
+	s3CAFile            *string
 	s3ParquetFlushBytes *uint
 
 	pollJitterPct             *uint
@@ -450,7 +452,7 @@ func defineFlags() *mainFlags {
 	// packetSize of the buffer the netlinkers syscall.Recvfrom to read into
 	f.packetSize = flag.Uint64("packetSize", packetSizeCst, "netlinker packetSize.  buffer size = packetSize * packetSizeMply. Use zero (0) for syscall.Getpagesize()")
 	f.packetSizeMply = flag.Uint("packetSizeMply", packetSizeMplyCst, "netlinker packetSize multiplier.  buffer size = packetSize * packetSizeMply")
-	f.writeFiles = flag.Uint("writeFiles", WriteFilesCst, "Write netlink packets to writeFiles number of files ( to generate test data ) per netlinker")
+	f.writeFiles = flag.Uint("writeFiles", WriteFilesCst, "Write netlink packets to writeFiles number of files ( to generate test data ) per netlinker. Debugging only: needs a binary built with -tags capture")
 	f.capturePath = flag.String("capturePath", capturePathCst, "Write files path")
 	f.modulus = flag.Uint64("modulus", modulusCst, "modulus. Report every X inetd messages to output")
 	f.marshal = flag.String("marshal", marshalCst, "Marshaling of the exported data (protobufList, protoJson, protoText, msgpack, jsonl, csv, tsv)")
@@ -497,10 +499,12 @@ func defineS3Flags(f *mainFlags) {
 	f.s3Endpoint = flag.String("s3Endpoint", s3EndpointCst, "s3parquet: S3-compatible endpoint URL (e.g. http://127.0.0.1:9000 for MinIO). Falls back to S3_ENDPOINT env, or the address after `s3parquet:` in -dest. Required when -dest s3parquet:...")
 	f.s3Bucket = flag.String("s3Bucket", s3BucketCst, "s3parquet: target bucket name. Falls back to S3_BUCKET env. Bucket must already exist; daemon does not auto-create.")
 	f.s3Prefix = flag.String("s3Prefix", s3PrefixCst, "s3parquet: optional key prefix within the bucket. Combined with Hive-style partitioning host=…/date=…/hour=…/<file>.parquet.")
-	f.s3AccessKey = flag.String("s3AccessKey", s3AccessKeyCst, "s3parquet: S3 access key. Falls back to S3_ACCESS_KEY env, or S3_ACCESS_KEY_FILE (path to a file holding the key). Never logged.")
-	f.s3SecretKey = flag.String("s3SecretKey", s3SecretKeyCst, "s3parquet: S3 secret key. Falls back to S3_SECRET_KEY env, or S3_SECRET_KEY_FILE (path to a file holding the key). Never logged.")
+	f.s3AccessKey = flag.String("s3AccessKey", s3AccessKeyCst, "s3parquet: S3 access key. Prefer S3_ACCESS_KEY_FILE (path to a file, mode 0400, holding the key): a flag value shows in ps and docker inspect, warns, and is refused by production builds. Never logged.")
+	f.s3SecretKey = flag.String("s3SecretKey", s3SecretKeyCst, "s3parquet: S3 secret key. Prefer S3_SECRET_KEY_FILE (path to a file, mode 0400, holding the key): a flag value shows in ps and docker inspect, warns, and is refused by production builds. Never logged.")
 	f.s3Region = flag.String("s3Region", s3RegionCst, "s3parquet: S3 region. Defaults to 'us-east-1' when empty; required by AWS, ignored by most MinIO setups.")
 	f.s3SkipBucketProbe = flag.Bool("s3SkipBucketProbe", s3SkipBucketProbeCst, "s3parquet: skip the startup BucketExists probe (a HeadBucket needing s3:ListBucket). Set true for a write-only, s3:PutObject-only credential. Falls back to S3_SKIP_BUCKET_PROBE env.")
+	f.s3AllowInsecure = flag.Bool("s3AllowInsecure", false, "s3parquet: allow a plaintext http:// endpoint. The credential and every object cross the network unencrypted; for local test fixtures only. A bare host:port and https:// use TLS. Falls back to S3_ALLOW_INSECURE env.")
+	f.s3CAFile = flag.String("s3CAFile", "", "s3parquet: PEM bundle of CA certificates to trust for the S3 endpoint, on top of the system roots. Falls back to S3_CA_FILE env.")
 	f.s3ParquetFlushBytes = flag.Uint("s3ParquetFlushBytes", s3ParquetFlushThresholdBytesCst, "s3parquet: soft cap on the in-memory Parquet builder's uncompressed row bytes before finalize+upload. 0 = daemon default (63 MiB).")
 	f.s3FlushInterval = flag.Duration("s3FlushInterval", s3FlushIntervalCst, "s3parquet: staleness ceiling — force-flush the in-memory Parquet object after this long even if under the byte cap. 0 = derive as max(-frequency, 30m).")
 	f.s3FlushJitterPct = flag.Uint("s3FlushJitterPct", s3FlushJitterPctCst, "s3parquet: jitter as a percent (0-100) of -s3FlushInterval, applied to the timed flush so the fleet doesn't ceiling-flush in lockstep. 0 disables.")
@@ -668,6 +672,8 @@ func printS3Flags(f *mainFlags) {
 	// they would leak via console logs, lifecycle test scrapers, etc.
 	fmt.Println("*s3Region:", *f.s3Region)
 	fmt.Println("*s3SkipBucketProbe:", *f.s3SkipBucketProbe)
+	fmt.Println("*s3AllowInsecure:", *f.s3AllowInsecure)
+	fmt.Println("*s3CAFile:", *f.s3CAFile)
 	fmt.Println("*s3ParquetFlushBytes:", *f.s3ParquetFlushBytes)
 	fmt.Println("*pollJitterPct:", *f.pollJitterPct)
 	fmt.Println("*s3FlushInterval:", *f.s3FlushInterval)
@@ -781,6 +787,8 @@ func buildConfig(f *mainFlags, des *xtcp_config.EnabledDeserializers) *xtcp_conf
 		S3SecretKey:                  *f.s3SecretKey,
 		S3Region:                     *f.s3Region,
 		S3SkipBucketProbe:            *f.s3SkipBucketProbe,
+		S3AllowInsecure:              *f.s3AllowInsecure,
+		S3CaFile:                     *f.s3CAFile,
 		S3ParquetFlushThresholdBytes: uint32(*f.s3ParquetFlushBytes),
 		PollJitterPct:                uint32(*f.pollJitterPct),
 		S3FlushInterval:              durationpb.New(*f.s3FlushInterval),
@@ -950,8 +958,17 @@ func startPyroscope(url, appName string, sampleHz, uploadSec uint, debugLevel ui
 // same package, called from tests) so the version-flag path is testable
 // without a subprocess.
 func versionString() string {
-	return fmt.Sprintf("xtcp commit:%s\tdate(UTC):%s\tversion:%s",
-		commit, date, version)
+	return fmt.Sprintf("xtcp commit:%s\tdate(UTC):%s\tversion:%s%s",
+		commit, date, version, buildSuffix())
+}
+
+// buildSuffix marks a binary that carries the netlink capture writer, so a
+// debug build is recognizable from its version line.
+func buildSuffix() string {
+	if xtcp.CaptureCompiledIn {
+		return "+capture"
+	}
+	return ""
 }
 
 // prepareConfig runs the env-override + validation portion of main() up
@@ -977,7 +994,6 @@ func prepareConfig(f *mainFlags) (*xtcp_config.XtcpConfig, bool) {
 		printConfig(c, "Before environmentOverrideConfig")
 	}
 	environmentOverrideConfig(c, debugLevel)
-	warnListenerAuthSecretSource(f)
 	if debugLevel > 100 {
 		printConfig(c, "After environmentOverrideConfig")
 	}
@@ -1019,6 +1035,48 @@ func finishMain(code int, reexec func(*xtcp_config.XtcpConfig)) int {
 	return code
 }
 
+// startupConfig builds the config the daemon runs: flags and env, the
+// _FILE secrets, the soft-restart carry, then the checks that refuse it
+// before anything binds or starts. A nil config means exit with the code.
+func startupConfig(f *mainFlags) (*xtcp_config.XtcpConfig, int) {
+	c, done := prepareConfig(f)
+	if done {
+		return nil, 0
+	}
+	if err := applySecretFiles(c); err != nil {
+		fmt.Fprintln(os.Stderr, "xtcp2:", err)
+		return nil, exitCodeFor(err)
+	}
+
+	// Soft-restart carry: if a prior ConfigService.Set re-exec'd us with a full
+	// config in the environment, that config wins over the flag/env-derived one.
+	// A malformed value is fatal — the restart intent is explicit, so silently
+	// falling back to the flag config would be surprising and wrong.
+	if envc, ok, err := loadReconfigureConfig(); err != nil {
+		fatalf("reconfigure: invalid %s: %v", reconfigureEnvKey, err)
+		return nil, 1
+	} else if ok {
+		c = envc
+		if debugLevel > 10 {
+			log.Printf("reconfigure: loaded config from %s (soft restart)", reconfigureEnvKey)
+		}
+	}
+
+	// Refuse a config that needs a debug writer this binary was built
+	// without (netlink capture, the file destination), before anything
+	// binds or starts. Checked after the soft-restart carry so that config
+	// is covered too.
+	if err := xtcp.CheckBuildSupport(c); err != nil {
+		fmt.Fprintln(os.Stderr, "xtcp2:", err)
+		return nil, exitCodeFor(err)
+	}
+	if err := xtcp.CheckS3Transport(c); err != nil {
+		fmt.Fprintln(os.Stderr, "xtcp2:", err)
+		return nil, exitCodeFor(err)
+	}
+	return c, 0
+}
+
 // runMain wires the production main body. Extracted so tests can run
 // it with stubbed daemonRunner / promHandlerStarter.
 func runMain(ctx context.Context) int {
@@ -1034,8 +1092,17 @@ func runMain(ctx context.Context) int {
 		fmt.Fprintln(os.Stderr, "xtcp2:", err)
 		return 2
 	}
+	if err := checkSecretFlags(flag.CommandLine, productionBuild()); err != nil {
+		fmt.Fprintln(os.Stderr, "xtcp2:", err)
+		return exitCodeFor(err)
+	}
 	healthAuth := buildListenerAuth(f)
-	envOverrideListenerAuth(&xtcp_config.XtcpConfig{ListenerAuth: healthAuth}, 0)
+	healthCfg := &xtcp_config.XtcpConfig{ListenerAuth: healthAuth}
+	envOverrideListenerAuth(healthCfg, 0)
+	if err := applyListenerSecretFiles(healthCfg); err != nil {
+		fmt.Fprintln(os.Stderr, "xtcp2:", err)
+		return exitCodeFor(err)
+	}
 
 	// Container HEALTHCHECK mode: probe the local /readyz and exit, without
 	// starting the daemon. The scratch image has no shell/curl, so the binary
@@ -1049,23 +1116,9 @@ func runMain(ctx context.Context) int {
 		return runHealthcheck(runCtx, *f.promListenNetwork, *f.promListen, authn, listenerauth.ClientAuth{RawToken: healthAuth.GetRawToken(), HMACSharedKey: healthAuth.GetHmacSharedKey()})
 	}
 
-	c, done := prepareConfig(f)
-	if done {
-		return 0
-	}
-
-	// Soft-restart carry: if a prior ConfigService.Set re-exec'd us with a full
-	// config in the environment, that config wins over the flag/env-derived one.
-	// A malformed value is fatal — the restart intent is explicit, so silently
-	// falling back to the flag config would be surprising and wrong.
-	if envc, ok, err := loadReconfigureConfig(); err != nil {
-		fatalf("reconfigure: invalid %s: %v", reconfigureEnvKey, err)
-		return 1
-	} else if ok {
-		c = envc
-		if debugLevel > 10 {
-			log.Printf("reconfigure: loaded config from %s (soft restart)", reconfigureEnvKey)
-		}
+	c, code := startupConfig(f)
+	if c == nil {
+		return code
 	}
 
 	environmentOverrideGoMaxProcs(f.goMaxProcs, debugLevel)
@@ -1568,8 +1621,9 @@ func envOverrideListenerAuth(c *xtcp_config.XtcpConfig, debugLevel uint) {
 	admin.FailureJitterMax = a.FailureJitterMax
 }
 
-// envOverrideAuthCredential applies <prefix>AUTH_MODE, <prefix>RAW_TOKEN[_FILE]
-// and <prefix>HMAC_SHARED_KEY[_FILE].
+// envOverrideAuthCredential applies <prefix>AUTH_MODE, <prefix>RAW_TOKEN and
+// <prefix>HMAC_SHARED_KEY. The _FILE forms are read afterwards by
+// applySecretFiles, which can fail startup on a bad file.
 func envOverrideAuthCredential(a *xtcp_config.ListenerAuth, prefix, what string, debugLevel uint) {
 	if v, ok := envString(prefix + "AUTH_MODE"); ok {
 		if mode, err := listenerauth.ParseMode(v); err == nil {
@@ -1577,50 +1631,16 @@ func envOverrideAuthCredential(a *xtcp_config.ListenerAuth, prefix, what string,
 			logEnv(prefix+"AUTH_MODE", what+" auth mode set", debugLevel)
 		}
 	}
-	if v, ok := secretEnv(prefix+"RAW_TOKEN", prefix+"RAW_TOKEN_FILE"); ok {
+	if v, ok := os.LookupEnv(prefix + "RAW_TOKEN"); ok {
 		a.RawToken = v
 		logEnv(prefix+"RAW_TOKEN", what+" raw token set", debugLevel)
 	}
-	if v, ok := secretEnv(prefix+"HMAC_SHARED_KEY", prefix+"HMAC_SHARED_KEY_FILE"); ok {
+	if v, ok := os.LookupEnv(prefix + "HMAC_SHARED_KEY"); ok {
 		a.HmacSharedKey = v
 		logEnv(prefix+"HMAC_SHARED_KEY", what+" HMAC key set", debugLevel)
 	}
 }
 
-func secretEnv(inlineKey, fileKey string) (string, bool) {
-	if path, ok := os.LookupEnv(fileKey); ok && path != "" {
-		b, err := os.ReadFile(path)
-		if err != nil {
-			return "", false
-		}
-		return strings.TrimSpace(string(b)), true
-	}
-	return os.LookupEnv(inlineKey)
-}
-
-func warnListenerAuthSecretSource(f *mainFlags) {
-	if *f.listenerRawToken != "" && !envSet("LISTENER_RAW_TOKEN", "LISTENER_RAW_TOKEN_FILE") {
-		log.Print("listener auth raw token came from CLI/config; prefer LISTENER_RAW_TOKEN or LISTENER_RAW_TOKEN_FILE")
-	}
-	if *f.listenerHMACKey != "" && !envSet("LISTENER_HMAC_SHARED_KEY", "LISTENER_HMAC_SHARED_KEY_FILE") {
-		log.Print("listener auth HMAC key came from CLI/config; prefer LISTENER_HMAC_SHARED_KEY or LISTENER_HMAC_SHARED_KEY_FILE")
-	}
-	if *f.listenerAdminToken != "" && !envSet("LISTENER_ADMIN_RAW_TOKEN", "LISTENER_ADMIN_RAW_TOKEN_FILE") {
-		log.Print("listener admin raw token came from CLI/config; prefer LISTENER_ADMIN_RAW_TOKEN or LISTENER_ADMIN_RAW_TOKEN_FILE")
-	}
-	if *f.listenerAdminHMAC != "" && !envSet("LISTENER_ADMIN_HMAC_SHARED_KEY", "LISTENER_ADMIN_HMAC_SHARED_KEY_FILE") {
-		log.Print("listener admin HMAC key came from CLI/config; prefer LISTENER_ADMIN_HMAC_SHARED_KEY or LISTENER_ADMIN_HMAC_SHARED_KEY_FILE")
-	}
-}
-
-func envSet(inlineKey, fileKey string) bool {
-	if v, ok := os.LookupEnv(fileKey); ok && v != "" {
-		return true
-	}
-	_, ok := os.LookupEnv(inlineKey)
-	return ok
-}
-
 // envUint64 parses an env var as base-10 int64 and yields it as uint64.
 // Returns ok=false when the var is unset or unparseable.
 func envUint64(key string) (uint64, bool) {
@@ -1724,31 +1744,6 @@ func splitCSV(s string) []string {
 	return out
 }
 
-// envStringFromFile reads a secret from the file whose path is the value of
-// the `key` env var (the Docker `_FILE` convention, e.g.
-// S3_SECRET_KEY_FILE=/run/secrets/s3). This keeps the secret out of the
-// process environment (visible via `docker inspect` / /proc/<pid>/environ)
-// and out of argv — the env only names a path, the bytes live in a file.
-//
-// The file contents are trimmed of surrounding whitespace (handles a trailing
-// newline from `echo`/`aws ssm get-parameter`). Returns ("", false) when the
-// env var is unset/empty, or when the named file can't be read — in the latter
-// case it logs a non-secret error so a misconfiguration is visible, and the
-// downstream destination fails fast on the resulting empty credential rather
-// than running half-configured. The file's contents are never logged.
-func envStringFromFile(key string) (string, bool) {
-	path, ok := os.LookupEnv(key)
-	if !ok || path == "" {
-		return "", false
-	}
-	b, err := os.ReadFile(path)
-	if err != nil {
-		log.Printf("key:%s error reading secret file: %v", key, err)
-		return "", false
-	}
-	return strings.TrimSpace(string(b)), true
-}
-
 func logEnv(key, msg string, debugLevel uint) {
 	if debugLevel > 10 {
 		log.Printf("key:%s, %s", key, msg)
@@ -1859,18 +1854,6 @@ func envOverrideMarshalAndDest(c *xtcp_config.XtcpConfig, debugLevel uint) {
 		c.S3SecretKey = v
 		logEnv("S3_SECRET_KEY", "set", debugLevel)
 	}
-	// File-based variants (Docker `_FILE` convention). Applied after the
-	// inline S3_ACCESS_KEY / S3_SECRET_KEY blocks so a mounted/baked secret
-	// file wins when both are set. The env var holds only the path; the
-	// credential bytes live in the file. Value is never logged.
-	if v, ok := envStringFromFile("S3_ACCESS_KEY_FILE"); ok {
-		c.S3AccessKey = v
-		logEnv("S3_ACCESS_KEY_FILE", "set", debugLevel)
-	}
-	if v, ok := envStringFromFile("S3_SECRET_KEY_FILE"); ok {
-		c.S3SecretKey = v
-		logEnv("S3_SECRET_KEY_FILE", "set", debugLevel)
-	}
 	if v, ok := envString("S3_REGION"); ok {
 		c.S3Region = v
 		logEnv("S3_REGION", fmt.Sprintf("c.S3Region:%s", v), debugLevel)
@@ -1879,6 +1862,14 @@ func envOverrideMarshalAndDest(c *xtcp_config.XtcpConfig, debugLevel uint) {
 		c.S3SkipBucketProbe = v
 		logEnv("S3_SKIP_BUCKET_PROBE", fmt.Sprintf("c.S3SkipBucketProbe:%t", v), debugLevel)
 	}
+	if v, ok := envBool("S3_ALLOW_INSECURE"); ok {
+		c.S3AllowInsecure = v
+		logEnv("S3_ALLOW_INSECURE", fmt.Sprintf("c.S3AllowInsecure:%t", v), debugLevel)
+	}
+	if v, ok := envString("S3_CA_FILE"); ok {
+		c.S3CaFile = v
+		logEnv("S3_CA_FILE", fmt.Sprintf("c.S3CaFile:%s", v), debugLevel)
+	}
 	if v, ok := envUint32("S3_PARQUET_FLUSH_BYTES"); ok {
 		c.S3ParquetFlushThresholdBytes = v
 		logEnv("S3_PARQUET_FLUSH_BYTES", fmt.Sprintf("c.S3ParquetFlushThresholdBytes:%d", v), debugLevel)
diff --git a/cmd/xtcp2/xtcp2_flags_helpers_test.go b/cmd/xtcp2/xtcp2_flags_helpers_test.go
index 17bb759cb..a2cd4182e 100644
--- a/cmd/xtcp2/xtcp2_flags_helpers_test.go
+++ b/cmd/xtcp2/xtcp2_flags_helpers_test.go
@@ -89,7 +89,7 @@ const (
 	// mainFlags field must be a registered flag and every registered flag must
 	// have a field. A flag added without a field, or a field that stops being
 	// registered, is the drift this file exists to notice.
-	mainFlagsFieldCountCst = 125
+	mainFlagsFieldCountCst = 127
 
 	printFlagsGoldenCst  = "testdata/printflags-golden.txt"
 	defineFlagsGoldenCst = "testdata/defineflags-golden.txt"
@@ -178,6 +178,8 @@ func populatedMainFlags() *mainFlags {
 		s3SecretKey:         s(fakeS3SigningSentinelCst),
 		s3Region:            s("s3Region-v"),
 		s3SkipBucketProbe:   b(true),
+		s3AllowInsecure:     b(true),
+		s3CAFile:            s("s3CAFile-v"),
 		s3ParquetFlushBytes: u(113),
 
 		pollJitterPct:             u(114),
diff --git a/cmd/xtcp2/xtcp2_test.go b/cmd/xtcp2/xtcp2_test.go
index bb23c07d6..5fa2fd36e 100644
--- a/cmd/xtcp2/xtcp2_test.go
+++ b/cmd/xtcp2/xtcp2_test.go
@@ -342,7 +342,7 @@ func TestEnvOverrideS3SecretFile(t *testing.T) {
 	accessPath := filepath.Join(dir, "access")
 	secretPath := filepath.Join(dir, "secret")
 	// Trailing newline is intentional — mimics `echo`/`aws ssm get-parameter`
-	// output; envStringFromFile must trim it.
+	// output; readSecretFile must trim it.
 	if err := os.WriteFile(accessPath, []byte("AKIAFROMFILE\n"), 0o400); err != nil {
 		t.Fatal(err)
 	}
@@ -357,6 +357,9 @@ func TestEnvOverrideS3SecretFile(t *testing.T) {
 	t.Setenv("S3_ACCESS_KEY_FILE", accessPath)
 	t.Setenv("S3_SECRET_KEY_FILE", secretPath)
 	envOverrideMarshalAndDest(c, 0)
+	if err := applySecretFiles(c); err != nil {
+		t.Fatalf("applySecretFiles: %v", err)
+	}
 	if c.S3AccessKey != "AKIAFROMFILE" {
 		t.Errorf("S3AccessKey = %q, want trimmed file contents", c.S3AccessKey)
 	}
@@ -365,19 +368,6 @@ func TestEnvOverrideS3SecretFile(t *testing.T) {
 	}
 }
 
-// TestEnvStringFromFileMissing: an unset env var, or a path that can't be
-// read, yields (_, false) and leaves config untouched (fail-fast downstream
-// rather than running with an empty credential silently overwriting a good one).
-func TestEnvStringFromFileMissing(t *testing.T) {
-	if v, ok := envStringFromFile("S3_SECRET_KEY_FILE_UNSET_FOR_TEST"); ok || v != "" {
-		t.Errorf("unset env: got (%q, %v), want (\"\", false)", v, ok)
-	}
-	t.Setenv("S3_SECRET_KEY_FILE_BADPATH", filepath.Join(t.TempDir(), "does-not-exist"))
-	if v, ok := envStringFromFile("S3_SECRET_KEY_FILE_BADPATH"); ok || v != "" {
-		t.Errorf("missing file: got (%q, %v), want (\"\", false)", v, ok)
-	}
-}
-
 func TestEnvOverrideKafka(t *testing.T) {
 	c := &xtcp_config.XtcpConfig{}
 	t.Setenv("TOPIC", "xtcp-test")
@@ -972,6 +962,8 @@ func TestPrintFlags(t *testing.T) {
 	f.s3SecretKey = &s
 	f.s3Region = &s
 	f.s3SkipBucketProbe = &b
+	f.s3AllowInsecure = &b
+	f.s3CAFile = &s
 	f.s3ParquetFlushBytes = &n
 	f.pollJitterPct = &n
 	f.s3FlushInterval = &d
@@ -1188,6 +1180,8 @@ func TestBuildConfig(t *testing.T) {
 		s3SecretKey:               &mar,
 		s3Region:                  &mar,
 		s3SkipBucketProbe:         &iu,
+		s3AllowInsecure:           &iu,
+		s3CAFile:                  &mar,
 		location:                  &mar,
 		hostname:                  &mar,
 		resolveContainerId:        &iu,
diff --git a/docs/build-flavors.md b/docs/build-flavors.md
index eb1864b72..686c1e8ca 100644
--- a/docs/build-flavors.md
+++ b/docs/build-flavors.md
@@ -6,7 +6,14 @@ xtcp2 binaries are built along three orthogonal axes, so you can produce anythin
 2. **Destination flavor** — which message-destination clients are compiled in: `full` / `min` / `kafka` / `nats` / `nsq` / `valkey` / `s3parquet` (`nix/versions.nix` → `destinationFlavors`).
 3. **Enrichment flavor** — whether the two heavyweight enrichers are compiled in: `none` / `asn` / `locality` / `enrich` (both) (`nix/versions.nix` → `enrichmentFlavors`).
 
-Stdlib destinations (`null`, `stdout`, `stderr`, `file`, `tcp`, `http`, `https`, `udp`, `unix`, `unixgram`) are **always** compiled regardless of flavor. Only the library destinations (`kafka`, `nats`, `nsq`, `valkey`, `s3parquet`) are gated, by `//go:build dest_<scheme>`.
+Stdlib destinations (`null`, `stdout`, `stderr`, `tcp`, `http`, `https`, `udp`, `unix`, `unixgram`) are **always** compiled regardless of flavor. The library destinations (`kafka`, `nats`, `nsq`, `valkey`, `s3parquet`) are gated, by `//go:build dest_<scheme>`.
+
+Two **debug writers** are gated too, because they write to the filesystem wherever configuration points them:
+
+- **`file:` destination** (`//go:build dest_file`): compiled into the full (development) flavor only — `xtcp2`, `xtcp2-full-*` and the fat images. No slim flavor or slim image has it.
+- **Netlink capture writer** (`-writeFiles` / `-capturePath`, `//go:build capture`): writes raw netlink replies, which hold every socket's addresses, to disk. No flavor or image carries it; build `nix build .#xtcp2-capture` (the development build plus `capture`) when you need fixtures. A capture build says so in its version line (`version:…+capture`), and when armed it logs a warning and sets `xtcp2_debug_capture_enabled 1`.
+
+Asking a binary for a debug writer it lacks (`-writeFiles 1`, `-dest file:…`) exits with status 64 before anything starts, naming the tag to rebuild with; `ConfigService.Set` refuses the same config with `FailedPrecondition`. `nix flake check` runs `flavor-tags`, which fails if a slim flavor carries either tag.
 
 Likewise, most metadata enrichers (container, LLDP, NIC, nsid) are **always** compiled and merely toggled at runtime — each is pure Go with no third-party dependency, so carrying them costs nothing. Only **ASN** and **locality** are build-tag gated, by `//go:build enrich_asn` / `//go:build enrich_locality`: `pkg/ipasn` pulls in `parquet-go` and `gaissmai/bart`, and `pkg/localnet` pulls in `bart`. Left unconditional they would land in `xtcp2-min`, whose entire purpose is to be the stdlib-only slim daemon.
 
@@ -241,7 +248,9 @@ The absent ones are published as `0` deliberately: a binary built without the ta
 
 | File | Build tag | Compiled in |
 |---|---|---|
-| `destinations_core.go`, `destinations_null.go`, `destinations_udp.go`, `destinations_unix.go`, `destinations_unixgram.go` | (none) | always |
+| `destinations_core.go`, `destinations_null.go`, `destinations_stderr.go`, `destinations_udp.go`, `destinations_unix.go`, `destinations_unixgram.go` | (none) | always |
+| `destinations_file.go` | `//go:build dest_file` | only with `-tags dest_file` (full flavor) |
+| `netlinker_capture.go` / `netlinker_nocapture.go` | `//go:build capture` / `!capture` | the capture writer, or its no-op stub |
 | `destinations_kafka.go` | `//go:build dest_kafka` | only with `-tags dest_kafka` |
 | `destinations_nats.go` | `//go:build dest_nats` | only with `-tags dest_nats` |
 | `destinations_nsq.go` | `//go:build dest_nsq` | only with `-tags dest_nsq` |
diff --git a/docs/integration-testing.md b/docs/integration-testing.md
index 77cde66fe..3764c5539 100644
--- a/docs/integration-testing.md
+++ b/docs/integration-testing.md
@@ -265,7 +265,7 @@ In the microvms, xtcp2 runs as a NixOS systemd service (`xtcp2.service`, defined
 | minimal / soak / tcp-stress / coverage | `null` | No downstream; the point is the netlink readout (minimal also writes a `file:` dest for the `OUTPUT_CONTENT` check) |
 | clickhouse-pipeline / -stress / -rate | `kafka:localhost:19092` | Real Kafka → ClickHouse destination (rate disables poll jitter via `-pollJitterPct 0`) |
 | clickhouse-http | `http://localhost:18123/?query=INSERT+INTO+xtcp.xtcp_flat_records+FORMAT+ProtobufList&format_schema=…&password=…` | Direct HTTP→ClickHouse ProtobufList insert (no Kafka); the daemon POSTs the batch to the verbatim URL |
-| s3parquet / -long / -stress / -lowfreq | `s3parquet:http://127.0.0.1:9000` | In-VM Garage (S3 API on :9000); parquet upload path |
+| s3parquet / -long / -stress / -lowfreq | `s3parquet:http://127.0.0.1:9000` + `-s3AllowInsecure` | In-VM Garage (plaintext S3 API on :9000); parquet upload path |
 | valkey / nats / nsq | `valkey:127.0.0.1:6379` / `nats:127.0.0.1:4222` / `nsq:127.0.0.1:4150` | Native in-VM broker; `-topic xtcp2-records`, `-marshal protobufList` |
 | tcp-sink / udp-sink / unix-sink / unixgram-sink | `tcp:localhost:13001` / `udp:localhost:13001` / `unix:/run/xtcp2-sink.sock` / `unixgram:/run/xtcp2-sink.sock` | Raw socket → an in-VM `ncat`/`socat` receiver |
 
diff --git a/docs/netlink/collection.md b/docs/netlink/collection.md
index 18eb5dfbc..846e13a0d 100644
--- a/docs/netlink/collection.md
+++ b/docs/netlink/collection.md
@@ -252,7 +252,7 @@ Netlink dump replies can be large, so the receive buffer is tunable. The buffer
 | `-packetSizeMply` | — | Buffer multiplier; buffer = `packetSize × packetSizeMply`. |
 | `-nlmsgSeq` | — | Starting netlink message sequence number (uint32). |
 | `-modulus` | — | Report every Nth inet_diag message to output (sampling/debug). |
-| `-writeFiles` / `-capturePath` | — | Dump raw netlink packets to files for generating test data. |
+| `-writeFiles` / `-capturePath` | `0` / `./` | Dump raw netlink packets to files for generating test data. Debugging only: compiled in only with `-tags capture` (`nix build .#xtcp2-capture`); other builds refuse `-writeFiles > 0` with exit 64. The files hold every socket's addresses. |
 
 ## See also
 
diff --git a/docs/output-and-destinations.md b/docs/output-and-destinations.md
index b17983f67..9103680b6 100644
--- a/docs/output-and-destinations.md
+++ b/docs/output-and-destinations.md
@@ -50,8 +50,8 @@ The `protobufList` format is the production wire format: it frames each Envelope
 | `valkey` | `valkey:valkey:6379` | `dest_valkey` | `destinations_valkey.go` |
 | `s3parquet` | `s3parquet:...` | `dest_s3parquet` | `destinations_s3parquet.go` |
 | `stdout` | `stdout` | *(always built)* | `destinations_stdout.go` |
-| `stderr` | `stderr` | *(always built)* | `destinations_file.go` |
-| `file` | `file:/var/log/xtcp.jsonl` | *(always built)* | `destinations_file.go` |
+| `stderr` | `stderr` | *(always built)* | `destinations_stderr.go` |
+| `file` | `file:/var/log/xtcp.jsonl` | `dest_file` (full flavor only) | `destinations_file.go` |
 | `tcp` | `tcp:127.0.0.1:9000` | *(always built)* | `destinations_tcp.go` |
 | `http` / `https` | `http://host:8080/ingest` | *(always built)* | `destinations_http.go` |
 | `udp` | `udp:127.0.0.1:13000` | *(always built)* | `destinations_udp.go` |
@@ -59,7 +59,7 @@ The `protobufList` format is the production wire format: it frames each Envelope
 | `unixgram` | `unixgram:/tmp/xtcp.sock` | *(always built)* | `destinations_unixgram.go` |
 | `null` | `null` | *(always built)* | `destinations_null.go` |
 
-The stdlib destinations (`stdout`, `stderr`, `file`, `tcp`, `http`/`https`, `udp`, `unix`, `unixgram`, `null`) are always compiled in; the library-backed ones (`kafka`, `nats`, `nsq`, `valkey`, `s3parquet`) are only present when their build tag is set. `null` discards output and is handy for benchmarking the collection path in isolation.
+The stdlib destinations (`stdout`, `stderr`, `tcp`, `http`/`https`, `udp`, `unix`, `unixgram`, `null`) are always compiled in; the library-backed ones (`kafka`, `nats`, `nsq`, `valkey`, `s3parquet`) are only present when their build tag is set. `file` is a debug writer: it is in the full (development) flavor only, behind `dest_file`, so production flavors cannot be configured to write records to disk. `null` discards output and is handy for benchmarking the collection path in isolation.
 
 Notes on the stream sinks:
 
@@ -101,6 +101,7 @@ These exercise the analysis-friendly formats and sinks. xtcp2 needs `CAP_NET_ADM
 sudo ./result/bin/xtcp2 -dest stdout -marshal jsonl -d 1 | jq .
 
 # CSV of just the columns you care about, into a file → open in DuckDB/R
+# (file: needs the full flavor, e.g. `nix build .#xtcp2`)
 sudo ./result/bin/xtcp2 -dest file:/tmp/socks.csv -marshal csv -d 1 \
   -columns hostname,inetDiagMsgSocketSource,inetDiagMsgSocketSourcePort,inetDiagMsgState,inetDiagCongEnum,tcpInfoRtt
 duckdb -c "select inetDiagMsgState, count(*) from '/tmp/socks.csv' group by 1"
@@ -146,11 +147,13 @@ docker logs xtcp2            # header + humanized rows
 | `-resolveContainerId` | `false` | Resolve each socket's owning container id/runtime from its cgroup into `container_id`/`container_runtime` (`CONTAINER_ID_RESOLVE`). Needs `/sys/fs/cgroup` (mount it + `--cgroupns=host` in a container). |
 | `-ipv4Ttl` | `3` | Outgoing IPv4 TTL on xtcp2's TCP listeners (Prometheus + gRPC); `0` = kernel default. The low default keeps replies from travelling far if the host is internet-exposed; raise it for a scraper more than two routers away (`IPV4_TTL`). |
 | `-ipv6HopLimit` | `3` | Outgoing IPv6 unicast hop limit on xtcp2's TCP listeners; `0` = kernel default (`IPV6_HOP_LIMIT`). |
-| `-s3Endpoint` | — | S3 endpoint URL (or `S3_ENDPOINT`). |
+| `-s3Endpoint` | — | S3 endpoint (or `S3_ENDPOINT`). `https://host[:port]` and a bare `host[:port]` use TLS; `http://` is refused unless `-s3AllowInsecure`. |
 | `-s3Bucket` | — | S3 bucket (or `S3_BUCKET`); must already exist. |
 | `-s3Prefix` | — | Key prefix within the bucket. |
-| `-s3AccessKey` / `-s3SecretKey` | — | S3 credentials (or `S3_ACCESS_KEY` / `S3_SECRET_KEY`); never logged. |
+| `-s3AccessKey` / `-s3SecretKey` | — | S3 credentials; never logged. Use `S3_ACCESS_KEY_FILE` / `S3_SECRET_KEY_FILE` (a mode `0400` file); the flags are refused by production flavors and warn elsewhere. See [security](security.md#secret-handling-and-rotation). |
 | `-s3Region` | `us-east-1` | S3 region. |
+| `-s3AllowInsecure` | `false` | Allow a plaintext `http://` endpoint (`S3_ALLOW_INSECURE`): the credential and every object cross the network unencrypted. For local test fixtures; sets `xtcp2_s3_insecure 1`. |
+| `-s3CAFile` | — | PEM CA bundle trusted for the endpoint on top of the system roots (`S3_CA_FILE`). TLS 1.2 is the minimum. |
 | `-s3SkipBucketProbe` | `false` | Skip the startup `BucketExists` probe (a `HeadBucket` needing `s3:ListBucket`; or `S3_SKIP_BUCKET_PROBE`). Set for a write-only `s3:PutObject`-only credential. |
 | `-s3ParquetFlushBytes` | `0` → 63 MiB | Parquet builder flush threshold (uncompressed). |
 | `-destWriteFiles` | — | Also write marshalled output to N files (debugging). |
diff --git a/docs/security.md b/docs/security.md
index 13d6369af..c12700c52 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -241,11 +241,20 @@ to your operational policy without logging bearer values.
 | Admin HMAC key | `-listenerAdminAuthMode hmac-utc-minute` / `LISTENER_ADMIN_AUTH_MODE=hmac-utc-minute` | `LISTENER_ADMIN_HMAC_SHARED_KEY_FILE` |
 
 Direct environment values omit `_FILE`. CLI secret flags are `-listenerRawToken`,
-`-listenerAdminRawToken`, `-listenerHMACSharedKey`, and
-`-listenerAdminHMACSharedKey`. Prefer files to avoid secrets in argv, shell history,
-deployment manifests, or inline environment inspection. Provision independent,
-high-entropy values with restrictive ownership/modes through your secret manager;
-the loader does not generate or assess their entropy. File contents are trimmed.
+`-listenerAdminRawToken`, `-listenerHMACSharedKey`, `-listenerAdminHMACSharedKey`,
+`-s3AccessKey` and `-s3SecretKey`. A value on the command line is visible in `ps`,
+`/proc/<pid>/cmdline` and `docker inspect`, so the production (slim) flavors refuse
+these flags with exit 64, and development builds log a warning naming the `_FILE`
+variable to use instead. Use the `_FILE` form. Provision independent, high-entropy
+values through your secret manager; the loader does not generate or assess their
+entropy. File contents are trimmed.
+
+A `_FILE` path is checked before it is used: a missing or unreadable path, a
+non-regular file, or a file with any permission bit for group or others (for
+example `0644`, or `0444` from a Nix store path) stops startup with exit 64
+rather than leaving the credential empty. Mount secrets mode `0400` (Kubernetes:
+`defaultMode: 0400`; Compose: a host file with mode `0400`). Symlinks are
+followed, so Kubernetes secret volumes work.
 Do not put literal secrets into Nix expressions or derivations that enter the store.
 
 `-listenerSignedSkewMinutes` / `LISTENER_SIGNED_SKEW_MINUTES` and
diff --git a/gen/cpp/xtcp_config/v1/xtcp_config.pb.cc b/gen/cpp/xtcp_config/v1/xtcp_config.pb.cc
index 011e31f86..8082851e1 100644
--- a/gen/cpp/xtcp_config/v1/xtcp_config.pb.cc
+++ b/gen/cpp/xtcp_config/v1/xtcp_config.pb.cc
@@ -2334,7 +2334,7 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
       offsetof(ParseTableT_, field_lookup_table),
       4278190591,  // skipmap
       offsetof(ParseTableT_, field_entries),
-      80,  // num_field_entries
+      82,  // num_field_entries
       14,  // num_aux_entries
       offsetof(ParseTableT_, aux_entries),
       class_data,
@@ -2355,77 +2355,77 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
       {::_pbi::TcParser::MiniParse, {}},
       {::_pbi::TcParser::MiniParse, {}},
       // uint64 nl_timeout_milliseconds = 10 [json_name = "nlTimeoutMilliseconds", (.buf.validate.field) = {
-      {::_pbi::TcParser::SingularVarintNoZag1<::uint64_t, offsetof(XtcpConfig, _impl_.nl_timeout_milliseconds_), 8>(),
-       {80, 8, 0,
+      {::_pbi::TcParser::SingularVarintNoZag1<::uint64_t, offsetof(XtcpConfig, _impl_.nl_timeout_milliseconds_), 7>(),
+       {80, 7, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.nl_timeout_milliseconds_)}},
       // .google.protobuf.Duration poll_frequency = 11 [json_name = "pollFrequency", (.buf.validate.field) = {
       {::_pbi::TcParser::FastMtS1,
-       {90, 5, 0,
+       {90, 4, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_frequency_)}},
       // .google.protobuf.Duration poll_timeout = 12 [json_name = "pollTimeout", (.buf.validate.field) = {
       {::_pbi::TcParser::FastMtS1,
-       {98, 6, 1,
+       {98, 5, 1,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_timeout_)}},
       // uint32 poll_jitter_pct = 13 [json_name = "pollJitterPct", (.buf.validate.field) = {
-      {::_pbi::TcParser::SingularVarintNoZag1<::uint32_t, offsetof(XtcpConfig, _impl_.poll_jitter_pct_), 10>(),
-       {104, 10, 0,
+      {::_pbi::TcParser::SingularVarintNoZag1<::uint32_t, offsetof(XtcpConfig, _impl_.poll_jitter_pct_), 9>(),
+       {104, 9, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_jitter_pct_)}},
       // uint64 max_loops = 14 [json_name = "maxLoops", (.buf.validate.field) = {
-      {::_pbi::TcParser::SingularVarintNoZag1<::uint64_t, offsetof(XtcpConfig, _impl_.max_loops_), 9>(),
-       {112, 9, 0,
+      {::_pbi::TcParser::SingularVarintNoZag1<::uint64_t, offsetof(XtcpConfig, _impl_.max_loops_), 8>(),
+       {112, 8, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.max_loops_)}},
       // uint32 netlinkers = 15 [json_name = "netlinkers", (.buf.validate.field) = {
-      {::_pbi::TcParser::SingularVarintNoZag1<::uint32_t, offsetof(XtcpConfig, _impl_.netlinkers_), 11>(),
-       {120, 11, 0,
+      {::_pbi::TcParser::SingularVarintNoZag1<::uint32_t, offsetof(XtcpConfig, _impl_.netlinkers_), 10>(),
+       {120, 10, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.netlinkers_)}},
       // uint32 netlinkers_done_chan_size = 16 [json_name = "netlinkersDoneChanSize", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV32S2,
-       {384, 12, 0,
+       {384, 11, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.netlinkers_done_chan_size_)}},
       // uint32 nlmsg_seq = 17 [json_name = "nlmsgSeq", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV32S2,
-       {392, 13, 0,
+       {392, 12, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.nlmsg_seq_)}},
       // uint64 packet_size = 18 [json_name = "packetSize", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV64S2,
-       {400, 14, 0,
+       {400, 13, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.packet_size_)}},
       // uint32 packet_size_mply = 19 [json_name = "packetSizeMply", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV32S2,
-       {408, 16, 0,
+       {408, 15, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.packet_size_mply_)}},
       // uint64 modulus = 20 [json_name = "modulus", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV64S2,
-       {416, 15, 0,
+       {416, 14, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.modulus_)}},
       // .xtcp_config.v1.EnabledDeserializers enabled_deserializers = 21 [json_name = "enabledDeserializers", (.buf.validate.field) = {
       {::_pbi::TcParser::FastMtS2,
-       {426, 7, 2,
+       {426, 6, 2,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enabled_deserializers_)}},
       // bool io_uring = 22 [json_name = "ioUring", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV8S2,
-       {432, 19, 0,
+       {432, 18, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_)}},
       // uint32 io_uring_recv_batch_size = 23 [json_name = "ioUringRecvBatchSize", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV32S2,
-       {440, 17, 0,
+       {440, 16, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_recv_batch_size_)}},
       // uint32 io_uring_cqe_batch_size = 24 [json_name = "ioUringCqeBatchSize", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV32S2,
-       {448, 18, 0,
+       {448, 17, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_cqe_batch_size_)}},
       // bool reconcile_before_poll = 41 [json_name = "reconcileBeforePoll"];
       {::_pbi::TcParser::FastV8S2,
-       {712, 20, 0,
+       {712, 19, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.reconcile_before_poll_)}},
       // bool s3_skip_bucket_probe = 106 [json_name = "s3SkipBucketProbe", (.buf.validate.field) = {
       {::_pbi::TcParser::FastV8S2,
-       {1744, 21, 0,
+       {1744, 20, 0,
         PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_skip_bucket_probe_)}},
-      // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
-      {::_pbi::TcParser::FastUS2,
-       {2778, 4, 0,
-        PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_app_name_)}},
+      // bool s3_allow_insecure = 107 [json_name = "s3AllowInsecure", (.buf.validate.field) = {
+      {::_pbi::TcParser::FastV8S2,
+       {1752, 21, 0,
+        PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_allow_insecure_)}},
       // string dest = 60 [json_name = "dest", (.buf.validate.field) = {
       {::_pbi::TcParser::FastUS2,
        {994, 0, 0,
@@ -2448,62 +2448,62 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
       64527, 22,
       61695, 28,
       4095, 32,
-      61496, 36,
-      33791, 45,
-      16383, 50,
-      64760, 52,
-      65475, 57,
-      65535, 61,
-      58360, 61,
-      49039, 67,
-      255, 71,
-      65531, 79,
+      61472, 36,
+      33791, 47,
+      16383, 52,
+      64760, 54,
+      65475, 59,
+      65535, 63,
+      58360, 63,
+      49039, 69,
+      255, 73,
+      65531, 81,
       65535, 65535
     }}, {{
       // uint64 nl_timeout_milliseconds = 10 [json_name = "nlTimeoutMilliseconds", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.nl_timeout_milliseconds_), _Internal::kHasBitsOffset + 8, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.nl_timeout_milliseconds_), _Internal::kHasBitsOffset + 7, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
       // .google.protobuf.Duration poll_frequency = 11 [json_name = "pollFrequency", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_frequency_), _Internal::kHasBitsOffset + 5, 0, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_frequency_), _Internal::kHasBitsOffset + 4, 0, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // .google.protobuf.Duration poll_timeout = 12 [json_name = "pollTimeout", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_timeout_), _Internal::kHasBitsOffset + 6, 1, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_timeout_), _Internal::kHasBitsOffset + 5, 1, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // uint32 poll_jitter_pct = 13 [json_name = "pollJitterPct", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_jitter_pct_), _Internal::kHasBitsOffset + 10, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_jitter_pct_), _Internal::kHasBitsOffset + 9, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint64 max_loops = 14 [json_name = "maxLoops", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.max_loops_), _Internal::kHasBitsOffset + 9, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.max_loops_), _Internal::kHasBitsOffset + 8, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
       // uint32 netlinkers = 15 [json_name = "netlinkers", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.netlinkers_), _Internal::kHasBitsOffset + 11, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.netlinkers_), _Internal::kHasBitsOffset + 10, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 netlinkers_done_chan_size = 16 [json_name = "netlinkersDoneChanSize", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.netlinkers_done_chan_size_), _Internal::kHasBitsOffset + 12, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.netlinkers_done_chan_size_), _Internal::kHasBitsOffset + 11, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 nlmsg_seq = 17 [json_name = "nlmsgSeq", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.nlmsg_seq_), _Internal::kHasBitsOffset + 13, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.nlmsg_seq_), _Internal::kHasBitsOffset + 12, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint64 packet_size = 18 [json_name = "packetSize", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.packet_size_), _Internal::kHasBitsOffset + 14, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.packet_size_), _Internal::kHasBitsOffset + 13, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
       // uint32 packet_size_mply = 19 [json_name = "packetSizeMply", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.packet_size_mply_), _Internal::kHasBitsOffset + 16, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.packet_size_mply_), _Internal::kHasBitsOffset + 15, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint64 modulus = 20 [json_name = "modulus", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.modulus_), _Internal::kHasBitsOffset + 15, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.modulus_), _Internal::kHasBitsOffset + 14, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt64)},
       // .xtcp_config.v1.EnabledDeserializers enabled_deserializers = 21 [json_name = "enabledDeserializers", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enabled_deserializers_), _Internal::kHasBitsOffset + 7, 2, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enabled_deserializers_), _Internal::kHasBitsOffset + 6, 2, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // bool io_uring = 22 [json_name = "ioUring", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_), _Internal::kHasBitsOffset + 19, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_), _Internal::kHasBitsOffset + 18, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // uint32 io_uring_recv_batch_size = 23 [json_name = "ioUringRecvBatchSize", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_recv_batch_size_), _Internal::kHasBitsOffset + 17, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_recv_batch_size_), _Internal::kHasBitsOffset + 16, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 io_uring_cqe_batch_size = 24 [json_name = "ioUringCqeBatchSize", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_cqe_batch_size_), _Internal::kHasBitsOffset + 18, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.io_uring_cqe_batch_size_), _Internal::kHasBitsOffset + 17, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // .google.protobuf.Duration reconcile_frequency = 40 [json_name = "reconcileFrequency", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.reconcile_frequency_), _Internal::kHasBitsOffset + 45, 3, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.reconcile_frequency_), _Internal::kHasBitsOffset + 47, 3, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // bool reconcile_before_poll = 41 [json_name = "reconcileBeforePoll"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.reconcile_before_poll_), _Internal::kHasBitsOffset + 20, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.reconcile_before_poll_), _Internal::kHasBitsOffset + 19, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // uint32 write_files = 50 [json_name = "writeFiles", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.write_files_), _Internal::kHasBitsOffset + 56, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.write_files_), _Internal::kHasBitsOffset + 58, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // string capture_path = 51 [json_name = "capturePath", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.capture_path_), _Internal::kHasBitsOffset + 23, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // uint32 dest_write_files = 52 [json_name = "destWriteFiles", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.dest_write_files_), _Internal::kHasBitsOffset + 57, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.dest_write_files_), _Internal::kHasBitsOffset + 59, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 debug_level = 53 [json_name = "debugLevel", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.debug_level_), _Internal::kHasBitsOffset + 58, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.debug_level_), _Internal::kHasBitsOffset + 60, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // bool debug_prometheus = 54 [json_name = "debugPrometheus", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.debug_prometheus_), _Internal::kHasBitsOffset + 68, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.debug_prometheus_), _Internal::kHasBitsOffset + 70, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // string dest = 60 [json_name = "dest", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.dest_), _Internal::kHasBitsOffset + 0, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string marshal_to = 61 [json_name = "marshalTo", (.buf.validate.field) = {
@@ -2513,15 +2513,15 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
       // string xtcp_proto_file = 63 [json_name = "xtcpProtoFile", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.xtcp_proto_file_), _Internal::kHasBitsOffset + 3, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // uint32 envelope_flush_threshold_bytes = 64 [json_name = "envelopeFlushThresholdBytes", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.envelope_flush_threshold_bytes_), _Internal::kHasBitsOffset + 59, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.envelope_flush_threshold_bytes_), _Internal::kHasBitsOffset + 61, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 envelope_flush_threshold_rows = 65 [json_name = "envelopeFlushThresholdRows", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.envelope_flush_threshold_rows_), _Internal::kHasBitsOffset + 60, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.envelope_flush_threshold_rows_), _Internal::kHasBitsOffset + 62, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // string topic = 80 [json_name = "topic", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.topic_), _Internal::kHasBitsOffset + 24, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string kafka_schema_url = 81 [json_name = "kafkaSchemaUrl", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.kafka_schema_url_), _Internal::kHasBitsOffset + 25, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // .google.protobuf.Duration kafka_produce_timeout = 82 [json_name = "kafkaProduceTimeout", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.kafka_produce_timeout_), _Internal::kHasBitsOffset + 46, 4, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.kafka_produce_timeout_), _Internal::kHasBitsOffset + 48, 4, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // string kafka_compression = 83 [json_name = "kafkaCompression", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.kafka_compression_), _Internal::kHasBitsOffset + 26, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string s3_endpoint = 100 [json_name = "s3Endpoint", (.buf.validate.field) = {
@@ -2537,89 +2537,93 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
       // string s3_secret_key = 105 [json_name = "s3SecretKey", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_secret_key_), _Internal::kHasBitsOffset + 32, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // bool s3_skip_bucket_probe = 106 [json_name = "s3SkipBucketProbe", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_skip_bucket_probe_), _Internal::kHasBitsOffset + 21, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_skip_bucket_probe_), _Internal::kHasBitsOffset + 20, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      // bool s3_allow_insecure = 107 [json_name = "s3AllowInsecure", (.buf.validate.field) = {
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_allow_insecure_), _Internal::kHasBitsOffset + 21, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      // string s3_ca_file = 108 [json_name = "s3CaFile", (.buf.validate.field) = {
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_ca_file_), _Internal::kHasBitsOffset + 33, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // uint32 s3_parquet_flush_threshold_bytes = 110 [json_name = "s3ParquetFlushThresholdBytes", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_parquet_flush_threshold_bytes_), _Internal::kHasBitsOffset + 61, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_parquet_flush_threshold_bytes_), _Internal::kHasBitsOffset + 63, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // .google.protobuf.Duration s3_flush_interval = 111 [json_name = "s3FlushInterval", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_flush_interval_), _Internal::kHasBitsOffset + 47, 5, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_flush_interval_), _Internal::kHasBitsOffset + 49, 5, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // uint32 s3_flush_jitter_pct = 112 [json_name = "s3FlushJitterPct", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_flush_jitter_pct_), _Internal::kHasBitsOffset + 62, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_flush_jitter_pct_), _Internal::kHasBitsOffset + 64, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 s3_flush_threshold_jitter_pct = 113 [json_name = "s3FlushThresholdJitterPct", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_flush_threshold_jitter_pct_), _Internal::kHasBitsOffset + 63, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_flush_threshold_jitter_pct_), _Internal::kHasBitsOffset + 65, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 s3_upload_max_attempts = 114 [json_name = "s3UploadMaxAttempts", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_upload_max_attempts_), _Internal::kHasBitsOffset + 64, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_upload_max_attempts_), _Internal::kHasBitsOffset + 66, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // .google.protobuf.Duration s3_upload_backoff_cap = 115 [json_name = "s3UploadBackoffCap", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_upload_backoff_cap_), _Internal::kHasBitsOffset + 48, 6, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_upload_backoff_cap_), _Internal::kHasBitsOffset + 50, 6, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // string hostname = 130 [json_name = "hostname", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.hostname_), _Internal::kHasBitsOffset + 33, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.hostname_), _Internal::kHasBitsOffset + 34, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string location = 131 [json_name = "location", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.location_), _Internal::kHasBitsOffset + 34, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.location_), _Internal::kHasBitsOffset + 35, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string label = 132 [json_name = "label", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.label_), _Internal::kHasBitsOffset + 35, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.label_), _Internal::kHasBitsOffset + 36, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string tag = 133 [json_name = "tag", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.tag_), _Internal::kHasBitsOffset + 36, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.tag_), _Internal::kHasBitsOffset + 37, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string daemon_version = 134 [json_name = "daemonVersion", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.daemon_version_), _Internal::kHasBitsOffset + 37, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.daemon_version_), _Internal::kHasBitsOffset + 38, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // uint32 ipv4_ttl = 150 [json_name = "ipv4Ttl", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipv4_ttl_), _Internal::kHasBitsOffset + 65, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipv4_ttl_), _Internal::kHasBitsOffset + 67, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 ipv6_hop_limit = 151 [json_name = "ipv6HopLimit", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipv6_hop_limit_), _Internal::kHasBitsOffset + 66, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipv6_hop_limit_), _Internal::kHasBitsOffset + 68, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // .xtcp_config.v1.ListenerAuth listener_auth = 152 [json_name = "listenerAuth", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.listener_auth_), _Internal::kHasBitsOffset + 49, 7, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.listener_auth_), _Internal::kHasBitsOffset + 51, 7, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // .xtcp_config.v1.ListenerEndpoint prometheus_listener = 153 [json_name = "prometheusListener", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.prometheus_listener_), _Internal::kHasBitsOffset + 50, 8, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.prometheus_listener_), _Internal::kHasBitsOffset + 52, 8, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // .xtcp_config.v1.ListenerAuth admin_listener_auth = 154 [json_name = "adminListenerAuth", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.admin_listener_auth_), _Internal::kHasBitsOffset + 51, 9, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.admin_listener_auth_), _Internal::kHasBitsOffset + 53, 9, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // uint32 grpc_port = 160 [json_name = "grpcPort", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.grpc_port_), _Internal::kHasBitsOffset + 67, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.grpc_port_), _Internal::kHasBitsOffset + 69, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // .xtcp_config.v1.ListenerEndpoint grpc_listener = 161 [json_name = "grpcListener", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.grpc_listener_), _Internal::kHasBitsOffset + 52, 10, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.grpc_listener_), _Internal::kHasBitsOffset + 54, 10, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // string pyroscope_url = 170 [json_name = "pyroscopeUrl", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_url_), _Internal::kHasBitsOffset + 38, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_url_), _Internal::kHasBitsOffset + 39, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_app_name_), _Internal::kHasBitsOffset + 4, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_app_name_), _Internal::kHasBitsOffset + 40, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // uint32 pyroscope_sample_hz = 172 [json_name = "pyroscopeSampleHz", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_sample_hz_), _Internal::kHasBitsOffset + 72, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_sample_hz_), _Internal::kHasBitsOffset + 74, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // uint32 pyroscope_upload_interval_sec = 173 [json_name = "pyroscopeUploadIntervalSec", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_upload_interval_sec_), _Internal::kHasBitsOffset + 73, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.pyroscope_upload_interval_sec_), _Internal::kHasBitsOffset + 75, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // bool resolve_container_id = 200 [json_name = "resolveContainerId", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.resolve_container_id_), _Internal::kHasBitsOffset + 69, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.resolve_container_id_), _Internal::kHasBitsOffset + 71, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // bool enrich_container_enable = 201 [json_name = "enrichContainerEnable"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_container_enable_), _Internal::kHasBitsOffset + 70, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_container_enable_), _Internal::kHasBitsOffset + 72, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // string docker_socket_path = 202 [json_name = "dockerSocketPath", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.docker_socket_path_), _Internal::kHasBitsOffset + 39, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.docker_socket_path_), _Internal::kHasBitsOffset + 41, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // bool enrich_lldp_enable = 210 [json_name = "enrichLldpEnable"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_lldp_enable_), _Internal::kHasBitsOffset + 71, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_lldp_enable_), _Internal::kHasBitsOffset + 73, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // string lldpd_socket_path = 211 [json_name = "lldpdSocketPath", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.lldpd_socket_path_), _Internal::kHasBitsOffset + 40, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.lldpd_socket_path_), _Internal::kHasBitsOffset + 42, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string lldpd_version_hint = 212 [json_name = "lldpdVersionHint", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.lldpd_version_hint_), _Internal::kHasBitsOffset + 41, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.lldpd_version_hint_), _Internal::kHasBitsOffset + 43, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // bool enrich_nic_enable = 220 [json_name = "enrichNicEnable"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_nic_enable_), _Internal::kHasBitsOffset + 75, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_nic_enable_), _Internal::kHasBitsOffset + 77, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // uint32 uplink_count = 221 [json_name = "uplinkCount", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.uplink_count_), _Internal::kHasBitsOffset + 74, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.uplink_count_), _Internal::kHasBitsOffset + 76, 0, (0 | ::_fl::kFcOptional | ::_fl::kUInt32)},
       // repeated string uplink_interfaces = 222 [json_name = "uplinkInterfaces", (.buf.validate.field) = {
       {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.uplink_interfaces_), _Internal::kHasBitsOffset + 22, 0, (0 | ::_fl::kFcRepeated | ::_fl::kUtf8String | ::_fl::kRepSString)},
       // bool populate_nsid = 230 [json_name = "populateNsid"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.populate_nsid_), _Internal::kHasBitsOffset + 76, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.populate_nsid_), _Internal::kHasBitsOffset + 78, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // bool enrich_asn_enable = 240 [json_name = "enrichAsnEnable"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_asn_enable_), _Internal::kHasBitsOffset + 77, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_asn_enable_), _Internal::kHasBitsOffset + 79, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // string asn_db_path = 241 [json_name = "asnDbPath", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.asn_db_path_), _Internal::kHasBitsOffset + 42, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.asn_db_path_), _Internal::kHasBitsOffset + 44, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // .google.protobuf.Duration asn_refresh_interval = 242 [json_name = "asnRefreshInterval"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.asn_refresh_interval_), _Internal::kHasBitsOffset + 53, 11, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.asn_refresh_interval_), _Internal::kHasBitsOffset + 55, 11, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // string ipmeta_bootstrap_path = 243 [json_name = "ipmetaBootstrapPath", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipmeta_bootstrap_path_), _Internal::kHasBitsOffset + 43, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipmeta_bootstrap_path_), _Internal::kHasBitsOffset + 45, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // string ipmeta_cache_path = 244 [json_name = "ipmetaCachePath", (.buf.validate.field) = {
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipmeta_cache_path_), _Internal::kHasBitsOffset + 44, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.ipmeta_cache_path_), _Internal::kHasBitsOffset + 46, 0, (0 | ::_fl::kFcOptional | ::_fl::kUtf8String | ::_fl::kRepAString)},
       // bool enrich_locality_enable = 245 [json_name = "enrichLocalityEnable"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_locality_enable_), _Internal::kHasBitsOffset + 78, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.enrich_locality_enable_), _Internal::kHasBitsOffset + 80, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // .google.protobuf.Duration locality_refresh_interval = 246 [json_name = "localityRefreshInterval"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.locality_refresh_interval_), _Internal::kHasBitsOffset + 54, 12, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.locality_refresh_interval_), _Internal::kHasBitsOffset + 56, 12, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
       // bool locality_events_enable = 247 [json_name = "localityEventsEnable"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.locality_events_enable_), _Internal::kHasBitsOffset + 79, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.locality_events_enable_), _Internal::kHasBitsOffset + 81, 0, (0 | ::_fl::kFcOptional | ::_fl::kBool)},
       // .xtcp_config.v1.LinkMonitorConfig link_monitor = 250 [json_name = "linkMonitor"];
-      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.link_monitor_), _Internal::kHasBitsOffset + 55, 13, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
+      {PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.link_monitor_), _Internal::kHasBitsOffset + 57, 13, (0 | ::_fl::kFcOptional | ::_fl::kMessage | ::_fl::kTvTable)},
     }},
     {{
         #ifndef PROTOBUF_MESSAGE_GLOBALS
@@ -2694,7 +2698,7 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
         #endif
     }},
     {{
-      "\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\4\12\13\17\0\0\5\20\0\21\13\11\11\11\15\15\0\0\0\0\0\0\0\10\10\5\3\16\0\0\0\0\0\0\0\15\22\0\0\0\0\22\0\21\22\0\0\21\0\0\13\0\25\21\0\0\0\0\0\0\0\0\0\0\0"
+      "\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\4\12\13\17\0\0\5\20\0\21\13\11\11\11\15\15\0\0\12\0\0\0\0\0\0\10\10\5\3\16\0\0\0\0\0\0\0\15\22\0\0\0\0\22\0\21\22\0\0\21\0\0\13\0\25\21\0\0\0\0\0\0\0\0\0"
       "xtcp_config.v1.XtcpConfig"
       "capture_path"
       "dest"
@@ -2710,6 +2714,7 @@ constexpr XtcpConfig::ParseTableT_ XtcpConfig::InternalGenerateParseTable_(const
       "s3_prefix"
       "s3_access_key"
       "s3_secret_key"
+      "s3_ca_file"
       "hostname"
       "location"
       "label"
@@ -2744,9 +2749,6 @@ inline constexpr XtcpConfig::Impl_::Impl_(
         xtcp_proto_file_(
             &::google::protobuf::internal::fixed_address_empty_string,
             ::_pbi::ConstantInitialized()),
-        pyroscope_app_name_(
-            &::google::protobuf::internal::fixed_address_empty_string,
-            ::_pbi::ConstantInitialized()),
         poll_frequency_{nullptr},
         poll_timeout_{nullptr},
         enabled_deserializers_{nullptr},
@@ -2764,6 +2766,7 @@ inline constexpr XtcpConfig::Impl_::Impl_(
         io_uring_{false},
         reconcile_before_poll_{false},
         s3_skip_bucket_probe_{false},
+        s3_allow_insecure_{false},
         uplink_interfaces_ { visibility, ::_pbi::InternalMetadataOffset::Build<
             ::xtcp_config::v1::XtcpConfig,
             PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.uplink_interfaces_)>()
@@ -2799,6 +2802,9 @@ inline constexpr XtcpConfig::Impl_::Impl_(
         s3_secret_key_(
             &::google::protobuf::internal::fixed_address_empty_string,
             ::_pbi::ConstantInitialized()),
+        s3_ca_file_(
+            &::google::protobuf::internal::fixed_address_empty_string,
+            ::_pbi::ConstantInitialized()),
         hostname_(
             &::google::protobuf::internal::fixed_address_empty_string,
             ::_pbi::ConstantInitialized()),
@@ -2817,6 +2823,9 @@ inline constexpr XtcpConfig::Impl_::Impl_(
         pyroscope_url_(
             &::google::protobuf::internal::fixed_address_empty_string,
             ::_pbi::ConstantInitialized()),
+        pyroscope_app_name_(
+            &::google::protobuf::internal::fixed_address_empty_string,
+            ::_pbi::ConstantInitialized()),
         docker_socket_path_(
             &::google::protobuf::internal::fixed_address_empty_string,
             ::_pbi::ConstantInitialized()),
@@ -4009,7 +4018,7 @@ const ::uint32_t
         22,
         0x081, // bitmap
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_._has_bits_),
-        83, // hasbit index offset
+        85, // hasbit index offset
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.nl_timeout_milliseconds_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.poll_frequency_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.poll_timeout_),
@@ -4049,6 +4058,8 @@ const ::uint32_t
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_access_key_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_secret_key_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_skip_bucket_probe_),
+        PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_allow_insecure_),
+        PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_ca_file_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_parquet_flush_threshold_bytes_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_flush_interval_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.s3_flush_jitter_pct_),
@@ -4090,37 +4101,37 @@ const ::uint32_t
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.locality_refresh_interval_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.locality_events_enable_),
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.link_monitor_),
-        8,
+        7,
+        4,
         5,
-        6,
-        10,
         9,
+        8,
+        10,
         11,
         12,
         13,
+        15,
         14,
+        6,
+        18,
         16,
-        15,
-        7,
-        19,
         17,
-        18,
-        45,
-        20,
-        56,
-        23,
-        57,
+        47,
+        19,
         58,
-        68,
+        23,
+        59,
+        60,
+        70,
         0,
         1,
         2,
         3,
-        59,
-        60,
+        61,
+        62,
         24,
         25,
-        46,
+        48,
         26,
         27,
         28,
@@ -4128,48 +4139,50 @@ const ::uint32_t
         30,
         31,
         32,
+        20,
         21,
-        61,
-        47,
-        62,
+        33,
         63,
+        49,
         64,
-        48,
-        33,
+        65,
+        66,
+        50,
         34,
         35,
         36,
         37,
-        65,
-        66,
-        49,
-        50,
-        51,
+        38,
         67,
+        68,
+        51,
         52,
-        38,
-        4,
-        72,
-        73,
+        53,
         69,
-        70,
+        54,
         39,
-        71,
         40,
-        41,
-        75,
         74,
-        22,
-        76,
-        77,
+        75,
+        71,
+        72,
+        41,
+        73,
         42,
-        53,
         43,
-        44,
+        77,
+        76,
+        22,
         78,
-        54,
         79,
+        44,
         55,
+        45,
+        46,
+        80,
+        56,
+        81,
+        57,
         0x081, // bitmap
         PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::EnabledDeserializers_EnabledEntry_DoNotUse, _impl_._has_bits_),
         5, // hasbit index offset
@@ -4204,8 +4217,8 @@ static const ::_pbi::MigrationSchema
         {85, sizeof(::xtcp_config::v1::ListenerAuth)},
         {100, sizeof(::xtcp_config::v1::LinkMonitorConfig)},
         {159, sizeof(::xtcp_config::v1::XtcpConfig)},
-        {322, sizeof(::xtcp_config::v1::EnabledDeserializers_EnabledEntry_DoNotUse)},
-        {329, sizeof(::xtcp_config::v1::EnabledDeserializers)},
+        {326, sizeof(::xtcp_config::v1::EnabledDeserializers_EnabledEntry_DoNotUse)},
+        {333, sizeof(::xtcp_config::v1::EnabledDeserializers)},
 };
 static const ::_pbi::MessageGlobalsBase* PROTOBUF_NONNULL const
     file_message_globals[] = {
@@ -4353,7 +4366,7 @@ const char descriptor_table_protodef_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2eproto[
     "\272H\013\252\001\010\"\004\010\200\243\0052\000R\rlearnDeadlineB\020\n\016_error_"
     "classesB\025\n\023_metrics_categoriesB\032\n\030_metri"
     "cs_interface_pathsB\023\n\021_metrics_all_path\""
-    "\213%\n\nXtcpConfig\022F\n\027nl_timeout_millisecond"
+    "\352%\n\nXtcpConfig\022F\n\027nl_timeout_millisecond"
     "s\030\n \001(\004B\016\272H\0132\006\030\240\215\006(\000\310\001\001R\025nlTimeoutMillis"
     "econds\022S\n\016poll_frequency\030\013 \001(\0132\031.google."
     "protobuf.DurationB\021\272H\016\252\001\010\"\004\010\200\365$*\000\310\001\001R\rpo"
@@ -4407,110 +4420,112 @@ const char descriptor_table_protodef_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2eproto[
     "\010s3Prefix\022*\n\rs3_access_key\030h \001(\tB\006\272H\003\310\001\000"
     "R\013s3AccessKey\022*\n\rs3_secret_key\030i \001(\tB\006\272H"
     "\003\310\001\000R\013s3SecretKey\0227\n\024s3_skip_bucket_prob"
-    "e\030j \001(\010B\006\272H\003\310\001\000R\021s3SkipBucketProbe\022N\n s3"
-    "_parquet_flush_threshold_bytes\030n \001(\rB\006\272H"
-    "\003\310\001\000R\034s3ParquetFlushThresholdBytes\022R\n\021s3"
-    "_flush_interval\030o \001(\0132\031.google.protobuf."
-    "DurationB\013\272H\010\252\001\0022\000\310\001\000R\017s3FlushInterval\0229"
-    "\n\023s3_flush_jitter_pct\030p \001(\rB\n\272H\007*\002\030d\310\001\000R"
-    "\020s3FlushJitterPct\022L\n\035s3_flush_threshold_"
-    "jitter_pct\030q \001(\rB\n\272H\007*\002\030d\310\001\000R\031s3FlushThr"
-    "esholdJitterPct\022A\n\026s3_upload_max_attempt"
-    "s\030r \001(\rB\014\272H\t*\004\030d(\001\310\001\000R\023s3UploadMaxAttemp"
-    "ts\022Y\n\025s3_upload_backoff_cap\030s \001(\0132\031.goog"
-    "le.protobuf.DurationB\013\272H\010\252\001\0022\000\310\001\000R\022s3Upl"
-    "oadBackoffCap\022(\n\010hostname\030\202\001 \001(\tB\013\272H\010r\003\030"
-    "\375\001\310\001\000R\010hostname\022(\n\010location\030\203\001 \001(\tB\013\272H\010r"
-    "\003\030\375\001\310\001\000R\010location\022!\n\005label\030\204\001 \001(\tB\n\272H\007r\002"
-    "\030(\310\001\000R\005label\022\035\n\003tag\030\205\001 \001(\tB\n\272H\007r\002\030(\310\001\000R\003"
-    "tag\0223\n\016daemon_version\030\206\001 \001(\tB\013\272H\010r\003\030\375\001\310\001"
-    "\000R\rdaemonVersion\022\'\n\010ipv4_ttl\030\226\001 \001(\rB\013\272H\010"
-    "*\003\030\377\001\310\001\000R\007ipv4Ttl\0222\n\016ipv6_hop_limit\030\227\001 \001"
-    "(\rB\013\272H\010*\003\030\377\001\310\001\000R\014ipv6HopLimit\022J\n\rlistene"
-    "r_auth\030\230\001 \001(\0132\034.xtcp_config.v1.ListenerA"
-    "uthB\006\272H\003\310\001\000R\014listenerAuth\022Z\n\023prometheus_"
-    "listener\030\231\001 \001(\0132 .xtcp_config.v1.Listene"
-    "rEndpointB\006\272H\003\310\001\000R\022prometheusListener\022U\n"
-    "\023admin_listener_auth\030\232\001 \001(\0132\034.xtcp_confi"
-    "g.v1.ListenerAuthB\006\272H\003\310\001\000R\021adminListener"
-    "Auth\022,\n\tgrpc_port\030\240\001 \001(\rB\016\272H\013*\006\030\377\377\003(\001\310\001\001"
-    "R\010grpcPort\022N\n\rgrpc_listener\030\241\001 \001(\0132 .xtc"
-    "p_config.v1.ListenerEndpointB\006\272H\003\310\001\000R\014gr"
-    "pcListener\022,\n\rpyroscope_url\030\252\001 \001(\tB\006\272H\003\310"
-    "\001\000R\014pyroscopeUrl\0225\n\022pyroscope_app_name\030\253"
-    "\001 \001(\tB\006\272H\003\310\001\000R\020pyroscopeAppName\0227\n\023pyros"
-    "cope_sample_hz\030\254\001 \001(\rB\006\272H\003\310\001\000R\021pyroscope"
-    "SampleHz\022J\n\035pyroscope_upload_interval_se"
-    "c\030\255\001 \001(\rB\006\272H\003\310\001\000R\032pyroscopeUploadInterva"
-    "lSec\0229\n\024resolve_container_id\030\310\001 \001(\010B\006\272H\003"
-    "\310\001\000R\022resolveContainerId\0227\n\027enrich_contai"
-    "ner_enable\030\311\001 \001(\010R\025enrichContainerEnable"
-    "\0227\n\022docker_socket_path\030\312\001 \001(\tB\010\272H\005r\003\030\377\001R"
-    "\020dockerSocketPath\022-\n\022enrich_lldp_enable\030"
-    "\322\001 \001(\010R\020enrichLldpEnable\0225\n\021lldpd_socket"
-    "_path\030\323\001 \001(\tB\010\272H\005r\003\030\377\001R\017lldpdSocketPath\022"
-    "6\n\022lldpd_version_hint\030\324\001 \001(\tB\007\272H\004r\002\030\020R\020l"
-    "ldpdVersionHint\022+\n\021enrich_nic_enable\030\334\001 "
-    "\001(\010R\017enrichNicEnable\022+\n\014uplink_count\030\335\001 "
-    "\001(\rB\007\272H\004*\002\030\002R\013uplinkCount\0226\n\021uplink_inte"
-    "rfaces\030\336\001 \003(\tB\010\272H\005\222\001\002\020\002R\020uplinkInterface"
-    "s\022$\n\rpopulate_nsid\030\346\001 \001(\010R\014populateNsid\022"
-    "+\n\021enrich_asn_enable\030\360\001 \001(\010R\017enrichAsnEn"
-    "able\022)\n\013asn_db_path\030\361\001 \001(\tB\010\272H\005r\003\030\377\001R\tas"
-    "nDbPath\022L\n\024asn_refresh_interval\030\362\001 \001(\0132\031"
-    ".google.protobuf.DurationR\022asnRefreshInt"
-    "erval\022=\n\025ipmeta_bootstrap_path\030\363\001 \001(\tB\010\272"
-    "H\005r\003\030\377\001R\023ipmetaBootstrapPath\0225\n\021ipmeta_c"
-    "ache_path\030\364\001 \001(\tB\010\272H\005r\003\030\377\001R\017ipmetaCacheP"
-    "ath\0225\n\026enrich_locality_enable\030\365\001 \001(\010R\024en"
-    "richLocalityEnable\022V\n\031locality_refresh_i"
-    "nterval\030\366\001 \001(\0132\031.google.protobuf.Duratio"
-    "nR\027localityRefreshInterval\0225\n\026locality_e"
-    "vents_enable\030\367\001 \001(\010R\024localityEventsEnabl"
-    "e\022E\n\014link_monitor\030\372\001 \001(\0132!.xtcp_config.v"
-    "1.LinkMonitorConfigR\013linkMonitor:s\272Hp\032n\n"
-    "\017XtcpConfig.poll\0222Poll timeout must be l"
-    "ess than poll poll_frequency\032\'this.poll_"
-    "frequency > this.poll_timeout\"\237\001\n\024Enable"
-    "dDeserializers\022K\n\007enabled\030\001 \003(\01321.xtcp_c"
-    "onfig.v1.EnabledDeserializers.EnabledEnt"
-    "ryR\007enabled\032:\n\014EnabledEntry\022\020\n\003key\030\001 \001(\t"
-    "R\003key\022\024\n\005value\030\002 \001(\010R\005value:\0028\001*h\n\017Liste"
-    "nerNetwork\022 \n\034LISTENER_NETWORK_UNSPECIFI"
-    "ED\020\000\022\030\n\024LISTENER_NETWORK_TCP\020\001\022\031\n\025LISTEN"
-    "ER_NETWORK_UNIX\020\002*\241\001\n\020ListenerAuthMode\022\""
-    "\n\036LISTENER_AUTH_MODE_UNSPECIFIED\020\000\022\037\n\033LI"
-    "STENER_AUTH_MODE_DISABLED\020\001\022 \n\034LISTENER_"
-    "AUTH_MODE_RAW_TOKEN\020\002\022&\n\"LISTENER_AUTH_M"
-    "ODE_HMAC_UTC_MINUTE\020\0032\245\007\n\rConfigService\022"
-    "a\n\003Get\022\032.xtcp_config.v1.GetRequest\032\033.xtc"
-    "p_config.v1.GetResponse\"!\310\363\030\001\202\323\344\223\002\027\032\022/Co"
-    "nfigService/Get:\001*\022a\n\003Set\022\032.xtcp_config."
-    "v1.SetRequest\032\033.xtcp_config.v1.SetRespon"
-    "se\"!\310\363\030\002\202\323\344\223\002\027\032\022/ConfigService/Set:\001*\022\225\001"
-    "\n\020SetPollFrequency\022\'.xtcp_config.v1.SetP"
-    "ollFrequencyRequest\032(.xtcp_config.v1.Set"
-    "PollFrequencyResponse\".\310\363\030\002\202\323\344\223\002$\032\037/Conf"
-    "igService/SetPollFrequency:\001*\022\201\001\n\013Trigge"
-    "rPoll\022\".xtcp_config.v1.TriggerPollReques"
-    "t\032#.xtcp_config.v1.TriggerPollResponse\")"
-    "\310\363\030\002\202\323\344\223\002\037\032\032/ConfigService/TriggerPoll:\001"
-    "*\022\225\001\n\020TriggerPollBurst\022\'.xtcp_config.v1."
-    "TriggerPollBurstRequest\032(.xtcp_config.v1"
-    ".TriggerPollBurstResponse\".\310\363\030\002\202\323\344\223\002$\032\037/"
-    "ConfigService/TriggerPollBurst:\001*\022\201\001\n\013Se"
-    "tS3Upload\022\".xtcp_config.v1.SetS3UploadRe"
-    "quest\032#.xtcp_config.v1.SetS3UploadRespon"
-    "se\")\310\363\030\002\202\323\344\223\002\037\032\032/ConfigService/SetS3Uplo"
-    "ad:\001*\022\225\001\n\020SetEnvelopeFlush\022\'.xtcp_config"
-    ".v1.SetEnvelopeFlushRequest\032(.xtcp_confi"
-    "g.v1.SetEnvelopeFlushResponse\".\310\363\030\002\202\323\344\223\002"
-    "$\032\037/ConfigService/SetEnvelopeFlush:\001*B\257\001"
-    "\n\022com.xtcp_config.v1B\017XtcpConfigProtoP\001Z"
-    "3github.com/randomizedcoder/xtcp2/gen/go"
-    "/xtcp_config\242\002\003XXX\252\002\rXtcpConfig.V1\312\002\rXtc"
-    "pConfig\\V1\342\002\031XtcpConfig\\V1\\GPBMetadata\352\002"
-    "\016XtcpConfig::V1b\006proto3"
+    "e\030j \001(\010B\006\272H\003\310\001\000R\021s3SkipBucketProbe\0222\n\021s3"
+    "_allow_insecure\030k \001(\010B\006\272H\003\310\001\000R\017s3AllowIn"
+    "secure\022)\n\ns3_ca_file\030l \001(\tB\013\272H\010r\003\030\200 \310\001\000R"
+    "\010s3CaFile\022N\n s3_parquet_flush_threshold_"
+    "bytes\030n \001(\rB\006\272H\003\310\001\000R\034s3ParquetFlushThres"
+    "holdBytes\022R\n\021s3_flush_interval\030o \001(\0132\031.g"
+    "oogle.protobuf.DurationB\013\272H\010\252\001\0022\000\310\001\000R\017s3"
+    "FlushInterval\0229\n\023s3_flush_jitter_pct\030p \001"
+    "(\rB\n\272H\007*\002\030d\310\001\000R\020s3FlushJitterPct\022L\n\035s3_f"
+    "lush_threshold_jitter_pct\030q \001(\rB\n\272H\007*\002\030d"
+    "\310\001\000R\031s3FlushThresholdJitterPct\022A\n\026s3_upl"
+    "oad_max_attempts\030r \001(\rB\014\272H\t*\004\030d(\001\310\001\000R\023s3"
+    "UploadMaxAttempts\022Y\n\025s3_upload_backoff_c"
+    "ap\030s \001(\0132\031.google.protobuf.DurationB\013\272H\010"
+    "\252\001\0022\000\310\001\000R\022s3UploadBackoffCap\022(\n\010hostname"
+    "\030\202\001 \001(\tB\013\272H\010r\003\030\375\001\310\001\000R\010hostname\022(\n\010locati"
+    "on\030\203\001 \001(\tB\013\272H\010r\003\030\375\001\310\001\000R\010location\022!\n\005labe"
+    "l\030\204\001 \001(\tB\n\272H\007r\002\030(\310\001\000R\005label\022\035\n\003tag\030\205\001 \001("
+    "\tB\n\272H\007r\002\030(\310\001\000R\003tag\0223\n\016daemon_version\030\206\001 "
+    "\001(\tB\013\272H\010r\003\030\375\001\310\001\000R\rdaemonVersion\022\'\n\010ipv4_"
+    "ttl\030\226\001 \001(\rB\013\272H\010*\003\030\377\001\310\001\000R\007ipv4Ttl\0222\n\016ipv6"
+    "_hop_limit\030\227\001 \001(\rB\013\272H\010*\003\030\377\001\310\001\000R\014ipv6HopL"
+    "imit\022J\n\rlistener_auth\030\230\001 \001(\0132\034.xtcp_conf"
+    "ig.v1.ListenerAuthB\006\272H\003\310\001\000R\014listenerAuth"
+    "\022Z\n\023prometheus_listener\030\231\001 \001(\0132 .xtcp_co"
+    "nfig.v1.ListenerEndpointB\006\272H\003\310\001\000R\022promet"
+    "heusListener\022U\n\023admin_listener_auth\030\232\001 \001"
+    "(\0132\034.xtcp_config.v1.ListenerAuthB\006\272H\003\310\001\000"
+    "R\021adminListenerAuth\022,\n\tgrpc_port\030\240\001 \001(\rB"
+    "\016\272H\013*\006\030\377\377\003(\001\310\001\001R\010grpcPort\022N\n\rgrpc_listen"
+    "er\030\241\001 \001(\0132 .xtcp_config.v1.ListenerEndpo"
+    "intB\006\272H\003\310\001\000R\014grpcListener\022,\n\rpyroscope_u"
+    "rl\030\252\001 \001(\tB\006\272H\003\310\001\000R\014pyroscopeUrl\0225\n\022pyros"
+    "cope_app_name\030\253\001 \001(\tB\006\272H\003\310\001\000R\020pyroscopeA"
+    "ppName\0227\n\023pyroscope_sample_hz\030\254\001 \001(\rB\006\272H"
+    "\003\310\001\000R\021pyroscopeSampleHz\022J\n\035pyroscope_upl"
+    "oad_interval_sec\030\255\001 \001(\rB\006\272H\003\310\001\000R\032pyrosco"
+    "peUploadIntervalSec\0229\n\024resolve_container"
+    "_id\030\310\001 \001(\010B\006\272H\003\310\001\000R\022resolveContainerId\0227"
+    "\n\027enrich_container_enable\030\311\001 \001(\010R\025enrich"
+    "ContainerEnable\0227\n\022docker_socket_path\030\312\001"
+    " \001(\tB\010\272H\005r\003\030\377\001R\020dockerSocketPath\022-\n\022enri"
+    "ch_lldp_enable\030\322\001 \001(\010R\020enrichLldpEnable\022"
+    "5\n\021lldpd_socket_path\030\323\001 \001(\tB\010\272H\005r\003\030\377\001R\017l"
+    "ldpdSocketPath\0226\n\022lldpd_version_hint\030\324\001 "
+    "\001(\tB\007\272H\004r\002\030\020R\020lldpdVersionHint\022+\n\021enrich"
+    "_nic_enable\030\334\001 \001(\010R\017enrichNicEnable\022+\n\014u"
+    "plink_count\030\335\001 \001(\rB\007\272H\004*\002\030\002R\013uplinkCount"
+    "\0226\n\021uplink_interfaces\030\336\001 \003(\tB\010\272H\005\222\001\002\020\002R\020"
+    "uplinkInterfaces\022$\n\rpopulate_nsid\030\346\001 \001(\010"
+    "R\014populateNsid\022+\n\021enrich_asn_enable\030\360\001 \001"
+    "(\010R\017enrichAsnEnable\022)\n\013asn_db_path\030\361\001 \001("
+    "\tB\010\272H\005r\003\030\377\001R\tasnDbPath\022L\n\024asn_refresh_in"
+    "terval\030\362\001 \001(\0132\031.google.protobuf.Duration"
+    "R\022asnRefreshInterval\022=\n\025ipmeta_bootstrap"
+    "_path\030\363\001 \001(\tB\010\272H\005r\003\030\377\001R\023ipmetaBootstrapP"
+    "ath\0225\n\021ipmeta_cache_path\030\364\001 \001(\tB\010\272H\005r\003\030\377"
+    "\001R\017ipmetaCachePath\0225\n\026enrich_locality_en"
+    "able\030\365\001 \001(\010R\024enrichLocalityEnable\022V\n\031loc"
+    "ality_refresh_interval\030\366\001 \001(\0132\031.google.p"
+    "rotobuf.DurationR\027localityRefreshInterva"
+    "l\0225\n\026locality_events_enable\030\367\001 \001(\010R\024loca"
+    "lityEventsEnable\022E\n\014link_monitor\030\372\001 \001(\0132"
+    "!.xtcp_config.v1.LinkMonitorConfigR\013link"
+    "Monitor:s\272Hp\032n\n\017XtcpConfig.poll\0222Poll ti"
+    "meout must be less than poll poll_freque"
+    "ncy\032\'this.poll_frequency > this.poll_tim"
+    "eout\"\237\001\n\024EnabledDeserializers\022K\n\007enabled"
+    "\030\001 \003(\01321.xtcp_config.v1.EnabledDeseriali"
+    "zers.EnabledEntryR\007enabled\032:\n\014EnabledEnt"
+    "ry\022\020\n\003key\030\001 \001(\tR\003key\022\024\n\005value\030\002 \001(\010R\005val"
+    "ue:\0028\001*h\n\017ListenerNetwork\022 \n\034LISTENER_NE"
+    "TWORK_UNSPECIFIED\020\000\022\030\n\024LISTENER_NETWORK_"
+    "TCP\020\001\022\031\n\025LISTENER_NETWORK_UNIX\020\002*\241\001\n\020Lis"
+    "tenerAuthMode\022\"\n\036LISTENER_AUTH_MODE_UNSP"
+    "ECIFIED\020\000\022\037\n\033LISTENER_AUTH_MODE_DISABLED"
+    "\020\001\022 \n\034LISTENER_AUTH_MODE_RAW_TOKEN\020\002\022&\n\""
+    "LISTENER_AUTH_MODE_HMAC_UTC_MINUTE\020\0032\245\007\n"
+    "\rConfigService\022a\n\003Get\022\032.xtcp_config.v1.G"
+    "etRequest\032\033.xtcp_config.v1.GetResponse\"!"
+    "\310\363\030\001\202\323\344\223\002\027\032\022/ConfigService/Get:\001*\022a\n\003Set"
+    "\022\032.xtcp_config.v1.SetRequest\032\033.xtcp_conf"
+    "ig.v1.SetResponse\"!\310\363\030\002\202\323\344\223\002\027\032\022/ConfigSe"
+    "rvice/Set:\001*\022\225\001\n\020SetPollFrequency\022\'.xtcp"
+    "_config.v1.SetPollFrequencyRequest\032(.xtc"
+    "p_config.v1.SetPollFrequencyResponse\".\310\363"
+    "\030\002\202\323\344\223\002$\032\037/ConfigService/SetPollFrequenc"
+    "y:\001*\022\201\001\n\013TriggerPoll\022\".xtcp_config.v1.Tr"
+    "iggerPollRequest\032#.xtcp_config.v1.Trigge"
+    "rPollResponse\")\310\363\030\002\202\323\344\223\002\037\032\032/ConfigServic"
+    "e/TriggerPoll:\001*\022\225\001\n\020TriggerPollBurst\022\'."
+    "xtcp_config.v1.TriggerPollBurstRequest\032("
+    ".xtcp_config.v1.TriggerPollBurstResponse"
+    "\".\310\363\030\002\202\323\344\223\002$\032\037/ConfigService/TriggerPoll"
+    "Burst:\001*\022\201\001\n\013SetS3Upload\022\".xtcp_config.v"
+    "1.SetS3UploadRequest\032#.xtcp_config.v1.Se"
+    "tS3UploadResponse\")\310\363\030\002\202\323\344\223\002\037\032\032/ConfigSe"
+    "rvice/SetS3Upload:\001*\022\225\001\n\020SetEnvelopeFlus"
+    "h\022\'.xtcp_config.v1.SetEnvelopeFlushReque"
+    "st\032(.xtcp_config.v1.SetEnvelopeFlushResp"
+    "onse\".\310\363\030\002\202\323\344\223\002$\032\037/ConfigService/SetEnve"
+    "lopeFlush:\001*B\257\001\n\022com.xtcp_config.v1B\017Xtc"
+    "pConfigProtoP\001Z3github.com/randomizedcod"
+    "er/xtcp2/gen/go/xtcp_config\242\002\003XXX\252\002\rXtcp"
+    "Config.V1\312\002\rXtcpConfig\\V1\342\002\031XtcpConfig\\V"
+    "1\\GPBMetadata\352\002\016XtcpConfig::V1b\006proto3"
 };
 static const ::_pbi::DescriptorTable* PROTOBUF_NONNULL const
     descriptor_table_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2eproto_deps[4] = {
@@ -4523,7 +4538,7 @@ static ::absl::once_flag descriptor_table_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2ep
 PROTOBUF_CONSTINIT const ::_pbi::DescriptorTable descriptor_table_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2eproto = {
     false,
     false,
-    11143,
+    11238,
     descriptor_table_protodef_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2eproto,
     "xtcp_config/v1/xtcp_config.proto",
     &descriptor_table_xtcp_5fconfig_2fv1_2fxtcp_5fconfig_2eproto_once,
@@ -9013,42 +9028,42 @@ ::google::protobuf::Metadata LinkMonitorConfig::GetMetadata() const {
 void XtcpConfig::clear_poll_frequency() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.poll_frequency_ != nullptr) _impl_.poll_frequency_->Clear();
-  ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
 }
 void XtcpConfig::clear_poll_timeout() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.poll_timeout_ != nullptr) _impl_.poll_timeout_->Clear();
-  ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
 }
 void XtcpConfig::clear_reconcile_frequency() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.reconcile_frequency_ != nullptr) _impl_.reconcile_frequency_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
 }
 void XtcpConfig::clear_kafka_produce_timeout() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.kafka_produce_timeout_ != nullptr) _impl_.kafka_produce_timeout_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
 }
 void XtcpConfig::clear_s3_flush_interval() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.s3_flush_interval_ != nullptr) _impl_.s3_flush_interval_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
 }
 void XtcpConfig::clear_s3_upload_backoff_cap() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.s3_upload_backoff_cap_ != nullptr) _impl_.s3_upload_backoff_cap_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
 }
 void XtcpConfig::clear_asn_refresh_interval() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.asn_refresh_interval_ != nullptr) _impl_.asn_refresh_interval_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
 }
 void XtcpConfig::clear_locality_refresh_interval() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.locality_refresh_interval_ != nullptr) _impl_.locality_refresh_interval_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x01000000U);
 }
 XtcpConfig::XtcpConfig(::google::protobuf::Arena* PROTOBUF_NULLABLE arena)
 #if defined(PROTOBUF_CUSTOM_VTABLE)
@@ -9068,7 +9083,6 @@ PROTOBUF_NDEBUG_INLINE XtcpConfig::Impl_::Impl_(
         marshal_to_(arena, from.marshal_to_),
         csv_columns_(arena, from.csv_columns_),
         xtcp_proto_file_(arena, from.xtcp_proto_file_),
-        pyroscope_app_name_(arena, from.pyroscope_app_name_),
         uplink_interfaces_ {
           visibility, ::_pbi::InternalMetadataOffset::Build<
               ::xtcp_config::v1::XtcpConfig,
@@ -9086,12 +9100,14 @@ PROTOBUF_NDEBUG_INLINE XtcpConfig::Impl_::Impl_(
         s3_prefix_(arena, from.s3_prefix_),
         s3_access_key_(arena, from.s3_access_key_),
         s3_secret_key_(arena, from.s3_secret_key_),
+        s3_ca_file_(arena, from.s3_ca_file_),
         hostname_(arena, from.hostname_),
         location_(arena, from.location_),
         label_(arena, from.label_),
         tag_(arena, from.tag_),
         daemon_version_(arena, from.daemon_version_),
         pyroscope_url_(arena, from.pyroscope_url_),
+        pyroscope_app_name_(arena, from.pyroscope_app_name_),
         docker_socket_path_(arena, from.docker_socket_path_),
         lldpd_socket_path_(arena, from.lldpd_socket_path_),
         lldpd_version_hint_(arena, from.lldpd_version_hint_),
@@ -9114,54 +9130,54 @@ XtcpConfig::XtcpConfig(
       from._internal_metadata_);
   new (&_impl_) Impl_(internal_visibility(), arena, from._impl_, from);
   ::uint32_t cached_has_bits = _impl_._has_bits_[0];
-  _impl_.poll_frequency_ = (CheckHasBit(cached_has_bits, 0x00000020U))
+  _impl_.poll_frequency_ = (CheckHasBit(cached_has_bits, 0x00000010U))
                  ? Super_::CopyConstruct(arena, *from._impl_.poll_frequency_)
                  : nullptr;
-  _impl_.poll_timeout_ = (CheckHasBit(cached_has_bits, 0x00000040U))
+  _impl_.poll_timeout_ = (CheckHasBit(cached_has_bits, 0x00000020U))
                  ? Super_::CopyConstruct(arena, *from._impl_.poll_timeout_)
                  : nullptr;
-  _impl_.enabled_deserializers_ = (CheckHasBit(cached_has_bits, 0x00000080U))
+  _impl_.enabled_deserializers_ = (CheckHasBit(cached_has_bits, 0x00000040U))
                  ? Super_::CopyConstruct(arena, *from._impl_.enabled_deserializers_)
                  : nullptr;
   ::memcpy(reinterpret_cast<char*>(&_impl_) +
                offsetof(Impl_, nl_timeout_milliseconds_),
            reinterpret_cast<const char*>(&from._impl_) +
                offsetof(Impl_, nl_timeout_milliseconds_),
-           offsetof(Impl_, s3_skip_bucket_probe_) -
+           offsetof(Impl_, s3_allow_insecure_) -
                offsetof(Impl_, nl_timeout_milliseconds_) +
-               sizeof(Impl_::s3_skip_bucket_probe_));
+               sizeof(Impl_::s3_allow_insecure_));
   cached_has_bits = _impl_._has_bits_[1];
-  _impl_.reconcile_frequency_ = (CheckHasBit(cached_has_bits, 0x00002000U))
+  _impl_.reconcile_frequency_ = (CheckHasBit(cached_has_bits, 0x00008000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.reconcile_frequency_)
                  : nullptr;
-  _impl_.kafka_produce_timeout_ = (CheckHasBit(cached_has_bits, 0x00004000U))
+  _impl_.kafka_produce_timeout_ = (CheckHasBit(cached_has_bits, 0x00010000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.kafka_produce_timeout_)
                  : nullptr;
-  _impl_.s3_flush_interval_ = (CheckHasBit(cached_has_bits, 0x00008000U))
+  _impl_.s3_flush_interval_ = (CheckHasBit(cached_has_bits, 0x00020000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.s3_flush_interval_)
                  : nullptr;
-  _impl_.s3_upload_backoff_cap_ = (CheckHasBit(cached_has_bits, 0x00010000U))
+  _impl_.s3_upload_backoff_cap_ = (CheckHasBit(cached_has_bits, 0x00040000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.s3_upload_backoff_cap_)
                  : nullptr;
-  _impl_.listener_auth_ = (CheckHasBit(cached_has_bits, 0x00020000U))
+  _impl_.listener_auth_ = (CheckHasBit(cached_has_bits, 0x00080000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.listener_auth_)
                  : nullptr;
-  _impl_.prometheus_listener_ = (CheckHasBit(cached_has_bits, 0x00040000U))
+  _impl_.prometheus_listener_ = (CheckHasBit(cached_has_bits, 0x00100000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.prometheus_listener_)
                  : nullptr;
-  _impl_.admin_listener_auth_ = (CheckHasBit(cached_has_bits, 0x00080000U))
+  _impl_.admin_listener_auth_ = (CheckHasBit(cached_has_bits, 0x00200000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.admin_listener_auth_)
                  : nullptr;
-  _impl_.grpc_listener_ = (CheckHasBit(cached_has_bits, 0x00100000U))
+  _impl_.grpc_listener_ = (CheckHasBit(cached_has_bits, 0x00400000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.grpc_listener_)
                  : nullptr;
-  _impl_.asn_refresh_interval_ = (CheckHasBit(cached_has_bits, 0x00200000U))
+  _impl_.asn_refresh_interval_ = (CheckHasBit(cached_has_bits, 0x00800000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.asn_refresh_interval_)
                  : nullptr;
-  _impl_.locality_refresh_interval_ = (CheckHasBit(cached_has_bits, 0x00400000U))
+  _impl_.locality_refresh_interval_ = (CheckHasBit(cached_has_bits, 0x01000000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.locality_refresh_interval_)
                  : nullptr;
-  _impl_.link_monitor_ = (CheckHasBit(cached_has_bits, 0x00800000U))
+  _impl_.link_monitor_ = (CheckHasBit(cached_has_bits, 0x02000000U))
                  ? Super_::CopyConstruct(arena, *from._impl_.link_monitor_)
                  : nullptr;
   ::memcpy(reinterpret_cast<char*>(&_impl_) +
@@ -9181,7 +9197,6 @@ PROTOBUF_NDEBUG_INLINE XtcpConfig::Impl_::Impl_(
         marshal_to_(arena),
         csv_columns_(arena),
         xtcp_proto_file_(arena),
-        pyroscope_app_name_(arena),
         uplink_interfaces_ { visibility, ::_pbi::InternalMetadataOffset::Build<
             ::xtcp_config::v1::XtcpConfig,
             PROTOBUF_FIELD_OFFSET(::xtcp_config::v1::XtcpConfig, _impl_.uplink_interfaces_)>()
@@ -9197,12 +9212,14 @@ PROTOBUF_NDEBUG_INLINE XtcpConfig::Impl_::Impl_(
         s3_prefix_(arena),
         s3_access_key_(arena),
         s3_secret_key_(arena),
+        s3_ca_file_(arena),
         hostname_(arena),
         location_(arena),
         label_(arena),
         tag_(arena),
         daemon_version_(arena),
         pyroscope_url_(arena),
+        pyroscope_app_name_(arena),
         docker_socket_path_(arena),
         lldpd_socket_path_(arena),
         lldpd_version_hint_(arena),
@@ -9215,9 +9232,9 @@ inline void XtcpConfig::SharedCtor(::_pb::Arena* PROTOBUF_NULLABLE arena) {
   ::memset(reinterpret_cast<char*>(&_impl_) +
                offsetof(Impl_, poll_frequency_),
            0,
-           offsetof(Impl_, s3_skip_bucket_probe_) -
+           offsetof(Impl_, s3_allow_insecure_) -
                offsetof(Impl_, poll_frequency_) +
-               sizeof(Impl_::s3_skip_bucket_probe_));
+               sizeof(Impl_::s3_allow_insecure_));
   ::memset(reinterpret_cast<char*>(&_impl_) +
                offsetof(Impl_, reconcile_frequency_),
            0,
@@ -9240,7 +9257,6 @@ inline void XtcpConfig::SharedDtor(MessageLite& self) {
   this_._impl_.marshal_to_.Destroy();
   this_._impl_.csv_columns_.Destroy();
   this_._impl_.xtcp_proto_file_.Destroy();
-  this_._impl_.pyroscope_app_name_.Destroy();
   delete this_._impl_.poll_frequency_;
   delete this_._impl_.poll_timeout_;
   delete this_._impl_.enabled_deserializers_;
@@ -9254,12 +9270,14 @@ inline void XtcpConfig::SharedDtor(MessageLite& self) {
   this_._impl_.s3_prefix_.Destroy();
   this_._impl_.s3_access_key_.Destroy();
   this_._impl_.s3_secret_key_.Destroy();
+  this_._impl_.s3_ca_file_.Destroy();
   this_._impl_.hostname_.Destroy();
   this_._impl_.location_.Destroy();
   this_._impl_.label_.Destroy();
   this_._impl_.tag_.Destroy();
   this_._impl_.daemon_version_.Destroy();
   this_._impl_.pyroscope_url_.Destroy();
+  this_._impl_.pyroscope_app_name_.Destroy();
   this_._impl_.docker_socket_path_.Destroy();
   this_._impl_.lldpd_socket_path_.Destroy();
   this_._impl_.lldpd_version_hint_.Destroy();
@@ -9313,7 +9331,7 @@ PROTOBUF_NOINLINE void XtcpConfig::Clear() {
   ::uint32_t cached_has_bits [[maybe_unused]] = 0;
 
   cached_has_bits = this_._impl_._has_bits_[0];
-  if (BatchCheckHasBit(cached_has_bits, 0x000000ffU)) {
+  if (BatchCheckHasBit(cached_has_bits, 0x0000007fU)) {
     if (CheckHasBit(cached_has_bits, 0x00000001U)) {
       this_._impl_.dest_.ClearNonDefaultToEmpty();
     }
@@ -9327,34 +9345,32 @@ PROTOBUF_NOINLINE void XtcpConfig::Clear() {
       this_._impl_.xtcp_proto_file_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000010U)) {
-      this_._impl_.pyroscope_app_name_.ClearNonDefaultToEmpty();
-    }
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       ABSL_DCHECK(this_._impl_.poll_frequency_ != nullptr);
       this_._impl_.poll_frequency_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       ABSL_DCHECK(this_._impl_.poll_timeout_ != nullptr);
       this_._impl_.poll_timeout_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       ABSL_DCHECK(this_._impl_.enabled_deserializers_ != nullptr);
       this_._impl_.enabled_deserializers_->Clear();
     }
   }
+  this_._impl_.nl_timeout_milliseconds_ = ::uint64_t{0u};
   if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
-    ::memset(&this_._impl_.nl_timeout_milliseconds_, 0,
+    ::memset(&this_._impl_.max_loops_, 0,
              static_cast<::size_t>(
-                 reinterpret_cast<char*>(&this_._impl_.modulus_) -
-                 reinterpret_cast<char*>(&this_._impl_.nl_timeout_milliseconds_)) +
-                 sizeof(_impl_.modulus_));
+                 reinterpret_cast<char*>(&this_._impl_.packet_size_mply_) -
+                 reinterpret_cast<char*>(&this_._impl_.max_loops_)) +
+                 sizeof(_impl_.packet_size_mply_));
   }
   if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
-    ::memset(&this_._impl_.packet_size_mply_, 0,
+    ::memset(&this_._impl_.io_uring_recv_batch_size_, 0,
              static_cast<::size_t>(
-                 reinterpret_cast<char*>(&this_._impl_.s3_skip_bucket_probe_) -
-                 reinterpret_cast<char*>(&this_._impl_.packet_size_mply_)) +
-                 sizeof(_impl_.s3_skip_bucket_probe_));
+                 reinterpret_cast<char*>(&this_._impl_.s3_allow_insecure_) -
+                 reinterpret_cast<char*>(&this_._impl_.io_uring_recv_batch_size_)) +
+                 sizeof(_impl_.s3_allow_insecure_));
     if (CheckHasBit(cached_has_bits, 0x00400000U)) {
       _impl_.uplink_interfaces_.Clear();
     }
@@ -9394,110 +9410,125 @@ PROTOBUF_NOINLINE void XtcpConfig::Clear() {
       this_._impl_.s3_secret_key_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000002U)) {
-      this_._impl_.hostname_.ClearNonDefaultToEmpty();
+      this_._impl_.s3_ca_file_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000004U)) {
-      this_._impl_.location_.ClearNonDefaultToEmpty();
+      this_._impl_.hostname_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000008U)) {
-      this_._impl_.label_.ClearNonDefaultToEmpty();
+      this_._impl_.location_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000010U)) {
-      this_._impl_.tag_.ClearNonDefaultToEmpty();
+      this_._impl_.label_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000020U)) {
-      this_._impl_.daemon_version_.ClearNonDefaultToEmpty();
+      this_._impl_.tag_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000040U)) {
-      this_._impl_.pyroscope_url_.ClearNonDefaultToEmpty();
+      this_._impl_.daemon_version_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000080U)) {
-      this_._impl_.docker_socket_path_.ClearNonDefaultToEmpty();
+      this_._impl_.pyroscope_url_.ClearNonDefaultToEmpty();
     }
   }
   if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
     if (CheckHasBit(cached_has_bits, 0x00000100U)) {
-      this_._impl_.lldpd_socket_path_.ClearNonDefaultToEmpty();
+      this_._impl_.pyroscope_app_name_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000200U)) {
-      this_._impl_.lldpd_version_hint_.ClearNonDefaultToEmpty();
+      this_._impl_.docker_socket_path_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000400U)) {
-      this_._impl_.asn_db_path_.ClearNonDefaultToEmpty();
+      this_._impl_.lldpd_socket_path_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00000800U)) {
-      this_._impl_.ipmeta_bootstrap_path_.ClearNonDefaultToEmpty();
+      this_._impl_.lldpd_version_hint_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00001000U)) {
-      this_._impl_.ipmeta_cache_path_.ClearNonDefaultToEmpty();
+      this_._impl_.asn_db_path_.ClearNonDefaultToEmpty();
     }
     if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+      this_._impl_.ipmeta_bootstrap_path_.ClearNonDefaultToEmpty();
+    }
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+      this_._impl_.ipmeta_cache_path_.ClearNonDefaultToEmpty();
+    }
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       ABSL_DCHECK(this_._impl_.reconcile_frequency_ != nullptr);
       this_._impl_.reconcile_frequency_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       ABSL_DCHECK(this_._impl_.kafka_produce_timeout_ != nullptr);
       this_._impl_.kafka_produce_timeout_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       ABSL_DCHECK(this_._impl_.s3_flush_interval_ != nullptr);
       this_._impl_.s3_flush_interval_->Clear();
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
-    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
       ABSL_DCHECK(this_._impl_.s3_upload_backoff_cap_ != nullptr);
       this_._impl_.s3_upload_backoff_cap_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
       ABSL_DCHECK(this_._impl_.listener_auth_ != nullptr);
       this_._impl_.listener_auth_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
       ABSL_DCHECK(this_._impl_.prometheus_listener_ != nullptr);
       this_._impl_.prometheus_listener_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
       ABSL_DCHECK(this_._impl_.admin_listener_auth_ != nullptr);
       this_._impl_.admin_listener_auth_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00400000U)) {
       ABSL_DCHECK(this_._impl_.grpc_listener_ != nullptr);
       this_._impl_.grpc_listener_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00800000U)) {
       ABSL_DCHECK(this_._impl_.asn_refresh_interval_ != nullptr);
       this_._impl_.asn_refresh_interval_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00400000U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x03000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x01000000U)) {
       ABSL_DCHECK(this_._impl_.locality_refresh_interval_ != nullptr);
       this_._impl_.locality_refresh_interval_->Clear();
     }
-    if (CheckHasBit(cached_has_bits, 0x00800000U)) {
+    if (CheckHasBit(cached_has_bits, 0x02000000U)) {
       ABSL_DCHECK(this_._impl_.link_monitor_ != nullptr);
       this_._impl_.link_monitor_->Clear();
     }
   }
-  if (BatchCheckHasBit(cached_has_bits, 0xff000000U)) {
+  if (BatchCheckHasBit(cached_has_bits, 0xfc000000U)) {
     ::memset(&this_._impl_.write_files_, 0,
              static_cast<::size_t>(
-                 reinterpret_cast<char*>(&this_._impl_.s3_flush_threshold_jitter_pct_) -
+                 reinterpret_cast<char*>(&this_._impl_.s3_parquet_flush_threshold_bytes_) -
                  reinterpret_cast<char*>(&this_._impl_.write_files_)) +
-                 sizeof(_impl_.s3_flush_threshold_jitter_pct_));
+                 sizeof(_impl_.s3_parquet_flush_threshold_bytes_));
   }
   cached_has_bits = this_._impl_._has_bits_[2];
   if (BatchCheckHasBit(cached_has_bits, 0x000000ffU)) {
-    ::memset(&this_._impl_.s3_upload_max_attempts_, 0,
+    ::memset(&this_._impl_.s3_flush_jitter_pct_, 0,
              static_cast<::size_t>(
-                 reinterpret_cast<char*>(&this_._impl_.enrich_lldp_enable_) -
-                 reinterpret_cast<char*>(&this_._impl_.s3_upload_max_attempts_)) +
-                 sizeof(_impl_.enrich_lldp_enable_));
+                 reinterpret_cast<char*>(&this_._impl_.resolve_container_id_) -
+                 reinterpret_cast<char*>(&this_._impl_.s3_flush_jitter_pct_)) +
+                 sizeof(_impl_.resolve_container_id_));
   }
   if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
-    ::memset(&this_._impl_.pyroscope_sample_hz_, 0,
+    ::memset(&this_._impl_.enrich_container_enable_, 0,
+             static_cast<::size_t>(
+                 reinterpret_cast<char*>(&this_._impl_.enrich_asn_enable_) -
+                 reinterpret_cast<char*>(&this_._impl_.enrich_container_enable_)) +
+                 sizeof(_impl_.enrich_asn_enable_));
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00030000U)) {
+    ::memset(&this_._impl_.enrich_locality_enable_, 0,
              static_cast<::size_t>(
                  reinterpret_cast<char*>(&this_._impl_.locality_events_enable_) -
-                 reinterpret_cast<char*>(&this_._impl_.pyroscope_sample_hz_)) +
+                 reinterpret_cast<char*>(&this_._impl_.enrich_locality_enable_)) +
                  sizeof(_impl_.locality_events_enable_));
   }
   _impl_._has_bits_.Clear();
@@ -9524,7 +9555,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[0];
   // uint64 nl_timeout_milliseconds = 10 [json_name = "nlTimeoutMilliseconds", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000080U)) {
     if (this_._internal_nl_timeout_milliseconds() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt64ToArray(
@@ -9533,21 +9564,21 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // .google.protobuf.Duration poll_frequency = 11 [json_name = "pollFrequency", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000010U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         11, *this_._impl_.poll_frequency_, this_._impl_.poll_frequency_->GetCachedSize(), target,
         stream);
   }
 
   // .google.protobuf.Duration poll_timeout = 12 [json_name = "pollTimeout", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000020U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         12, *this_._impl_.poll_timeout_, this_._impl_.poll_timeout_->GetCachedSize(), target,
         stream);
   }
 
   // uint32 poll_jitter_pct = 13 [json_name = "pollJitterPct", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000200U)) {
     if (this_._internal_poll_jitter_pct() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9556,7 +9587,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint64 max_loops = 14 [json_name = "maxLoops", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000100U)) {
     if (this_._internal_max_loops() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt64ToArray(
@@ -9565,7 +9596,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 netlinkers = 15 [json_name = "netlinkers", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000400U)) {
     if (this_._internal_netlinkers() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9574,7 +9605,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 netlinkers_done_chan_size = 16 [json_name = "netlinkersDoneChanSize", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000800U)) {
     if (this_._internal_netlinkers_done_chan_size() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9583,7 +9614,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 nlmsg_seq = 17 [json_name = "nlmsgSeq", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00001000U)) {
     if (this_._internal_nlmsg_seq() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9592,7 +9623,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint64 packet_size = 18 [json_name = "packetSize", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00002000U)) {
     if (this_._internal_packet_size() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt64ToArray(
@@ -9601,7 +9632,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 packet_size_mply = 19 [json_name = "packetSizeMply", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00008000U)) {
     if (this_._internal_packet_size_mply() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9610,7 +9641,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint64 modulus = 20 [json_name = "modulus", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00004000U)) {
     if (this_._internal_modulus() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt64ToArray(
@@ -9619,14 +9650,14 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // .xtcp_config.v1.EnabledDeserializers enabled_deserializers = 21 [json_name = "enabledDeserializers", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000040U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         21, *this_._impl_.enabled_deserializers_, this_._impl_.enabled_deserializers_->GetCachedSize(), target,
         stream);
   }
 
   // bool io_uring = 22 [json_name = "ioUring", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00040000U)) {
     if (this_._internal_io_uring() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -9635,7 +9666,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 io_uring_recv_batch_size = 23 [json_name = "ioUringRecvBatchSize", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00010000U)) {
     if (this_._internal_io_uring_recv_batch_size() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9644,7 +9675,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 io_uring_cqe_batch_size = 24 [json_name = "ioUringCqeBatchSize", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00020000U)) {
     if (this_._internal_io_uring_cqe_batch_size() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9654,7 +9685,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .google.protobuf.Duration reconcile_frequency = 40 [json_name = "reconcileFrequency", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00008000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         40, *this_._impl_.reconcile_frequency_, this_._impl_.reconcile_frequency_->GetCachedSize(), target,
         stream);
@@ -9662,7 +9693,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[0];
   // bool reconcile_before_poll = 41 [json_name = "reconcileBeforePoll"];
-  if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00080000U)) {
     if (this_._internal_reconcile_before_poll() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -9672,7 +9703,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // uint32 write_files = 50 [json_name = "writeFiles", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x01000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x04000000U)) {
     if (this_._internal_write_files() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9693,7 +9724,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // uint32 dest_write_files = 52 [json_name = "destWriteFiles", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x02000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x08000000U)) {
     if (this_._internal_dest_write_files() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9702,7 +9733,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 debug_level = 53 [json_name = "debugLevel", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x04000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x10000000U)) {
     if (this_._internal_debug_level() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9712,7 +9743,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // bool debug_prometheus = 54 [json_name = "debugPrometheus", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000040U)) {
     if (this_._internal_debug_prometheus() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -9763,7 +9794,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // uint32 envelope_flush_threshold_bytes = 64 [json_name = "envelopeFlushThresholdBytes", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x08000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x20000000U)) {
     if (this_._internal_envelope_flush_threshold_bytes() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9772,7 +9803,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 envelope_flush_threshold_rows = 65 [json_name = "envelopeFlushThresholdRows", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x10000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x40000000U)) {
     if (this_._internal_envelope_flush_threshold_rows() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9803,7 +9834,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .google.protobuf.Duration kafka_produce_timeout = 82 [json_name = "kafkaProduceTimeout", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00010000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         82, *this_._impl_.kafka_produce_timeout_, this_._impl_.kafka_produce_timeout_->GetCachedSize(), target,
         stream);
@@ -9883,7 +9914,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[0];
   // bool s3_skip_bucket_probe = 106 [json_name = "s3SkipBucketProbe", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00100000U)) {
     if (this_._internal_s3_skip_bucket_probe() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -9891,9 +9922,28 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
     }
   }
 
+  // bool s3_allow_insecure = 107 [json_name = "s3AllowInsecure", (.buf.validate.field) = {
+  if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+    if (this_._internal_s3_allow_insecure() != 0) {
+      target = stream->EnsureSpace(target);
+      target = ::_pbi::WireFormatLite::WriteBoolToArray(
+          107, this_._internal_s3_allow_insecure(), target);
+    }
+  }
+
   cached_has_bits = this_._impl_._has_bits_[1];
+  // string s3_ca_file = 108 [json_name = "s3CaFile", (.buf.validate.field) = {
+  if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+    if (!this_._internal_s3_ca_file().empty()) {
+      const ::std::string& _s = this_._internal_s3_ca_file();
+      ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
+          _s.data(), static_cast<int>(_s.length()), ::google::protobuf::internal::WireFormatLite::SERIALIZE, "xtcp_config.v1.XtcpConfig.s3_ca_file");
+      target = stream->WriteStringMaybeAliased(108, _s, target);
+    }
+  }
+
   // uint32 s3_parquet_flush_threshold_bytes = 110 [json_name = "s3ParquetFlushThresholdBytes", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x20000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x80000000U)) {
     if (this_._internal_s3_parquet_flush_threshold_bytes() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9902,14 +9952,15 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // .google.protobuf.Duration s3_flush_interval = 111 [json_name = "s3FlushInterval", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00020000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         111, *this_._impl_.s3_flush_interval_, this_._impl_.s3_flush_interval_->GetCachedSize(), target,
         stream);
   }
 
+  cached_has_bits = this_._impl_._has_bits_[2];
   // uint32 s3_flush_jitter_pct = 112 [json_name = "s3FlushJitterPct", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x40000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000001U)) {
     if (this_._internal_s3_flush_jitter_pct() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9918,7 +9969,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 s3_flush_threshold_jitter_pct = 113 [json_name = "s3FlushThresholdJitterPct", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x80000000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000002U)) {
     if (this_._internal_s3_flush_threshold_jitter_pct() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9926,9 +9977,8 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
     }
   }
 
-  cached_has_bits = this_._impl_._has_bits_[2];
   // uint32 s3_upload_max_attempts = 114 [json_name = "s3UploadMaxAttempts", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000001U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000004U)) {
     if (this_._internal_s3_upload_max_attempts() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -9938,14 +9988,14 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .google.protobuf.Duration s3_upload_backoff_cap = 115 [json_name = "s3UploadBackoffCap", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00040000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         115, *this_._impl_.s3_upload_backoff_cap_, this_._impl_.s3_upload_backoff_cap_->GetCachedSize(), target,
         stream);
   }
 
   // string hostname = 130 [json_name = "hostname", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000004U)) {
     if (!this_._internal_hostname().empty()) {
       const ::std::string& _s = this_._internal_hostname();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -9955,7 +10005,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // string location = 131 [json_name = "location", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000004U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000008U)) {
     if (!this_._internal_location().empty()) {
       const ::std::string& _s = this_._internal_location();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -9965,7 +10015,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // string label = 132 [json_name = "label", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000008U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000010U)) {
     if (!this_._internal_label().empty()) {
       const ::std::string& _s = this_._internal_label();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -9975,7 +10025,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // string tag = 133 [json_name = "tag", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000020U)) {
     if (!this_._internal_tag().empty()) {
       const ::std::string& _s = this_._internal_tag();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -9985,7 +10035,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // string daemon_version = 134 [json_name = "daemonVersion", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000040U)) {
     if (!this_._internal_daemon_version().empty()) {
       const ::std::string& _s = this_._internal_daemon_version();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -9996,7 +10046,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // uint32 ipv4_ttl = 150 [json_name = "ipv4Ttl", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000008U)) {
     if (this_._internal_ipv4_ttl() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -10005,7 +10055,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 ipv6_hop_limit = 151 [json_name = "ipv6HopLimit", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000004U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000010U)) {
     if (this_._internal_ipv6_hop_limit() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -10015,21 +10065,21 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .xtcp_config.v1.ListenerAuth listener_auth = 152 [json_name = "listenerAuth", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00080000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         152, *this_._impl_.listener_auth_, this_._impl_.listener_auth_->GetCachedSize(), target,
         stream);
   }
 
   // .xtcp_config.v1.ListenerEndpoint prometheus_listener = 153 [json_name = "prometheusListener", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00100000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         153, *this_._impl_.prometheus_listener_, this_._impl_.prometheus_listener_->GetCachedSize(), target,
         stream);
   }
 
   // .xtcp_config.v1.ListenerAuth admin_listener_auth = 154 [json_name = "adminListenerAuth", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00200000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         154, *this_._impl_.admin_listener_auth_, this_._impl_.admin_listener_auth_->GetCachedSize(), target,
         stream);
@@ -10037,7 +10087,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // uint32 grpc_port = 160 [json_name = "grpcPort", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000008U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000020U)) {
     if (this_._internal_grpc_port() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -10047,14 +10097,14 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .xtcp_config.v1.ListenerEndpoint grpc_listener = 161 [json_name = "grpcListener", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00400000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         161, *this_._impl_.grpc_listener_, this_._impl_.grpc_listener_->GetCachedSize(), target,
         stream);
   }
 
   // string pyroscope_url = 170 [json_name = "pyroscopeUrl", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000080U)) {
     if (!this_._internal_pyroscope_url().empty()) {
       const ::std::string& _s = this_._internal_pyroscope_url();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10063,9 +10113,8 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
     }
   }
 
-  cached_has_bits = this_._impl_._has_bits_[0];
   // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000100U)) {
     if (!this_._internal_pyroscope_app_name().empty()) {
       const ::std::string& _s = this_._internal_pyroscope_app_name();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10076,7 +10125,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // uint32 pyroscope_sample_hz = 172 [json_name = "pyroscopeSampleHz", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000400U)) {
     if (this_._internal_pyroscope_sample_hz() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -10085,7 +10134,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 pyroscope_upload_interval_sec = 173 [json_name = "pyroscopeUploadIntervalSec", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000800U)) {
     if (this_._internal_pyroscope_upload_interval_sec() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -10094,7 +10143,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // bool resolve_container_id = 200 [json_name = "resolveContainerId", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000080U)) {
     if (this_._internal_resolve_container_id() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10103,7 +10152,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // bool enrich_container_enable = 201 [json_name = "enrichContainerEnable"];
-  if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000100U)) {
     if (this_._internal_enrich_container_enable() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10113,7 +10162,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // string docker_socket_path = 202 [json_name = "dockerSocketPath", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000200U)) {
     if (!this_._internal_docker_socket_path().empty()) {
       const ::std::string& _s = this_._internal_docker_socket_path();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10124,7 +10173,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // bool enrich_lldp_enable = 210 [json_name = "enrichLldpEnable"];
-  if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000200U)) {
     if (this_._internal_enrich_lldp_enable() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10134,7 +10183,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // string lldpd_socket_path = 211 [json_name = "lldpdSocketPath", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000400U)) {
     if (!this_._internal_lldpd_socket_path().empty()) {
       const ::std::string& _s = this_._internal_lldpd_socket_path();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10144,7 +10193,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // string lldpd_version_hint = 212 [json_name = "lldpdVersionHint", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+  if (CheckHasBit(cached_has_bits, 0x00000800U)) {
     if (!this_._internal_lldpd_version_hint().empty()) {
       const ::std::string& _s = this_._internal_lldpd_version_hint();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10155,7 +10204,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // bool enrich_nic_enable = 220 [json_name = "enrichNicEnable"];
-  if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+  if (CheckHasBit(cached_has_bits, 0x00002000U)) {
     if (this_._internal_enrich_nic_enable() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10164,7 +10213,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // uint32 uplink_count = 221 [json_name = "uplinkCount", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+  if (CheckHasBit(cached_has_bits, 0x00001000U)) {
     if (this_._internal_uplink_count() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteUInt32ToArray(
@@ -10185,7 +10234,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // bool populate_nsid = 230 [json_name = "populateNsid"];
-  if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00004000U)) {
     if (this_._internal_populate_nsid() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10194,7 +10243,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // bool enrich_asn_enable = 240 [json_name = "enrichAsnEnable"];
-  if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00008000U)) {
     if (this_._internal_enrich_asn_enable() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10204,7 +10253,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // string asn_db_path = 241 [json_name = "asnDbPath", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+  if (CheckHasBit(cached_has_bits, 0x00001000U)) {
     if (!this_._internal_asn_db_path().empty()) {
       const ::std::string& _s = this_._internal_asn_db_path();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10214,14 +10263,14 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // .google.protobuf.Duration asn_refresh_interval = 242 [json_name = "asnRefreshInterval"];
-  if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00800000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         242, *this_._impl_.asn_refresh_interval_, this_._impl_.asn_refresh_interval_->GetCachedSize(), target,
         stream);
   }
 
   // string ipmeta_bootstrap_path = 243 [json_name = "ipmetaBootstrapPath", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+  if (CheckHasBit(cached_has_bits, 0x00002000U)) {
     if (!this_._internal_ipmeta_bootstrap_path().empty()) {
       const ::std::string& _s = this_._internal_ipmeta_bootstrap_path();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10231,7 +10280,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
   }
 
   // string ipmeta_cache_path = 244 [json_name = "ipmetaCachePath", (.buf.validate.field) = {
-  if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00004000U)) {
     if (!this_._internal_ipmeta_cache_path().empty()) {
       const ::std::string& _s = this_._internal_ipmeta_cache_path();
       ::google::protobuf::internal::WireFormatLite::VerifyUtf8String(
@@ -10242,7 +10291,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // bool enrich_locality_enable = 245 [json_name = "enrichLocalityEnable"];
-  if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00010000U)) {
     if (this_._internal_enrich_locality_enable() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10252,7 +10301,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .google.protobuf.Duration locality_refresh_interval = 246 [json_name = "localityRefreshInterval"];
-  if (CheckHasBit(cached_has_bits, 0x00400000U)) {
+  if (CheckHasBit(cached_has_bits, 0x01000000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         246, *this_._impl_.locality_refresh_interval_, this_._impl_.locality_refresh_interval_->GetCachedSize(), target,
         stream);
@@ -10260,7 +10309,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[2];
   // bool locality_events_enable = 247 [json_name = "localityEventsEnable"];
-  if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+  if (CheckHasBit(cached_has_bits, 0x00020000U)) {
     if (this_._internal_locality_events_enable() != 0) {
       target = stream->EnsureSpace(target);
       target = ::_pbi::WireFormatLite::WriteBoolToArray(
@@ -10270,7 +10319,7 @@ ::uint8_t* PROTOBUF_NONNULL XtcpConfig::_InternalSerialize(
 
   cached_has_bits = this_._impl_._has_bits_[1];
   // .xtcp_config.v1.LinkMonitorConfig link_monitor = 250 [json_name = "linkMonitor"];
-  if (CheckHasBit(cached_has_bits, 0x00800000U)) {
+  if (CheckHasBit(cached_has_bits, 0x02000000U)) {
     target = ::google::protobuf::internal::WireFormatLite::InternalWriteMessage(
         250, *this_._impl_.link_monitor_, this_._impl_.link_monitor_->GetCachedSize(), target,
         stream);
@@ -10328,127 +10377,126 @@ ::size_t XtcpConfig::ByteSizeLong() const {
                                         this_._internal_xtcp_proto_file());
       }
     }
-    // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
-      if (!this_._internal_pyroscope_app_name().empty()) {
-        total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
-                                        this_._internal_pyroscope_app_name());
-      }
-    }
     // .google.protobuf.Duration poll_frequency = 11 [json_name = "pollFrequency", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
       total_size += 1 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.poll_frequency_);
     }
     // .google.protobuf.Duration poll_timeout = 12 [json_name = "pollTimeout", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       total_size += 1 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.poll_timeout_);
     }
     // .xtcp_config.v1.EnabledDeserializers enabled_deserializers = 21 [json_name = "enabledDeserializers", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.enabled_deserializers_);
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
     // uint64 nl_timeout_milliseconds = 10 [json_name = "nlTimeoutMilliseconds", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
       if (this_._internal_nl_timeout_milliseconds() != 0) {
         total_size += ::_pbi::WireFormatLite::UInt64SizePlusOne(
             this_._internal_nl_timeout_milliseconds());
       }
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
     // uint64 max_loops = 14 [json_name = "maxLoops", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
       if (this_._internal_max_loops() != 0) {
         total_size += ::_pbi::WireFormatLite::UInt64SizePlusOne(
             this_._internal_max_loops());
       }
     }
     // uint32 poll_jitter_pct = 13 [json_name = "pollJitterPct", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
       if (this_._internal_poll_jitter_pct() != 0) {
         total_size += ::_pbi::WireFormatLite::UInt32SizePlusOne(
             this_._internal_poll_jitter_pct());
       }
     }
     // uint32 netlinkers = 15 [json_name = "netlinkers", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
       if (this_._internal_netlinkers() != 0) {
         total_size += ::_pbi::WireFormatLite::UInt32SizePlusOne(
             this_._internal_netlinkers());
       }
     }
     // uint32 netlinkers_done_chan_size = 16 [json_name = "netlinkersDoneChanSize", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
       if (this_._internal_netlinkers_done_chan_size() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_netlinkers_done_chan_size());
       }
     }
     // uint32 nlmsg_seq = 17 [json_name = "nlmsgSeq", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
       if (this_._internal_nlmsg_seq() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_nlmsg_seq());
       }
     }
     // uint64 packet_size = 18 [json_name = "packetSize", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
       if (this_._internal_packet_size() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt64Size(
                                         this_._internal_packet_size());
       }
     }
     // uint64 modulus = 20 [json_name = "modulus", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
       if (this_._internal_modulus() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt64Size(
                                         this_._internal_modulus());
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
     // uint32 packet_size_mply = 19 [json_name = "packetSizeMply", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       if (this_._internal_packet_size_mply() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_packet_size_mply());
       }
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
     // uint32 io_uring_recv_batch_size = 23 [json_name = "ioUringRecvBatchSize", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       if (this_._internal_io_uring_recv_batch_size() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_io_uring_recv_batch_size());
       }
     }
     // uint32 io_uring_cqe_batch_size = 24 [json_name = "ioUringCqeBatchSize", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       if (this_._internal_io_uring_cqe_batch_size() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_io_uring_cqe_batch_size());
       }
     }
     // bool io_uring = 22 [json_name = "ioUring", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
       if (this_._internal_io_uring() != 0) {
         total_size += 3;
       }
     }
     // bool reconcile_before_poll = 41 [json_name = "reconcileBeforePoll"];
-    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
       if (this_._internal_reconcile_before_poll() != 0) {
         total_size += 3;
       }
     }
     // bool s3_skip_bucket_probe = 106 [json_name = "s3SkipBucketProbe", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
       if (this_._internal_s3_skip_bucket_probe() != 0) {
         total_size += 3;
       }
     }
+    // bool s3_allow_insecure = 107 [json_name = "s3AllowInsecure", (.buf.validate.field) = {
+    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+      if (this_._internal_s3_allow_insecure() != 0) {
+        total_size += 3;
+      }
+    }
     // repeated string uplink_interfaces = 222 [json_name = "uplinkInterfaces", (.buf.validate.field) = {
     if (CheckHasBit(cached_has_bits, 0x00400000U)) {
       total_size +=
@@ -10533,311 +10581,327 @@ ::size_t XtcpConfig::ByteSizeLong() const {
                                         this_._internal_s3_secret_key());
       }
     }
-    // string hostname = 130 [json_name = "hostname", (.buf.validate.field) = {
+    // string s3_ca_file = 108 [json_name = "s3CaFile", (.buf.validate.field) = {
     if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+      if (!this_._internal_s3_ca_file().empty()) {
+        total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
+                                        this_._internal_s3_ca_file());
+      }
+    }
+    // string hostname = 130 [json_name = "hostname", (.buf.validate.field) = {
+    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
       if (!this_._internal_hostname().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_hostname());
       }
     }
     // string location = 131 [json_name = "location", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
       if (!this_._internal_location().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_location());
       }
     }
     // string label = 132 [json_name = "label", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
       if (!this_._internal_label().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_label());
       }
     }
     // string tag = 133 [json_name = "tag", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       if (!this_._internal_tag().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_tag());
       }
     }
     // string daemon_version = 134 [json_name = "daemonVersion", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       if (!this_._internal_daemon_version().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_daemon_version());
       }
     }
     // string pyroscope_url = 170 [json_name = "pyroscopeUrl", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
       if (!this_._internal_pyroscope_url().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_pyroscope_url());
       }
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
+    // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
+    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+      if (!this_._internal_pyroscope_app_name().empty()) {
+        total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
+                                        this_._internal_pyroscope_app_name());
+      }
+    }
     // string docker_socket_path = 202 [json_name = "dockerSocketPath", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
       if (!this_._internal_docker_socket_path().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_docker_socket_path());
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
     // string lldpd_socket_path = 211 [json_name = "lldpdSocketPath", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
       if (!this_._internal_lldpd_socket_path().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_lldpd_socket_path());
       }
     }
     // string lldpd_version_hint = 212 [json_name = "lldpdVersionHint", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
       if (!this_._internal_lldpd_version_hint().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_lldpd_version_hint());
       }
     }
     // string asn_db_path = 241 [json_name = "asnDbPath", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
       if (!this_._internal_asn_db_path().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_asn_db_path());
       }
     }
     // string ipmeta_bootstrap_path = 243 [json_name = "ipmetaBootstrapPath", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
       if (!this_._internal_ipmeta_bootstrap_path().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_ipmeta_bootstrap_path());
       }
     }
     // string ipmeta_cache_path = 244 [json_name = "ipmetaCachePath", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
       if (!this_._internal_ipmeta_cache_path().empty()) {
         total_size += 2 + ::google::protobuf::internal::WireFormatLite::StringSize(
                                         this_._internal_ipmeta_cache_path());
       }
     }
     // .google.protobuf.Duration reconcile_frequency = 40 [json_name = "reconcileFrequency", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.reconcile_frequency_);
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
     // .google.protobuf.Duration kafka_produce_timeout = 82 [json_name = "kafkaProduceTimeout", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.kafka_produce_timeout_);
     }
     // .google.protobuf.Duration s3_flush_interval = 111 [json_name = "s3FlushInterval", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.s3_flush_interval_);
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
     // .google.protobuf.Duration s3_upload_backoff_cap = 115 [json_name = "s3UploadBackoffCap", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.s3_upload_backoff_cap_);
     }
     // .xtcp_config.v1.ListenerAuth listener_auth = 152 [json_name = "listenerAuth", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.listener_auth_);
     }
     // .xtcp_config.v1.ListenerEndpoint prometheus_listener = 153 [json_name = "prometheusListener", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.prometheus_listener_);
     }
     // .xtcp_config.v1.ListenerAuth admin_listener_auth = 154 [json_name = "adminListenerAuth", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.admin_listener_auth_);
     }
     // .xtcp_config.v1.ListenerEndpoint grpc_listener = 161 [json_name = "grpcListener", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00400000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.grpc_listener_);
     }
     // .google.protobuf.Duration asn_refresh_interval = 242 [json_name = "asnRefreshInterval"];
-    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00800000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.asn_refresh_interval_);
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0xff000000U)) {
     // .google.protobuf.Duration locality_refresh_interval = 246 [json_name = "localityRefreshInterval"];
-    if (CheckHasBit(cached_has_bits, 0x00400000U)) {
+    if (CheckHasBit(cached_has_bits, 0x01000000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.locality_refresh_interval_);
     }
     // .xtcp_config.v1.LinkMonitorConfig link_monitor = 250 [json_name = "linkMonitor"];
-    if (CheckHasBit(cached_has_bits, 0x00800000U)) {
+    if (CheckHasBit(cached_has_bits, 0x02000000U)) {
       total_size += 2 +
                     ::google::protobuf::internal::WireFormatLite::MessageSize(*this_._impl_.link_monitor_);
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0xff000000U)) {
     // uint32 write_files = 50 [json_name = "writeFiles", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x01000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x04000000U)) {
       if (this_._internal_write_files() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_write_files());
       }
     }
     // uint32 dest_write_files = 52 [json_name = "destWriteFiles", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x02000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x08000000U)) {
       if (this_._internal_dest_write_files() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_dest_write_files());
       }
     }
     // uint32 debug_level = 53 [json_name = "debugLevel", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x04000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x10000000U)) {
       if (this_._internal_debug_level() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_debug_level());
       }
     }
     // uint32 envelope_flush_threshold_bytes = 64 [json_name = "envelopeFlushThresholdBytes", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x08000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x20000000U)) {
       if (this_._internal_envelope_flush_threshold_bytes() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_envelope_flush_threshold_bytes());
       }
     }
     // uint32 envelope_flush_threshold_rows = 65 [json_name = "envelopeFlushThresholdRows", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x10000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x40000000U)) {
       if (this_._internal_envelope_flush_threshold_rows() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_envelope_flush_threshold_rows());
       }
     }
     // uint32 s3_parquet_flush_threshold_bytes = 110 [json_name = "s3ParquetFlushThresholdBytes", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x20000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x80000000U)) {
       if (this_._internal_s3_parquet_flush_threshold_bytes() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_s3_parquet_flush_threshold_bytes());
       }
     }
+  }
+  cached_has_bits = this_._impl_._has_bits_[2];
+  if (BatchCheckHasBit(cached_has_bits, 0x000000ffU)) {
     // uint32 s3_flush_jitter_pct = 112 [json_name = "s3FlushJitterPct", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x40000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000001U)) {
       if (this_._internal_s3_flush_jitter_pct() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_s3_flush_jitter_pct());
       }
     }
     // uint32 s3_flush_threshold_jitter_pct = 113 [json_name = "s3FlushThresholdJitterPct", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x80000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000002U)) {
       if (this_._internal_s3_flush_threshold_jitter_pct() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_s3_flush_threshold_jitter_pct());
       }
     }
-  }
-  cached_has_bits = this_._impl_._has_bits_[2];
-  if (BatchCheckHasBit(cached_has_bits, 0x000000ffU)) {
     // uint32 s3_upload_max_attempts = 114 [json_name = "s3UploadMaxAttempts", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000001U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
       if (this_._internal_s3_upload_max_attempts() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_s3_upload_max_attempts());
       }
     }
     // uint32 ipv4_ttl = 150 [json_name = "ipv4Ttl", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
       if (this_._internal_ipv4_ttl() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_ipv4_ttl());
       }
     }
     // uint32 ipv6_hop_limit = 151 [json_name = "ipv6HopLimit", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
       if (this_._internal_ipv6_hop_limit() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_ipv6_hop_limit());
       }
     }
     // uint32 grpc_port = 160 [json_name = "grpcPort", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       if (this_._internal_grpc_port() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_grpc_port());
       }
     }
     // bool debug_prometheus = 54 [json_name = "debugPrometheus", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       if (this_._internal_debug_prometheus() != 0) {
         total_size += 3;
       }
     }
     // bool resolve_container_id = 200 [json_name = "resolveContainerId", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
       if (this_._internal_resolve_container_id() != 0) {
         total_size += 3;
       }
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
     // bool enrich_container_enable = 201 [json_name = "enrichContainerEnable"];
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
       if (this_._internal_enrich_container_enable() != 0) {
         total_size += 3;
       }
     }
     // bool enrich_lldp_enable = 210 [json_name = "enrichLldpEnable"];
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
       if (this_._internal_enrich_lldp_enable() != 0) {
         total_size += 3;
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
     // uint32 pyroscope_sample_hz = 172 [json_name = "pyroscopeSampleHz", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
       if (this_._internal_pyroscope_sample_hz() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_pyroscope_sample_hz());
       }
     }
     // uint32 pyroscope_upload_interval_sec = 173 [json_name = "pyroscopeUploadIntervalSec", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
       if (this_._internal_pyroscope_upload_interval_sec() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_pyroscope_upload_interval_sec());
       }
     }
     // uint32 uplink_count = 221 [json_name = "uplinkCount", (.buf.validate.field) = {
-    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
       if (this_._internal_uplink_count() != 0) {
         total_size += 2 + ::_pbi::WireFormatLite::UInt32Size(
                                         this_._internal_uplink_count());
       }
     }
     // bool enrich_nic_enable = 220 [json_name = "enrichNicEnable"];
-    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
       if (this_._internal_enrich_nic_enable() != 0) {
         total_size += 3;
       }
     }
     // bool populate_nsid = 230 [json_name = "populateNsid"];
-    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
       if (this_._internal_populate_nsid() != 0) {
         total_size += 3;
       }
     }
     // bool enrich_asn_enable = 240 [json_name = "enrichAsnEnable"];
-    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       if (this_._internal_enrich_asn_enable() != 0) {
         total_size += 3;
       }
     }
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00030000U)) {
     // bool enrich_locality_enable = 245 [json_name = "enrichLocalityEnable"];
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       if (this_._internal_enrich_locality_enable() != 0) {
         total_size += 3;
       }
     }
     // bool locality_events_enable = 247 [json_name = "localityEventsEnable"];
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       if (this_._internal_locality_events_enable() != 0) {
         total_size += 3;
       }
@@ -10899,15 +10963,6 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
       }
     }
     if (CheckHasBit(cached_has_bits, 0x00000010U)) {
-      if (!from._internal_pyroscope_app_name().empty()) {
-        _this->_internal_set_pyroscope_app_name(from._internal_pyroscope_app_name());
-      } else {
-        if (_this->_impl_.pyroscope_app_name_.IsDefault()) {
-          _this->_internal_set_pyroscope_app_name("");
-        }
-      }
-    }
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       ABSL_DCHECK(from._impl_.poll_frequency_ != nullptr);
       if (_this->_impl_.poll_frequency_ == nullptr) {
         _this->_impl_.poll_frequency_ = Super_::CopyConstruct(arena, *from._impl_.poll_frequency_);
@@ -10915,7 +10970,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.poll_frequency_->MergeFrom(*from._impl_.poll_frequency_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       ABSL_DCHECK(from._impl_.poll_timeout_ != nullptr);
       if (_this->_impl_.poll_timeout_ == nullptr) {
         _this->_impl_.poll_timeout_ = Super_::CopyConstruct(arena, *from._impl_.poll_timeout_);
@@ -10923,7 +10978,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.poll_timeout_->MergeFrom(*from._impl_.poll_timeout_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       ABSL_DCHECK(from._impl_.enabled_deserializers_ != nullptr);
       if (_this->_impl_.enabled_deserializers_ == nullptr) {
         _this->_impl_.enabled_deserializers_ = Super_::CopyConstruct(arena, *from._impl_.enabled_deserializers_);
@@ -10931,80 +10986,85 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.enabled_deserializers_->MergeFrom(*from._impl_.enabled_deserializers_);
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
-    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
       if (from._internal_nl_timeout_milliseconds() != 0) {
         _this->_impl_.nl_timeout_milliseconds_ = from._impl_.nl_timeout_milliseconds_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
       if (from._internal_max_loops() != 0) {
         _this->_impl_.max_loops_ = from._impl_.max_loops_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
       if (from._internal_poll_jitter_pct() != 0) {
         _this->_impl_.poll_jitter_pct_ = from._impl_.poll_jitter_pct_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
       if (from._internal_netlinkers() != 0) {
         _this->_impl_.netlinkers_ = from._impl_.netlinkers_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
       if (from._internal_netlinkers_done_chan_size() != 0) {
         _this->_impl_.netlinkers_done_chan_size_ = from._impl_.netlinkers_done_chan_size_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
       if (from._internal_nlmsg_seq() != 0) {
         _this->_impl_.nlmsg_seq_ = from._impl_.nlmsg_seq_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
       if (from._internal_packet_size() != 0) {
         _this->_impl_.packet_size_ = from._impl_.packet_size_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
       if (from._internal_modulus() != 0) {
         _this->_impl_.modulus_ = from._impl_.modulus_;
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
-    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       if (from._internal_packet_size_mply() != 0) {
         _this->_impl_.packet_size_mply_ = from._impl_.packet_size_mply_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       if (from._internal_io_uring_recv_batch_size() != 0) {
         _this->_impl_.io_uring_recv_batch_size_ = from._impl_.io_uring_recv_batch_size_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       if (from._internal_io_uring_cqe_batch_size() != 0) {
         _this->_impl_.io_uring_cqe_batch_size_ = from._impl_.io_uring_cqe_batch_size_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
       if (from._internal_io_uring() != 0) {
         _this->_impl_.io_uring_ = from._impl_.io_uring_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
       if (from._internal_reconcile_before_poll() != 0) {
         _this->_impl_.reconcile_before_poll_ = from._impl_.reconcile_before_poll_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
       if (from._internal_s3_skip_bucket_probe() != 0) {
         _this->_impl_.s3_skip_bucket_probe_ = from._impl_.s3_skip_bucket_probe_;
       }
     }
+    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+      if (from._internal_s3_allow_insecure() != 0) {
+        _this->_impl_.s3_allow_insecure_ = from._impl_.s3_allow_insecure_;
+      }
+    }
     if (CheckHasBit(cached_has_bits, 0x00400000U)) {
       _this->_internal_mutable_uplink_interfaces()->InternalMergeFromWithArena(
           ::google::protobuf::MessageLite::internal_visibility(), arena,
@@ -11106,6 +11166,15 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
       }
     }
     if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+      if (!from._internal_s3_ca_file().empty()) {
+        _this->_internal_set_s3_ca_file(from._internal_s3_ca_file());
+      } else {
+        if (_this->_impl_.s3_ca_file_.IsDefault()) {
+          _this->_internal_set_s3_ca_file("");
+        }
+      }
+    }
+    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
       if (!from._internal_hostname().empty()) {
         _this->_internal_set_hostname(from._internal_hostname());
       } else {
@@ -11114,7 +11183,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
       if (!from._internal_location().empty()) {
         _this->_internal_set_location(from._internal_location());
       } else {
@@ -11123,7 +11192,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
       if (!from._internal_label().empty()) {
         _this->_internal_set_label(from._internal_label());
       } else {
@@ -11132,7 +11201,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       if (!from._internal_tag().empty()) {
         _this->_internal_set_tag(from._internal_tag());
       } else {
@@ -11141,7 +11210,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       if (!from._internal_daemon_version().empty()) {
         _this->_internal_set_daemon_version(from._internal_daemon_version());
       } else {
@@ -11150,7 +11219,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
       if (!from._internal_pyroscope_url().empty()) {
         _this->_internal_set_pyroscope_url(from._internal_pyroscope_url());
       } else {
@@ -11159,7 +11228,18 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+      if (!from._internal_pyroscope_app_name().empty()) {
+        _this->_internal_set_pyroscope_app_name(from._internal_pyroscope_app_name());
+      } else {
+        if (_this->_impl_.pyroscope_app_name_.IsDefault()) {
+          _this->_internal_set_pyroscope_app_name("");
+        }
+      }
+    }
+    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
       if (!from._internal_docker_socket_path().empty()) {
         _this->_internal_set_docker_socket_path(from._internal_docker_socket_path());
       } else {
@@ -11168,9 +11248,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
-    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
       if (!from._internal_lldpd_socket_path().empty()) {
         _this->_internal_set_lldpd_socket_path(from._internal_lldpd_socket_path());
       } else {
@@ -11179,7 +11257,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
       if (!from._internal_lldpd_version_hint().empty()) {
         _this->_internal_set_lldpd_version_hint(from._internal_lldpd_version_hint());
       } else {
@@ -11188,7 +11266,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
       if (!from._internal_asn_db_path().empty()) {
         _this->_internal_set_asn_db_path(from._internal_asn_db_path());
       } else {
@@ -11197,7 +11275,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
       if (!from._internal_ipmeta_bootstrap_path().empty()) {
         _this->_internal_set_ipmeta_bootstrap_path(from._internal_ipmeta_bootstrap_path());
       } else {
@@ -11206,7 +11284,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
       if (!from._internal_ipmeta_cache_path().empty()) {
         _this->_internal_set_ipmeta_cache_path(from._internal_ipmeta_cache_path());
       } else {
@@ -11215,7 +11293,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         }
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       ABSL_DCHECK(from._impl_.reconcile_frequency_ != nullptr);
       if (_this->_impl_.reconcile_frequency_ == nullptr) {
         _this->_impl_.reconcile_frequency_ = Super_::CopyConstruct(arena, *from._impl_.reconcile_frequency_);
@@ -11223,7 +11301,9 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.reconcile_frequency_->MergeFrom(*from._impl_.reconcile_frequency_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       ABSL_DCHECK(from._impl_.kafka_produce_timeout_ != nullptr);
       if (_this->_impl_.kafka_produce_timeout_ == nullptr) {
         _this->_impl_.kafka_produce_timeout_ = Super_::CopyConstruct(arena, *from._impl_.kafka_produce_timeout_);
@@ -11231,7 +11311,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.kafka_produce_timeout_->MergeFrom(*from._impl_.kafka_produce_timeout_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       ABSL_DCHECK(from._impl_.s3_flush_interval_ != nullptr);
       if (_this->_impl_.s3_flush_interval_ == nullptr) {
         _this->_impl_.s3_flush_interval_ = Super_::CopyConstruct(arena, *from._impl_.s3_flush_interval_);
@@ -11239,9 +11319,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.s3_flush_interval_->MergeFrom(*from._impl_.s3_flush_interval_);
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x00ff0000U)) {
-    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
       ABSL_DCHECK(from._impl_.s3_upload_backoff_cap_ != nullptr);
       if (_this->_impl_.s3_upload_backoff_cap_ == nullptr) {
         _this->_impl_.s3_upload_backoff_cap_ = Super_::CopyConstruct(arena, *from._impl_.s3_upload_backoff_cap_);
@@ -11249,7 +11327,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.s3_upload_backoff_cap_->MergeFrom(*from._impl_.s3_upload_backoff_cap_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
       ABSL_DCHECK(from._impl_.listener_auth_ != nullptr);
       if (_this->_impl_.listener_auth_ == nullptr) {
         _this->_impl_.listener_auth_ = Super_::CopyConstruct(arena, *from._impl_.listener_auth_);
@@ -11257,7 +11335,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.listener_auth_->MergeFrom(*from._impl_.listener_auth_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00040000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
       ABSL_DCHECK(from._impl_.prometheus_listener_ != nullptr);
       if (_this->_impl_.prometheus_listener_ == nullptr) {
         _this->_impl_.prometheus_listener_ = Super_::CopyConstruct(arena, *from._impl_.prometheus_listener_);
@@ -11265,7 +11343,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.prometheus_listener_->MergeFrom(*from._impl_.prometheus_listener_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00080000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
       ABSL_DCHECK(from._impl_.admin_listener_auth_ != nullptr);
       if (_this->_impl_.admin_listener_auth_ == nullptr) {
         _this->_impl_.admin_listener_auth_ = Super_::CopyConstruct(arena, *from._impl_.admin_listener_auth_);
@@ -11273,7 +11351,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.admin_listener_auth_->MergeFrom(*from._impl_.admin_listener_auth_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00100000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00400000U)) {
       ABSL_DCHECK(from._impl_.grpc_listener_ != nullptr);
       if (_this->_impl_.grpc_listener_ == nullptr) {
         _this->_impl_.grpc_listener_ = Super_::CopyConstruct(arena, *from._impl_.grpc_listener_);
@@ -11281,7 +11359,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.grpc_listener_->MergeFrom(*from._impl_.grpc_listener_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00200000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00800000U)) {
       ABSL_DCHECK(from._impl_.asn_refresh_interval_ != nullptr);
       if (_this->_impl_.asn_refresh_interval_ == nullptr) {
         _this->_impl_.asn_refresh_interval_ = Super_::CopyConstruct(arena, *from._impl_.asn_refresh_interval_);
@@ -11289,7 +11367,9 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.asn_refresh_interval_->MergeFrom(*from._impl_.asn_refresh_interval_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00400000U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0xff000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x01000000U)) {
       ABSL_DCHECK(from._impl_.locality_refresh_interval_ != nullptr);
       if (_this->_impl_.locality_refresh_interval_ == nullptr) {
         _this->_impl_.locality_refresh_interval_ = Super_::CopyConstruct(arena, *from._impl_.locality_refresh_interval_);
@@ -11297,7 +11377,7 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.locality_refresh_interval_->MergeFrom(*from._impl_.locality_refresh_interval_);
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00800000U)) {
+    if (CheckHasBit(cached_has_bits, 0x02000000U)) {
       ABSL_DCHECK(from._impl_.link_monitor_ != nullptr);
       if (_this->_impl_.link_monitor_ == nullptr) {
         _this->_impl_.link_monitor_ = Super_::CopyConstruct(arena, *from._impl_.link_monitor_);
@@ -11305,129 +11385,129 @@ void XtcpConfig::MergeImpl(::google::protobuf::MessageLite& to_msg,
         _this->_impl_.link_monitor_->MergeFrom(*from._impl_.link_monitor_);
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0xff000000U)) {
-    if (CheckHasBit(cached_has_bits, 0x01000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x04000000U)) {
       if (from._internal_write_files() != 0) {
         _this->_impl_.write_files_ = from._impl_.write_files_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x02000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x08000000U)) {
       if (from._internal_dest_write_files() != 0) {
         _this->_impl_.dest_write_files_ = from._impl_.dest_write_files_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x04000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x10000000U)) {
       if (from._internal_debug_level() != 0) {
         _this->_impl_.debug_level_ = from._impl_.debug_level_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x08000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x20000000U)) {
       if (from._internal_envelope_flush_threshold_bytes() != 0) {
         _this->_impl_.envelope_flush_threshold_bytes_ = from._impl_.envelope_flush_threshold_bytes_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x10000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x40000000U)) {
       if (from._internal_envelope_flush_threshold_rows() != 0) {
         _this->_impl_.envelope_flush_threshold_rows_ = from._impl_.envelope_flush_threshold_rows_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x20000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x80000000U)) {
       if (from._internal_s3_parquet_flush_threshold_bytes() != 0) {
         _this->_impl_.s3_parquet_flush_threshold_bytes_ = from._impl_.s3_parquet_flush_threshold_bytes_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x40000000U)) {
+  }
+  cached_has_bits = from._impl_._has_bits_[2];
+  if (BatchCheckHasBit(cached_has_bits, 0x000000ffU)) {
+    if (CheckHasBit(cached_has_bits, 0x00000001U)) {
       if (from._internal_s3_flush_jitter_pct() != 0) {
         _this->_impl_.s3_flush_jitter_pct_ = from._impl_.s3_flush_jitter_pct_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x80000000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000002U)) {
       if (from._internal_s3_flush_threshold_jitter_pct() != 0) {
         _this->_impl_.s3_flush_threshold_jitter_pct_ = from._impl_.s3_flush_threshold_jitter_pct_;
       }
     }
-  }
-  cached_has_bits = from._impl_._has_bits_[2];
-  if (BatchCheckHasBit(cached_has_bits, 0x000000ffU)) {
-    if (CheckHasBit(cached_has_bits, 0x00000001U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
       if (from._internal_s3_upload_max_attempts() != 0) {
         _this->_impl_.s3_upload_max_attempts_ = from._impl_.s3_upload_max_attempts_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000002U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
       if (from._internal_ipv4_ttl() != 0) {
         _this->_impl_.ipv4_ttl_ = from._impl_.ipv4_ttl_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000004U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
       if (from._internal_ipv6_hop_limit() != 0) {
         _this->_impl_.ipv6_hop_limit_ = from._impl_.ipv6_hop_limit_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000008U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
       if (from._internal_grpc_port() != 0) {
         _this->_impl_.grpc_port_ = from._impl_.grpc_port_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000010U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
       if (from._internal_debug_prometheus() != 0) {
         _this->_impl_.debug_prometheus_ = from._impl_.debug_prometheus_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000020U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
       if (from._internal_resolve_container_id() != 0) {
         _this->_impl_.resolve_container_id_ = from._impl_.resolve_container_id_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000040U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
       if (from._internal_enrich_container_enable() != 0) {
         _this->_impl_.enrich_container_enable_ = from._impl_.enrich_container_enable_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000080U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
       if (from._internal_enrich_lldp_enable() != 0) {
         _this->_impl_.enrich_lldp_enable_ = from._impl_.enrich_lldp_enable_;
       }
     }
-  }
-  if (BatchCheckHasBit(cached_has_bits, 0x0000ff00U)) {
-    if (CheckHasBit(cached_has_bits, 0x00000100U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
       if (from._internal_pyroscope_sample_hz() != 0) {
         _this->_impl_.pyroscope_sample_hz_ = from._impl_.pyroscope_sample_hz_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000200U)) {
+    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
       if (from._internal_pyroscope_upload_interval_sec() != 0) {
         _this->_impl_.pyroscope_upload_interval_sec_ = from._impl_.pyroscope_upload_interval_sec_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000400U)) {
+    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
       if (from._internal_uplink_count() != 0) {
         _this->_impl_.uplink_count_ = from._impl_.uplink_count_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00000800U)) {
+    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
       if (from._internal_enrich_nic_enable() != 0) {
         _this->_impl_.enrich_nic_enable_ = from._impl_.enrich_nic_enable_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00001000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
       if (from._internal_populate_nsid() != 0) {
         _this->_impl_.populate_nsid_ = from._impl_.populate_nsid_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00002000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
       if (from._internal_enrich_asn_enable() != 0) {
         _this->_impl_.enrich_asn_enable_ = from._impl_.enrich_asn_enable_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00004000U)) {
+  }
+  if (BatchCheckHasBit(cached_has_bits, 0x00030000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00010000U)) {
       if (from._internal_enrich_locality_enable() != 0) {
         _this->_impl_.enrich_locality_enable_ = from._impl_.enrich_locality_enable_;
       }
     }
-    if (CheckHasBit(cached_has_bits, 0x00008000U)) {
+    if (CheckHasBit(cached_has_bits, 0x00020000U)) {
       if (from._internal_locality_events_enable() != 0) {
         _this->_impl_.locality_events_enable_ = from._impl_.locality_events_enable_;
       }
@@ -11458,10 +11538,9 @@ void XtcpConfig::InternalSwap(XtcpConfig* PROTOBUF_RESTRICT PROTOBUF_NONNULL oth
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.marshal_to_, &other->_impl_.marshal_to_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.csv_columns_, &other->_impl_.csv_columns_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.xtcp_proto_file_, &other->_impl_.xtcp_proto_file_, arena);
-  ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.pyroscope_app_name_, &other->_impl_.pyroscope_app_name_, arena);
   ::google::protobuf::internal::memswap<
-      PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_skip_bucket_probe_)
-      + sizeof(XtcpConfig::_impl_.s3_skip_bucket_probe_)
+      PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.s3_allow_insecure_)
+      + sizeof(XtcpConfig::_impl_.s3_allow_insecure_)
       - PROTOBUF_FIELD_OFFSET(XtcpConfig, _impl_.poll_frequency_)>(
           reinterpret_cast<char*>(&_impl_.poll_frequency_),
           reinterpret_cast<char*>(&other->_impl_.poll_frequency_));
@@ -11476,12 +11555,14 @@ void XtcpConfig::InternalSwap(XtcpConfig* PROTOBUF_RESTRICT PROTOBUF_NONNULL oth
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.s3_prefix_, &other->_impl_.s3_prefix_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.s3_access_key_, &other->_impl_.s3_access_key_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.s3_secret_key_, &other->_impl_.s3_secret_key_, arena);
+  ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.s3_ca_file_, &other->_impl_.s3_ca_file_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.hostname_, &other->_impl_.hostname_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.location_, &other->_impl_.location_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.label_, &other->_impl_.label_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.tag_, &other->_impl_.tag_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.daemon_version_, &other->_impl_.daemon_version_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.pyroscope_url_, &other->_impl_.pyroscope_url_, arena);
+  ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.pyroscope_app_name_, &other->_impl_.pyroscope_app_name_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.docker_socket_path_, &other->_impl_.docker_socket_path_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.lldpd_socket_path_, &other->_impl_.lldpd_socket_path_, arena);
   ::_pbi::ArenaStringPtr::InternalSwap(&_impl_.lldpd_version_hint_, &other->_impl_.lldpd_version_hint_, arena);
diff --git a/gen/cpp/xtcp_config/v1/xtcp_config.pb.h b/gen/cpp/xtcp_config/v1/xtcp_config.pb.h
index bb6832ec0..15e17c28e 100644
--- a/gen/cpp/xtcp_config/v1/xtcp_config.pb.h
+++ b/gen/cpp/xtcp_config/v1/xtcp_config.pb.h
@@ -3453,7 +3453,6 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
     kMarshalToFieldNumber = 61,
     kCsvColumnsFieldNumber = 62,
     kXtcpProtoFileFieldNumber = 63,
-    kPyroscopeAppNameFieldNumber = 171,
     kPollFrequencyFieldNumber = 11,
     kPollTimeoutFieldNumber = 12,
     kEnabledDeserializersFieldNumber = 21,
@@ -3471,6 +3470,7 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
     kIoUringFieldNumber = 22,
     kReconcileBeforePollFieldNumber = 41,
     kS3SkipBucketProbeFieldNumber = 106,
+    kS3AllowInsecureFieldNumber = 107,
     kUplinkInterfacesFieldNumber = 222,
     kCapturePathFieldNumber = 51,
     kTopicFieldNumber = 80,
@@ -3482,12 +3482,14 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
     kS3PrefixFieldNumber = 103,
     kS3AccessKeyFieldNumber = 104,
     kS3SecretKeyFieldNumber = 105,
+    kS3CaFileFieldNumber = 108,
     kHostnameFieldNumber = 130,
     kLocationFieldNumber = 131,
     kLabelFieldNumber = 132,
     kTagFieldNumber = 133,
     kDaemonVersionFieldNumber = 134,
     kPyroscopeUrlFieldNumber = 170,
+    kPyroscopeAppNameFieldNumber = 171,
     kDockerSocketPathFieldNumber = 202,
     kLldpdSocketPathFieldNumber = 211,
     kLldpdVersionHintFieldNumber = 212,
@@ -3589,21 +3591,6 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
   PROTOBUF_ALWAYS_INLINE void _internal_set_xtcp_proto_file(const ::std::string& value);
   ::std::string* PROTOBUF_NONNULL _internal_mutable_xtcp_proto_file();
 
-  public:
-  // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
-  void clear_pyroscope_app_name() ;
-  [[nodiscard]] const ::std::string& pyroscope_app_name() const;
-  template <typename Arg_ = const ::std::string&, typename... Args_>
-  void set_pyroscope_app_name(Arg_&& arg, Args_... args);
-  ::std::string* PROTOBUF_NONNULL mutable_pyroscope_app_name();
-  [[nodiscard]] ::std::string* PROTOBUF_NULLABLE release_pyroscope_app_name();
-  void set_allocated_pyroscope_app_name(::std::string* PROTOBUF_NULLABLE value);
-
-  private:
-  const ::std::string& _internal_pyroscope_app_name() const;
-  PROTOBUF_ALWAYS_INLINE void _internal_set_pyroscope_app_name(const ::std::string& value);
-  ::std::string* PROTOBUF_NONNULL _internal_mutable_pyroscope_app_name();
-
   public:
   // .google.protobuf.Duration poll_frequency = 11 [json_name = "pollFrequency", (.buf.validate.field) = {
   [[nodiscard]] bool has_poll_frequency() const;
@@ -3789,6 +3776,16 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
   bool _internal_s3_skip_bucket_probe() const;
   void _internal_set_s3_skip_bucket_probe(bool value);
 
+  public:
+  // bool s3_allow_insecure = 107 [json_name = "s3AllowInsecure", (.buf.validate.field) = {
+  void clear_s3_allow_insecure() ;
+  [[nodiscard]] bool s3_allow_insecure() const;
+  void set_s3_allow_insecure(bool value);
+
+  private:
+  bool _internal_s3_allow_insecure() const;
+  void _internal_set_s3_allow_insecure(bool value);
+
   public:
   // repeated string uplink_interfaces = 222 [json_name = "uplinkInterfaces", (.buf.validate.field) = {
   [[nodiscard]] int uplink_interfaces_size() const;
@@ -3965,6 +3962,21 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
   PROTOBUF_ALWAYS_INLINE void _internal_set_s3_secret_key(const ::std::string& value);
   ::std::string* PROTOBUF_NONNULL _internal_mutable_s3_secret_key();
 
+  public:
+  // string s3_ca_file = 108 [json_name = "s3CaFile", (.buf.validate.field) = {
+  void clear_s3_ca_file() ;
+  [[nodiscard]] const ::std::string& s3_ca_file() const;
+  template <typename Arg_ = const ::std::string&, typename... Args_>
+  void set_s3_ca_file(Arg_&& arg, Args_... args);
+  ::std::string* PROTOBUF_NONNULL mutable_s3_ca_file();
+  [[nodiscard]] ::std::string* PROTOBUF_NULLABLE release_s3_ca_file();
+  void set_allocated_s3_ca_file(::std::string* PROTOBUF_NULLABLE value);
+
+  private:
+  const ::std::string& _internal_s3_ca_file() const;
+  PROTOBUF_ALWAYS_INLINE void _internal_set_s3_ca_file(const ::std::string& value);
+  ::std::string* PROTOBUF_NONNULL _internal_mutable_s3_ca_file();
+
   public:
   // string hostname = 130 [json_name = "hostname", (.buf.validate.field) = {
   void clear_hostname() ;
@@ -4055,6 +4067,21 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
   PROTOBUF_ALWAYS_INLINE void _internal_set_pyroscope_url(const ::std::string& value);
   ::std::string* PROTOBUF_NONNULL _internal_mutable_pyroscope_url();
 
+  public:
+  // string pyroscope_app_name = 171 [json_name = "pyroscopeAppName", (.buf.validate.field) = {
+  void clear_pyroscope_app_name() ;
+  [[nodiscard]] const ::std::string& pyroscope_app_name() const;
+  template <typename Arg_ = const ::std::string&, typename... Args_>
+  void set_pyroscope_app_name(Arg_&& arg, Args_... args);
+  ::std::string* PROTOBUF_NONNULL mutable_pyroscope_app_name();
+  [[nodiscard]] ::std::string* PROTOBUF_NULLABLE release_pyroscope_app_name();
+  void set_allocated_pyroscope_app_name(::std::string* PROTOBUF_NULLABLE value);
+
+  private:
+  const ::std::string& _internal_pyroscope_app_name() const;
+  PROTOBUF_ALWAYS_INLINE void _internal_set_pyroscope_app_name(const ::std::string& value);
+  ::std::string* PROTOBUF_NONNULL _internal_mutable_pyroscope_app_name();
+
   public:
   // string docker_socket_path = 202 [json_name = "dockerSocketPath", (.buf.validate.field) = {
   void clear_docker_socket_path() ;
@@ -4555,8 +4582,8 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
  private:
   class _Internal;
   using ParseTableT_ =
-      ::google::protobuf::internal::TcParseTable<5, 80,
-                          14, 456,
+      ::google::protobuf::internal::TcParseTable<5, 82,
+                          14, 466,
                           33>;
   static constexpr ParseTableT_ InternalGenerateParseTable_(
       const ::google::protobuf::internal::ClassData* PROTOBUF_NONNULL class_data);
@@ -4588,7 +4615,6 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
     ::google::protobuf::internal::ArenaStringPtr marshal_to_;
     ::google::protobuf::internal::ArenaStringPtr csv_columns_;
     ::google::protobuf::internal::ArenaStringPtr xtcp_proto_file_;
-    ::google::protobuf::internal::ArenaStringPtr pyroscope_app_name_;
     ::google::protobuf::Duration* PROTOBUF_NULLABLE poll_frequency_;
     ::google::protobuf::Duration* PROTOBUF_NULLABLE poll_timeout_;
     ::xtcp_config::v1::EnabledDeserializers* PROTOBUF_NULLABLE enabled_deserializers_;
@@ -4606,6 +4632,7 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
     bool io_uring_;
     bool reconcile_before_poll_;
     bool s3_skip_bucket_probe_;
+    bool s3_allow_insecure_;
     ::google::protobuf::RepeatedPtrField<::std::string> uplink_interfaces_;
     ::google::protobuf::internal::ArenaStringPtr capture_path_;
     ::google::protobuf::internal::ArenaStringPtr topic_;
@@ -4617,12 +4644,14 @@ class  PROTOBUF_FUTURE_ADD_EARLY_WARN_UNUSED XtcpConfig final : public ::google:
     ::google::protobuf::internal::ArenaStringPtr s3_prefix_;
     ::google::protobuf::internal::ArenaStringPtr s3_access_key_;
     ::google::protobuf::internal::ArenaStringPtr s3_secret_key_;
+    ::google::protobuf::internal::ArenaStringPtr s3_ca_file_;
     ::google::protobuf::internal::ArenaStringPtr hostname_;
     ::google::protobuf::internal::ArenaStringPtr location_;
     ::google::protobuf::internal::ArenaStringPtr label_;
     ::google::protobuf::internal::ArenaStringPtr tag_;
     ::google::protobuf::internal::ArenaStringPtr daemon_version_;
     ::google::protobuf::internal::ArenaStringPtr pyroscope_url_;
+    ::google::protobuf::internal::ArenaStringPtr pyroscope_app_name_;
     ::google::protobuf::internal::ArenaStringPtr docker_socket_path_;
     ::google::protobuf::internal::ArenaStringPtr lldpd_socket_path_;
     ::google::protobuf::internal::ArenaStringPtr lldpd_version_hint_;
@@ -9647,7 +9676,7 @@ inline void LinkMonitorConfig::set_allocated_learn_deadline(::google::protobuf::
 inline void XtcpConfig::clear_nl_timeout_milliseconds() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.nl_timeout_milliseconds_ = ::uint64_t{0u};
-  ClearHasBit(_impl_._has_bits_[0], 0x00000100U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000080U);
 }
 inline ::uint64_t XtcpConfig::nl_timeout_milliseconds() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.nl_timeout_milliseconds)
@@ -9655,7 +9684,7 @@ inline ::uint64_t XtcpConfig::nl_timeout_milliseconds() const {
 }
 inline void XtcpConfig::set_nl_timeout_milliseconds(::uint64_t value) {
   _internal_set_nl_timeout_milliseconds(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00000100U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000080U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.nl_timeout_milliseconds)
 }
 inline ::uint64_t XtcpConfig::_internal_nl_timeout_milliseconds() const {
@@ -9669,7 +9698,7 @@ inline void XtcpConfig::_internal_set_nl_timeout_milliseconds(::uint64_t value)
 
 // .google.protobuf.Duration poll_frequency = 11 [json_name = "pollFrequency", (.buf.validate.field) = {
 inline bool XtcpConfig::has_poll_frequency() const {
-  bool value = CheckHasBit(_impl_._has_bits_[0], 0x00000020U);
+  bool value = CheckHasBit(_impl_._has_bits_[0], 0x00000010U);
   PROTOBUF_ASSUME(!value || _impl_.poll_frequency_ != nullptr);
   return value;
 }
@@ -9690,16 +9719,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_poll_frequency(
   }
   _impl_.poll_frequency_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[0], 0x00000020U);
+    SetHasBit(_impl_._has_bits_[0], 0x00000010U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
+    ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.poll_frequency)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_poll_frequency() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
   ::google::protobuf::Duration* released = _impl_.poll_frequency_;
   _impl_.poll_frequency_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -9719,7 +9748,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.poll_frequency)
 
-  ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
   ::google::protobuf::Duration* temp = _impl_.poll_frequency_;
   _impl_.poll_frequency_ = nullptr;
   return temp;
@@ -9734,7 +9763,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_poll_frequency()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[0], 0x00000020U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000010U);
   ::google::protobuf::Duration* _msg = _internal_mutable_poll_frequency();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.poll_frequency)
   return _msg;
@@ -9751,9 +9780,9 @@ inline void XtcpConfig::set_allocated_poll_frequency(::google::protobuf::Duratio
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[0], 0x00000020U);
+    SetHasBit(_impl_._has_bits_[0], 0x00000010U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
+    ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
   }
 
   _impl_.poll_frequency_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -9762,7 +9791,7 @@ inline void XtcpConfig::set_allocated_poll_frequency(::google::protobuf::Duratio
 
 // .google.protobuf.Duration poll_timeout = 12 [json_name = "pollTimeout", (.buf.validate.field) = {
 inline bool XtcpConfig::has_poll_timeout() const {
-  bool value = CheckHasBit(_impl_._has_bits_[0], 0x00000040U);
+  bool value = CheckHasBit(_impl_._has_bits_[0], 0x00000020U);
   PROTOBUF_ASSUME(!value || _impl_.poll_timeout_ != nullptr);
   return value;
 }
@@ -9783,16 +9812,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_poll_timeout(
   }
   _impl_.poll_timeout_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[0], 0x00000040U);
+    SetHasBit(_impl_._has_bits_[0], 0x00000020U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
+    ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.poll_timeout)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_poll_timeout() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
   ::google::protobuf::Duration* released = _impl_.poll_timeout_;
   _impl_.poll_timeout_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -9812,7 +9841,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.poll_timeout)
 
-  ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
   ::google::protobuf::Duration* temp = _impl_.poll_timeout_;
   _impl_.poll_timeout_ = nullptr;
   return temp;
@@ -9827,7 +9856,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_poll_timeout()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[0], 0x00000040U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000020U);
   ::google::protobuf::Duration* _msg = _internal_mutable_poll_timeout();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.poll_timeout)
   return _msg;
@@ -9844,9 +9873,9 @@ inline void XtcpConfig::set_allocated_poll_timeout(::google::protobuf::Duration*
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[0], 0x00000040U);
+    SetHasBit(_impl_._has_bits_[0], 0x00000020U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
+    ClearHasBit(_impl_._has_bits_[0], 0x00000020U);
   }
 
   _impl_.poll_timeout_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -9857,7 +9886,7 @@ inline void XtcpConfig::set_allocated_poll_timeout(::google::protobuf::Duration*
 inline void XtcpConfig::clear_poll_jitter_pct() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.poll_jitter_pct_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00000400U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000200U);
 }
 inline ::uint32_t XtcpConfig::poll_jitter_pct() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.poll_jitter_pct)
@@ -9865,7 +9894,7 @@ inline ::uint32_t XtcpConfig::poll_jitter_pct() const {
 }
 inline void XtcpConfig::set_poll_jitter_pct(::uint32_t value) {
   _internal_set_poll_jitter_pct(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00000400U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000200U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.poll_jitter_pct)
 }
 inline ::uint32_t XtcpConfig::_internal_poll_jitter_pct() const {
@@ -9881,7 +9910,7 @@ inline void XtcpConfig::_internal_set_poll_jitter_pct(::uint32_t value) {
 inline void XtcpConfig::clear_max_loops() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.max_loops_ = ::uint64_t{0u};
-  ClearHasBit(_impl_._has_bits_[0], 0x00000200U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000100U);
 }
 inline ::uint64_t XtcpConfig::max_loops() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.max_loops)
@@ -9889,7 +9918,7 @@ inline ::uint64_t XtcpConfig::max_loops() const {
 }
 inline void XtcpConfig::set_max_loops(::uint64_t value) {
   _internal_set_max_loops(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00000200U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000100U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.max_loops)
 }
 inline ::uint64_t XtcpConfig::_internal_max_loops() const {
@@ -9905,7 +9934,7 @@ inline void XtcpConfig::_internal_set_max_loops(::uint64_t value) {
 inline void XtcpConfig::clear_netlinkers() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.netlinkers_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00000800U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000400U);
 }
 inline ::uint32_t XtcpConfig::netlinkers() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.netlinkers)
@@ -9913,7 +9942,7 @@ inline ::uint32_t XtcpConfig::netlinkers() const {
 }
 inline void XtcpConfig::set_netlinkers(::uint32_t value) {
   _internal_set_netlinkers(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00000800U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000400U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.netlinkers)
 }
 inline ::uint32_t XtcpConfig::_internal_netlinkers() const {
@@ -9929,7 +9958,7 @@ inline void XtcpConfig::_internal_set_netlinkers(::uint32_t value) {
 inline void XtcpConfig::clear_netlinkers_done_chan_size() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.netlinkers_done_chan_size_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00001000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000800U);
 }
 inline ::uint32_t XtcpConfig::netlinkers_done_chan_size() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.netlinkers_done_chan_size)
@@ -9937,7 +9966,7 @@ inline ::uint32_t XtcpConfig::netlinkers_done_chan_size() const {
 }
 inline void XtcpConfig::set_netlinkers_done_chan_size(::uint32_t value) {
   _internal_set_netlinkers_done_chan_size(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00001000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000800U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.netlinkers_done_chan_size)
 }
 inline ::uint32_t XtcpConfig::_internal_netlinkers_done_chan_size() const {
@@ -9953,7 +9982,7 @@ inline void XtcpConfig::_internal_set_netlinkers_done_chan_size(::uint32_t value
 inline void XtcpConfig::clear_nlmsg_seq() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.nlmsg_seq_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00002000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00001000U);
 }
 inline ::uint32_t XtcpConfig::nlmsg_seq() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.nlmsg_seq)
@@ -9961,7 +9990,7 @@ inline ::uint32_t XtcpConfig::nlmsg_seq() const {
 }
 inline void XtcpConfig::set_nlmsg_seq(::uint32_t value) {
   _internal_set_nlmsg_seq(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00002000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00001000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.nlmsg_seq)
 }
 inline ::uint32_t XtcpConfig::_internal_nlmsg_seq() const {
@@ -9977,7 +10006,7 @@ inline void XtcpConfig::_internal_set_nlmsg_seq(::uint32_t value) {
 inline void XtcpConfig::clear_packet_size() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.packet_size_ = ::uint64_t{0u};
-  ClearHasBit(_impl_._has_bits_[0], 0x00004000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00002000U);
 }
 inline ::uint64_t XtcpConfig::packet_size() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.packet_size)
@@ -9985,7 +10014,7 @@ inline ::uint64_t XtcpConfig::packet_size() const {
 }
 inline void XtcpConfig::set_packet_size(::uint64_t value) {
   _internal_set_packet_size(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00004000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00002000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.packet_size)
 }
 inline ::uint64_t XtcpConfig::_internal_packet_size() const {
@@ -10001,7 +10030,7 @@ inline void XtcpConfig::_internal_set_packet_size(::uint64_t value) {
 inline void XtcpConfig::clear_packet_size_mply() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.packet_size_mply_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00010000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00008000U);
 }
 inline ::uint32_t XtcpConfig::packet_size_mply() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.packet_size_mply)
@@ -10009,7 +10038,7 @@ inline ::uint32_t XtcpConfig::packet_size_mply() const {
 }
 inline void XtcpConfig::set_packet_size_mply(::uint32_t value) {
   _internal_set_packet_size_mply(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00010000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00008000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.packet_size_mply)
 }
 inline ::uint32_t XtcpConfig::_internal_packet_size_mply() const {
@@ -10025,7 +10054,7 @@ inline void XtcpConfig::_internal_set_packet_size_mply(::uint32_t value) {
 inline void XtcpConfig::clear_modulus() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.modulus_ = ::uint64_t{0u};
-  ClearHasBit(_impl_._has_bits_[0], 0x00008000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00004000U);
 }
 inline ::uint64_t XtcpConfig::modulus() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.modulus)
@@ -10033,7 +10062,7 @@ inline ::uint64_t XtcpConfig::modulus() const {
 }
 inline void XtcpConfig::set_modulus(::uint64_t value) {
   _internal_set_modulus(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00008000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00004000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.modulus)
 }
 inline ::uint64_t XtcpConfig::_internal_modulus() const {
@@ -10047,14 +10076,14 @@ inline void XtcpConfig::_internal_set_modulus(::uint64_t value) {
 
 // .xtcp_config.v1.EnabledDeserializers enabled_deserializers = 21 [json_name = "enabledDeserializers", (.buf.validate.field) = {
 inline bool XtcpConfig::has_enabled_deserializers() const {
-  bool value = CheckHasBit(_impl_._has_bits_[0], 0x00000080U);
+  bool value = CheckHasBit(_impl_._has_bits_[0], 0x00000040U);
   PROTOBUF_ASSUME(!value || _impl_.enabled_deserializers_ != nullptr);
   return value;
 }
 inline void XtcpConfig::clear_enabled_deserializers() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.enabled_deserializers_ != nullptr) _impl_.enabled_deserializers_->Clear();
-  ClearHasBit(_impl_._has_bits_[0], 0x00000080U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
 }
 inline const ::xtcp_config::v1::EnabledDeserializers& XtcpConfig::_internal_enabled_deserializers() const {
   ::google::protobuf::internal::TSanRead(&_impl_);
@@ -10073,16 +10102,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_enabled_deserializers(
   }
   _impl_.enabled_deserializers_ = reinterpret_cast<::xtcp_config::v1::EnabledDeserializers*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[0], 0x00000080U);
+    SetHasBit(_impl_._has_bits_[0], 0x00000040U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000080U);
+    ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.enabled_deserializers)
 }
 inline ::xtcp_config::v1::EnabledDeserializers* PROTOBUF_NULLABLE XtcpConfig::release_enabled_deserializers() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[0], 0x00000080U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
   ::xtcp_config::v1::EnabledDeserializers* released = _impl_.enabled_deserializers_;
   _impl_.enabled_deserializers_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -10102,7 +10131,7 @@ inline ::xtcp_config::v1::EnabledDeserializers* PROTOBUF_NULLABLE XtcpConfig::un
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.enabled_deserializers)
 
-  ClearHasBit(_impl_._has_bits_[0], 0x00000080U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
   ::xtcp_config::v1::EnabledDeserializers* temp = _impl_.enabled_deserializers_;
   _impl_.enabled_deserializers_ = nullptr;
   return temp;
@@ -10117,7 +10146,7 @@ inline ::xtcp_config::v1::EnabledDeserializers* PROTOBUF_NONNULL XtcpConfig::_in
 }
 inline ::xtcp_config::v1::EnabledDeserializers* PROTOBUF_NONNULL XtcpConfig::mutable_enabled_deserializers()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[0], 0x00000080U);
+  SetHasBit(_impl_._has_bits_[0], 0x00000040U);
   ::xtcp_config::v1::EnabledDeserializers* _msg = _internal_mutable_enabled_deserializers();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.enabled_deserializers)
   return _msg;
@@ -10134,9 +10163,9 @@ inline void XtcpConfig::set_allocated_enabled_deserializers(::xtcp_config::v1::E
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[0], 0x00000080U);
+    SetHasBit(_impl_._has_bits_[0], 0x00000040U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000080U);
+    ClearHasBit(_impl_._has_bits_[0], 0x00000040U);
   }
 
   _impl_.enabled_deserializers_ = reinterpret_cast<::xtcp_config::v1::EnabledDeserializers*>(value);
@@ -10147,7 +10176,7 @@ inline void XtcpConfig::set_allocated_enabled_deserializers(::xtcp_config::v1::E
 inline void XtcpConfig::clear_io_uring() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.io_uring_ = false;
-  ClearHasBit(_impl_._has_bits_[0], 0x00080000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00040000U);
 }
 inline bool XtcpConfig::io_uring() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.io_uring)
@@ -10155,7 +10184,7 @@ inline bool XtcpConfig::io_uring() const {
 }
 inline void XtcpConfig::set_io_uring(bool value) {
   _internal_set_io_uring(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00080000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00040000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.io_uring)
 }
 inline bool XtcpConfig::_internal_io_uring() const {
@@ -10171,7 +10200,7 @@ inline void XtcpConfig::_internal_set_io_uring(bool value) {
 inline void XtcpConfig::clear_io_uring_recv_batch_size() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.io_uring_recv_batch_size_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00020000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00010000U);
 }
 inline ::uint32_t XtcpConfig::io_uring_recv_batch_size() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.io_uring_recv_batch_size)
@@ -10179,7 +10208,7 @@ inline ::uint32_t XtcpConfig::io_uring_recv_batch_size() const {
 }
 inline void XtcpConfig::set_io_uring_recv_batch_size(::uint32_t value) {
   _internal_set_io_uring_recv_batch_size(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00020000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00010000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.io_uring_recv_batch_size)
 }
 inline ::uint32_t XtcpConfig::_internal_io_uring_recv_batch_size() const {
@@ -10195,7 +10224,7 @@ inline void XtcpConfig::_internal_set_io_uring_recv_batch_size(::uint32_t value)
 inline void XtcpConfig::clear_io_uring_cqe_batch_size() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.io_uring_cqe_batch_size_ = 0u;
-  ClearHasBit(_impl_._has_bits_[0], 0x00040000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00020000U);
 }
 inline ::uint32_t XtcpConfig::io_uring_cqe_batch_size() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.io_uring_cqe_batch_size)
@@ -10203,7 +10232,7 @@ inline ::uint32_t XtcpConfig::io_uring_cqe_batch_size() const {
 }
 inline void XtcpConfig::set_io_uring_cqe_batch_size(::uint32_t value) {
   _internal_set_io_uring_cqe_batch_size(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00040000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00020000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.io_uring_cqe_batch_size)
 }
 inline ::uint32_t XtcpConfig::_internal_io_uring_cqe_batch_size() const {
@@ -10217,7 +10246,7 @@ inline void XtcpConfig::_internal_set_io_uring_cqe_batch_size(::uint32_t value)
 
 // .google.protobuf.Duration reconcile_frequency = 40 [json_name = "reconcileFrequency", (.buf.validate.field) = {
 inline bool XtcpConfig::has_reconcile_frequency() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00002000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00008000U);
   PROTOBUF_ASSUME(!value || _impl_.reconcile_frequency_ != nullptr);
   return value;
 }
@@ -10238,16 +10267,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_reconcile_frequency(
   }
   _impl_.reconcile_frequency_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00002000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00008000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.reconcile_frequency)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_reconcile_frequency() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
   ::google::protobuf::Duration* released = _impl_.reconcile_frequency_;
   _impl_.reconcile_frequency_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -10267,7 +10296,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.reconcile_frequency)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
   ::google::protobuf::Duration* temp = _impl_.reconcile_frequency_;
   _impl_.reconcile_frequency_ = nullptr;
   return temp;
@@ -10282,7 +10311,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_reconcile_frequency()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00002000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00008000U);
   ::google::protobuf::Duration* _msg = _internal_mutable_reconcile_frequency();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.reconcile_frequency)
   return _msg;
@@ -10299,9 +10328,9 @@ inline void XtcpConfig::set_allocated_reconcile_frequency(::google::protobuf::Du
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00002000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00008000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
   }
 
   _impl_.reconcile_frequency_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -10312,7 +10341,7 @@ inline void XtcpConfig::set_allocated_reconcile_frequency(::google::protobuf::Du
 inline void XtcpConfig::clear_reconcile_before_poll() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.reconcile_before_poll_ = false;
-  ClearHasBit(_impl_._has_bits_[0], 0x00100000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00080000U);
 }
 inline bool XtcpConfig::reconcile_before_poll() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.reconcile_before_poll)
@@ -10320,7 +10349,7 @@ inline bool XtcpConfig::reconcile_before_poll() const {
 }
 inline void XtcpConfig::set_reconcile_before_poll(bool value) {
   _internal_set_reconcile_before_poll(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00100000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00080000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.reconcile_before_poll)
 }
 inline bool XtcpConfig::_internal_reconcile_before_poll() const {
@@ -10336,7 +10365,7 @@ inline void XtcpConfig::_internal_set_reconcile_before_poll(bool value) {
 inline void XtcpConfig::clear_write_files() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.write_files_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x01000000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x04000000U);
 }
 inline ::uint32_t XtcpConfig::write_files() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.write_files)
@@ -10344,7 +10373,7 @@ inline ::uint32_t XtcpConfig::write_files() const {
 }
 inline void XtcpConfig::set_write_files(::uint32_t value) {
   _internal_set_write_files(value);
-  SetHasBit(_impl_._has_bits_[1], 0x01000000U);
+  SetHasBit(_impl_._has_bits_[1], 0x04000000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.write_files)
 }
 inline ::uint32_t XtcpConfig::_internal_write_files() const {
@@ -10424,7 +10453,7 @@ inline void XtcpConfig::set_allocated_capture_path(::std::string* PROTOBUF_NULLA
 inline void XtcpConfig::clear_dest_write_files() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.dest_write_files_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x02000000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x08000000U);
 }
 inline ::uint32_t XtcpConfig::dest_write_files() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.dest_write_files)
@@ -10432,7 +10461,7 @@ inline ::uint32_t XtcpConfig::dest_write_files() const {
 }
 inline void XtcpConfig::set_dest_write_files(::uint32_t value) {
   _internal_set_dest_write_files(value);
-  SetHasBit(_impl_._has_bits_[1], 0x02000000U);
+  SetHasBit(_impl_._has_bits_[1], 0x08000000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.dest_write_files)
 }
 inline ::uint32_t XtcpConfig::_internal_dest_write_files() const {
@@ -10448,7 +10477,7 @@ inline void XtcpConfig::_internal_set_dest_write_files(::uint32_t value) {
 inline void XtcpConfig::clear_debug_level() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.debug_level_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x04000000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x10000000U);
 }
 inline ::uint32_t XtcpConfig::debug_level() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.debug_level)
@@ -10456,7 +10485,7 @@ inline ::uint32_t XtcpConfig::debug_level() const {
 }
 inline void XtcpConfig::set_debug_level(::uint32_t value) {
   _internal_set_debug_level(value);
-  SetHasBit(_impl_._has_bits_[1], 0x04000000U);
+  SetHasBit(_impl_._has_bits_[1], 0x10000000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.debug_level)
 }
 inline ::uint32_t XtcpConfig::_internal_debug_level() const {
@@ -10472,7 +10501,7 @@ inline void XtcpConfig::_internal_set_debug_level(::uint32_t value) {
 inline void XtcpConfig::clear_debug_prometheus() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.debug_prometheus_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000010U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000040U);
 }
 inline bool XtcpConfig::debug_prometheus() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.debug_prometheus)
@@ -10480,7 +10509,7 @@ inline bool XtcpConfig::debug_prometheus() const {
 }
 inline void XtcpConfig::set_debug_prometheus(bool value) {
   _internal_set_debug_prometheus(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000010U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000040U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.debug_prometheus)
 }
 inline bool XtcpConfig::_internal_debug_prometheus() const {
@@ -10752,7 +10781,7 @@ inline void XtcpConfig::set_allocated_xtcp_proto_file(::std::string* PROTOBUF_NU
 inline void XtcpConfig::clear_envelope_flush_threshold_bytes() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.envelope_flush_threshold_bytes_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x08000000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x20000000U);
 }
 inline ::uint32_t XtcpConfig::envelope_flush_threshold_bytes() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.envelope_flush_threshold_bytes)
@@ -10760,7 +10789,7 @@ inline ::uint32_t XtcpConfig::envelope_flush_threshold_bytes() const {
 }
 inline void XtcpConfig::set_envelope_flush_threshold_bytes(::uint32_t value) {
   _internal_set_envelope_flush_threshold_bytes(value);
-  SetHasBit(_impl_._has_bits_[1], 0x08000000U);
+  SetHasBit(_impl_._has_bits_[1], 0x20000000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.envelope_flush_threshold_bytes)
 }
 inline ::uint32_t XtcpConfig::_internal_envelope_flush_threshold_bytes() const {
@@ -10776,7 +10805,7 @@ inline void XtcpConfig::_internal_set_envelope_flush_threshold_bytes(::uint32_t
 inline void XtcpConfig::clear_envelope_flush_threshold_rows() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.envelope_flush_threshold_rows_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x10000000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x40000000U);
 }
 inline ::uint32_t XtcpConfig::envelope_flush_threshold_rows() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.envelope_flush_threshold_rows)
@@ -10784,7 +10813,7 @@ inline ::uint32_t XtcpConfig::envelope_flush_threshold_rows() const {
 }
 inline void XtcpConfig::set_envelope_flush_threshold_rows(::uint32_t value) {
   _internal_set_envelope_flush_threshold_rows(value);
-  SetHasBit(_impl_._has_bits_[1], 0x10000000U);
+  SetHasBit(_impl_._has_bits_[1], 0x40000000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.envelope_flush_threshold_rows)
 }
 inline ::uint32_t XtcpConfig::_internal_envelope_flush_threshold_rows() const {
@@ -10926,7 +10955,7 @@ inline void XtcpConfig::set_allocated_kafka_schema_url(::std::string* PROTOBUF_N
 
 // .google.protobuf.Duration kafka_produce_timeout = 82 [json_name = "kafkaProduceTimeout", (.buf.validate.field) = {
 inline bool XtcpConfig::has_kafka_produce_timeout() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00004000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00010000U);
   PROTOBUF_ASSUME(!value || _impl_.kafka_produce_timeout_ != nullptr);
   return value;
 }
@@ -10947,16 +10976,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_kafka_produce_timeout(
   }
   _impl_.kafka_produce_timeout_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00004000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00010000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.kafka_produce_timeout)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_kafka_produce_timeout() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
   ::google::protobuf::Duration* released = _impl_.kafka_produce_timeout_;
   _impl_.kafka_produce_timeout_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -10976,7 +11005,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.kafka_produce_timeout)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
   ::google::protobuf::Duration* temp = _impl_.kafka_produce_timeout_;
   _impl_.kafka_produce_timeout_ = nullptr;
   return temp;
@@ -10991,7 +11020,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_kafka_produce_timeout()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00004000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00010000U);
   ::google::protobuf::Duration* _msg = _internal_mutable_kafka_produce_timeout();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.kafka_produce_timeout)
   return _msg;
@@ -11008,9 +11037,9 @@ inline void XtcpConfig::set_allocated_kafka_produce_timeout(::google::protobuf::
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00004000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00010000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
   }
 
   _impl_.kafka_produce_timeout_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -11469,7 +11498,7 @@ inline void XtcpConfig::set_allocated_s3_secret_key(::std::string* PROTOBUF_NULL
 inline void XtcpConfig::clear_s3_skip_bucket_probe() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.s3_skip_bucket_probe_ = false;
-  ClearHasBit(_impl_._has_bits_[0], 0x00200000U);
+  ClearHasBit(_impl_._has_bits_[0], 0x00100000U);
 }
 inline bool XtcpConfig::s3_skip_bucket_probe() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_skip_bucket_probe)
@@ -11477,7 +11506,7 @@ inline bool XtcpConfig::s3_skip_bucket_probe() const {
 }
 inline void XtcpConfig::set_s3_skip_bucket_probe(bool value) {
   _internal_set_s3_skip_bucket_probe(value);
-  SetHasBit(_impl_._has_bits_[0], 0x00200000U);
+  SetHasBit(_impl_._has_bits_[0], 0x00100000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_skip_bucket_probe)
 }
 inline bool XtcpConfig::_internal_s3_skip_bucket_probe() const {
@@ -11489,11 +11518,99 @@ inline void XtcpConfig::_internal_set_s3_skip_bucket_probe(bool value) {
   _impl_.s3_skip_bucket_probe_ = value;
 }
 
+// bool s3_allow_insecure = 107 [json_name = "s3AllowInsecure", (.buf.validate.field) = {
+inline void XtcpConfig::clear_s3_allow_insecure() {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  _impl_.s3_allow_insecure_ = false;
+  ClearHasBit(_impl_._has_bits_[0], 0x00200000U);
+}
+inline bool XtcpConfig::s3_allow_insecure() const {
+  // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_allow_insecure)
+  return _internal_s3_allow_insecure();
+}
+inline void XtcpConfig::set_s3_allow_insecure(bool value) {
+  _internal_set_s3_allow_insecure(value);
+  SetHasBit(_impl_._has_bits_[0], 0x00200000U);
+  // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_allow_insecure)
+}
+inline bool XtcpConfig::_internal_s3_allow_insecure() const {
+  ::google::protobuf::internal::TSanRead(&_impl_);
+  return _impl_.s3_allow_insecure_;
+}
+inline void XtcpConfig::_internal_set_s3_allow_insecure(bool value) {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  _impl_.s3_allow_insecure_ = value;
+}
+
+// string s3_ca_file = 108 [json_name = "s3CaFile", (.buf.validate.field) = {
+inline void XtcpConfig::clear_s3_ca_file() {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  _impl_.s3_ca_file_.ClearToEmpty();
+  ClearHasBit(_impl_._has_bits_[1], 0x00000002U);
+}
+inline const ::std::string& XtcpConfig::s3_ca_file() const
+    ABSL_ATTRIBUTE_LIFETIME_BOUND {
+  // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_ca_file)
+  return _internal_s3_ca_file();
+}
+template <typename Arg_, typename... Args_>
+PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_s3_ca_file(Arg_&& arg, Args_... args) {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  SetHasBit(_impl_._has_bits_[1], 0x00000002U);
+  _impl_.s3_ca_file_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
+  // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_ca_file)
+}
+inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_s3_ca_file()
+    ABSL_ATTRIBUTE_LIFETIME_BOUND {
+  SetHasBit(_impl_._has_bits_[1], 0x00000002U);
+  ::std::string* _s = _internal_mutable_s3_ca_file();
+  // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.s3_ca_file)
+  return _s;
+}
+inline const ::std::string& XtcpConfig::_internal_s3_ca_file() const {
+  ::google::protobuf::internal::TSanRead(&_impl_);
+  return _impl_.s3_ca_file_.Get();
+}
+inline void XtcpConfig::_internal_set_s3_ca_file(const ::std::string& value) {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  _impl_.s3_ca_file_.Set(value, GetArena());
+}
+inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_s3_ca_file() {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  return _impl_.s3_ca_file_.Mutable( GetArena());
+}
+inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_s3_ca_file() {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.s3_ca_file)
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000002U)) {
+    return nullptr;
+  }
+  ClearHasBit(_impl_._has_bits_[1], 0x00000002U);
+  auto* released = _impl_.s3_ca_file_.Release();
+  if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
+    _impl_.s3_ca_file_.Set("", GetArena());
+  }
+  return released;
+}
+inline void XtcpConfig::set_allocated_s3_ca_file(::std::string* PROTOBUF_NULLABLE value) {
+  ::google::protobuf::internal::TSanWrite(&_impl_);
+  if (value != nullptr) {
+    SetHasBit(_impl_._has_bits_[1], 0x00000002U);
+  } else {
+    ClearHasBit(_impl_._has_bits_[1], 0x00000002U);
+  }
+  _impl_.s3_ca_file_.SetAllocated(value, GetArena());
+  if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.s3_ca_file_.IsDefault()) {
+    _impl_.s3_ca_file_.Set("", GetArena());
+  }
+  // @@protoc_insertion_point(field_set_allocated:xtcp_config.v1.XtcpConfig.s3_ca_file)
+}
+
 // uint32 s3_parquet_flush_threshold_bytes = 110 [json_name = "s3ParquetFlushThresholdBytes", (.buf.validate.field) = {
 inline void XtcpConfig::clear_s3_parquet_flush_threshold_bytes() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.s3_parquet_flush_threshold_bytes_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x20000000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x80000000U);
 }
 inline ::uint32_t XtcpConfig::s3_parquet_flush_threshold_bytes() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_parquet_flush_threshold_bytes)
@@ -11501,7 +11618,7 @@ inline ::uint32_t XtcpConfig::s3_parquet_flush_threshold_bytes() const {
 }
 inline void XtcpConfig::set_s3_parquet_flush_threshold_bytes(::uint32_t value) {
   _internal_set_s3_parquet_flush_threshold_bytes(value);
-  SetHasBit(_impl_._has_bits_[1], 0x20000000U);
+  SetHasBit(_impl_._has_bits_[1], 0x80000000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_parquet_flush_threshold_bytes)
 }
 inline ::uint32_t XtcpConfig::_internal_s3_parquet_flush_threshold_bytes() const {
@@ -11515,7 +11632,7 @@ inline void XtcpConfig::_internal_set_s3_parquet_flush_threshold_bytes(::uint32_
 
 // .google.protobuf.Duration s3_flush_interval = 111 [json_name = "s3FlushInterval", (.buf.validate.field) = {
 inline bool XtcpConfig::has_s3_flush_interval() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00008000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00020000U);
   PROTOBUF_ASSUME(!value || _impl_.s3_flush_interval_ != nullptr);
   return value;
 }
@@ -11536,16 +11653,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_s3_flush_interval(
   }
   _impl_.s3_flush_interval_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00008000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00020000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.s3_flush_interval)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_s3_flush_interval() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
   ::google::protobuf::Duration* released = _impl_.s3_flush_interval_;
   _impl_.s3_flush_interval_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -11565,7 +11682,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.s3_flush_interval)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
   ::google::protobuf::Duration* temp = _impl_.s3_flush_interval_;
   _impl_.s3_flush_interval_ = nullptr;
   return temp;
@@ -11580,7 +11697,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_s3_flush_interval()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00008000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00020000U);
   ::google::protobuf::Duration* _msg = _internal_mutable_s3_flush_interval();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.s3_flush_interval)
   return _msg;
@@ -11597,9 +11714,9 @@ inline void XtcpConfig::set_allocated_s3_flush_interval(::google::protobuf::Dura
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00008000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00020000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00008000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
   }
 
   _impl_.s3_flush_interval_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -11610,7 +11727,7 @@ inline void XtcpConfig::set_allocated_s3_flush_interval(::google::protobuf::Dura
 inline void XtcpConfig::clear_s3_flush_jitter_pct() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.s3_flush_jitter_pct_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x40000000U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000001U);
 }
 inline ::uint32_t XtcpConfig::s3_flush_jitter_pct() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_flush_jitter_pct)
@@ -11618,7 +11735,7 @@ inline ::uint32_t XtcpConfig::s3_flush_jitter_pct() const {
 }
 inline void XtcpConfig::set_s3_flush_jitter_pct(::uint32_t value) {
   _internal_set_s3_flush_jitter_pct(value);
-  SetHasBit(_impl_._has_bits_[1], 0x40000000U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000001U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_flush_jitter_pct)
 }
 inline ::uint32_t XtcpConfig::_internal_s3_flush_jitter_pct() const {
@@ -11634,7 +11751,7 @@ inline void XtcpConfig::_internal_set_s3_flush_jitter_pct(::uint32_t value) {
 inline void XtcpConfig::clear_s3_flush_threshold_jitter_pct() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.s3_flush_threshold_jitter_pct_ = 0u;
-  ClearHasBit(_impl_._has_bits_[1], 0x80000000U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000002U);
 }
 inline ::uint32_t XtcpConfig::s3_flush_threshold_jitter_pct() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_flush_threshold_jitter_pct)
@@ -11642,7 +11759,7 @@ inline ::uint32_t XtcpConfig::s3_flush_threshold_jitter_pct() const {
 }
 inline void XtcpConfig::set_s3_flush_threshold_jitter_pct(::uint32_t value) {
   _internal_set_s3_flush_threshold_jitter_pct(value);
-  SetHasBit(_impl_._has_bits_[1], 0x80000000U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000002U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_flush_threshold_jitter_pct)
 }
 inline ::uint32_t XtcpConfig::_internal_s3_flush_threshold_jitter_pct() const {
@@ -11658,7 +11775,7 @@ inline void XtcpConfig::_internal_set_s3_flush_threshold_jitter_pct(::uint32_t v
 inline void XtcpConfig::clear_s3_upload_max_attempts() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.s3_upload_max_attempts_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000001U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000004U);
 }
 inline ::uint32_t XtcpConfig::s3_upload_max_attempts() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.s3_upload_max_attempts)
@@ -11666,7 +11783,7 @@ inline ::uint32_t XtcpConfig::s3_upload_max_attempts() const {
 }
 inline void XtcpConfig::set_s3_upload_max_attempts(::uint32_t value) {
   _internal_set_s3_upload_max_attempts(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000001U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000004U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.s3_upload_max_attempts)
 }
 inline ::uint32_t XtcpConfig::_internal_s3_upload_max_attempts() const {
@@ -11680,7 +11797,7 @@ inline void XtcpConfig::_internal_set_s3_upload_max_attempts(::uint32_t value) {
 
 // .google.protobuf.Duration s3_upload_backoff_cap = 115 [json_name = "s3UploadBackoffCap", (.buf.validate.field) = {
 inline bool XtcpConfig::has_s3_upload_backoff_cap() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00010000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00040000U);
   PROTOBUF_ASSUME(!value || _impl_.s3_upload_backoff_cap_ != nullptr);
   return value;
 }
@@ -11701,16 +11818,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_s3_upload_backoff_cap(
   }
   _impl_.s3_upload_backoff_cap_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00010000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00040000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.s3_upload_backoff_cap)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_s3_upload_backoff_cap() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
   ::google::protobuf::Duration* released = _impl_.s3_upload_backoff_cap_;
   _impl_.s3_upload_backoff_cap_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -11730,7 +11847,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.s3_upload_backoff_cap)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
   ::google::protobuf::Duration* temp = _impl_.s3_upload_backoff_cap_;
   _impl_.s3_upload_backoff_cap_ = nullptr;
   return temp;
@@ -11745,7 +11862,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_s3_upload_backoff_cap()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00010000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00040000U);
   ::google::protobuf::Duration* _msg = _internal_mutable_s3_upload_backoff_cap();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.s3_upload_backoff_cap)
   return _msg;
@@ -11762,9 +11879,9 @@ inline void XtcpConfig::set_allocated_s3_upload_backoff_cap(::google::protobuf::
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00010000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00040000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00010000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
   }
 
   _impl_.s3_upload_backoff_cap_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -11775,7 +11892,7 @@ inline void XtcpConfig::set_allocated_s3_upload_backoff_cap(::google::protobuf::
 inline void XtcpConfig::clear_hostname() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.hostname_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000002U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000004U);
 }
 inline const ::std::string& XtcpConfig::hostname() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -11785,13 +11902,13 @@ inline const ::std::string& XtcpConfig::hostname() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_hostname(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000002U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000004U);
   _impl_.hostname_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.hostname)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_hostname()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000002U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000004U);
   ::std::string* _s = _internal_mutable_hostname();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.hostname)
   return _s;
@@ -11811,10 +11928,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_hostname()
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_hostname() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.hostname)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000002U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000004U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000002U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000004U);
   auto* released = _impl_.hostname_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.hostname_.Set("", GetArena());
@@ -11824,9 +11941,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_hostname() {
 inline void XtcpConfig::set_allocated_hostname(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000002U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000004U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000002U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000004U);
   }
   _impl_.hostname_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.hostname_.IsDefault()) {
@@ -11839,7 +11956,7 @@ inline void XtcpConfig::set_allocated_hostname(::std::string* PROTOBUF_NULLABLE
 inline void XtcpConfig::clear_location() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.location_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000004U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000008U);
 }
 inline const ::std::string& XtcpConfig::location() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -11849,13 +11966,13 @@ inline const ::std::string& XtcpConfig::location() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_location(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000004U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000008U);
   _impl_.location_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.location)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_location()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000004U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000008U);
   ::std::string* _s = _internal_mutable_location();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.location)
   return _s;
@@ -11875,10 +11992,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_location()
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_location() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.location)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000004U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000008U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000004U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000008U);
   auto* released = _impl_.location_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.location_.Set("", GetArena());
@@ -11888,9 +12005,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_location() {
 inline void XtcpConfig::set_allocated_location(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000004U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000008U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000004U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000008U);
   }
   _impl_.location_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.location_.IsDefault()) {
@@ -11903,7 +12020,7 @@ inline void XtcpConfig::set_allocated_location(::std::string* PROTOBUF_NULLABLE
 inline void XtcpConfig::clear_label() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.label_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000008U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000010U);
 }
 inline const ::std::string& XtcpConfig::label() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -11913,13 +12030,13 @@ inline const ::std::string& XtcpConfig::label() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_label(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000008U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000010U);
   _impl_.label_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.label)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_label()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000008U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000010U);
   ::std::string* _s = _internal_mutable_label();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.label)
   return _s;
@@ -11939,10 +12056,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_label() {
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_label() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.label)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000008U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000010U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000008U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000010U);
   auto* released = _impl_.label_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.label_.Set("", GetArena());
@@ -11952,9 +12069,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_label() {
 inline void XtcpConfig::set_allocated_label(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000008U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000010U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000008U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000010U);
   }
   _impl_.label_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.label_.IsDefault()) {
@@ -11967,7 +12084,7 @@ inline void XtcpConfig::set_allocated_label(::std::string* PROTOBUF_NULLABLE val
 inline void XtcpConfig::clear_tag() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.tag_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000010U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000020U);
 }
 inline const ::std::string& XtcpConfig::tag() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -11977,13 +12094,13 @@ inline const ::std::string& XtcpConfig::tag() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_tag(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000010U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000020U);
   _impl_.tag_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.tag)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_tag()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000010U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000020U);
   ::std::string* _s = _internal_mutable_tag();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.tag)
   return _s;
@@ -12003,10 +12120,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_tag() {
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_tag() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.tag)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000010U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000020U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000010U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000020U);
   auto* released = _impl_.tag_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.tag_.Set("", GetArena());
@@ -12016,9 +12133,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_tag() {
 inline void XtcpConfig::set_allocated_tag(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000010U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000020U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000010U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000020U);
   }
   _impl_.tag_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.tag_.IsDefault()) {
@@ -12031,7 +12148,7 @@ inline void XtcpConfig::set_allocated_tag(::std::string* PROTOBUF_NULLABLE value
 inline void XtcpConfig::clear_daemon_version() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.daemon_version_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000020U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000040U);
 }
 inline const ::std::string& XtcpConfig::daemon_version() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -12041,13 +12158,13 @@ inline const ::std::string& XtcpConfig::daemon_version() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_daemon_version(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000020U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000040U);
   _impl_.daemon_version_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.daemon_version)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_daemon_version()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000020U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000040U);
   ::std::string* _s = _internal_mutable_daemon_version();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.daemon_version)
   return _s;
@@ -12067,10 +12184,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_daemon_vers
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_daemon_version() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.daemon_version)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000020U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000040U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000020U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000040U);
   auto* released = _impl_.daemon_version_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.daemon_version_.Set("", GetArena());
@@ -12080,9 +12197,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_daemon_version() {
 inline void XtcpConfig::set_allocated_daemon_version(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000020U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000040U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000020U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000040U);
   }
   _impl_.daemon_version_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.daemon_version_.IsDefault()) {
@@ -12095,7 +12212,7 @@ inline void XtcpConfig::set_allocated_daemon_version(::std::string* PROTOBUF_NUL
 inline void XtcpConfig::clear_ipv4_ttl() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.ipv4_ttl_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000002U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000008U);
 }
 inline ::uint32_t XtcpConfig::ipv4_ttl() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.ipv4_ttl)
@@ -12103,7 +12220,7 @@ inline ::uint32_t XtcpConfig::ipv4_ttl() const {
 }
 inline void XtcpConfig::set_ipv4_ttl(::uint32_t value) {
   _internal_set_ipv4_ttl(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000002U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000008U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.ipv4_ttl)
 }
 inline ::uint32_t XtcpConfig::_internal_ipv4_ttl() const {
@@ -12119,7 +12236,7 @@ inline void XtcpConfig::_internal_set_ipv4_ttl(::uint32_t value) {
 inline void XtcpConfig::clear_ipv6_hop_limit() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.ipv6_hop_limit_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000004U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000010U);
 }
 inline ::uint32_t XtcpConfig::ipv6_hop_limit() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.ipv6_hop_limit)
@@ -12127,7 +12244,7 @@ inline ::uint32_t XtcpConfig::ipv6_hop_limit() const {
 }
 inline void XtcpConfig::set_ipv6_hop_limit(::uint32_t value) {
   _internal_set_ipv6_hop_limit(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000004U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000010U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.ipv6_hop_limit)
 }
 inline ::uint32_t XtcpConfig::_internal_ipv6_hop_limit() const {
@@ -12141,14 +12258,14 @@ inline void XtcpConfig::_internal_set_ipv6_hop_limit(::uint32_t value) {
 
 // .xtcp_config.v1.ListenerAuth listener_auth = 152 [json_name = "listenerAuth", (.buf.validate.field) = {
 inline bool XtcpConfig::has_listener_auth() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00020000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00080000U);
   PROTOBUF_ASSUME(!value || _impl_.listener_auth_ != nullptr);
   return value;
 }
 inline void XtcpConfig::clear_listener_auth() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.listener_auth_ != nullptr) _impl_.listener_auth_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
 }
 inline const ::xtcp_config::v1::ListenerAuth& XtcpConfig::_internal_listener_auth() const {
   ::google::protobuf::internal::TSanRead(&_impl_);
@@ -12167,16 +12284,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_listener_auth(
   }
   _impl_.listener_auth_ = reinterpret_cast<::xtcp_config::v1::ListenerAuth*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00020000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00080000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.listener_auth)
 }
 inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NULLABLE XtcpConfig::release_listener_auth() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
   ::xtcp_config::v1::ListenerAuth* released = _impl_.listener_auth_;
   _impl_.listener_auth_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -12196,7 +12313,7 @@ inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NULLABLE XtcpConfig::unsafe_are
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.listener_auth)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
   ::xtcp_config::v1::ListenerAuth* temp = _impl_.listener_auth_;
   _impl_.listener_auth_ = nullptr;
   return temp;
@@ -12211,7 +12328,7 @@ inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NONNULL XtcpConfig::_internal_m
 }
 inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NONNULL XtcpConfig::mutable_listener_auth()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00020000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00080000U);
   ::xtcp_config::v1::ListenerAuth* _msg = _internal_mutable_listener_auth();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.listener_auth)
   return _msg;
@@ -12228,9 +12345,9 @@ inline void XtcpConfig::set_allocated_listener_auth(::xtcp_config::v1::ListenerA
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00020000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00080000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00020000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
   }
 
   _impl_.listener_auth_ = reinterpret_cast<::xtcp_config::v1::ListenerAuth*>(value);
@@ -12239,14 +12356,14 @@ inline void XtcpConfig::set_allocated_listener_auth(::xtcp_config::v1::ListenerA
 
 // .xtcp_config.v1.ListenerEndpoint prometheus_listener = 153 [json_name = "prometheusListener", (.buf.validate.field) = {
 inline bool XtcpConfig::has_prometheus_listener() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00040000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00100000U);
   PROTOBUF_ASSUME(!value || _impl_.prometheus_listener_ != nullptr);
   return value;
 }
 inline void XtcpConfig::clear_prometheus_listener() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.prometheus_listener_ != nullptr) _impl_.prometheus_listener_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
 }
 inline const ::xtcp_config::v1::ListenerEndpoint& XtcpConfig::_internal_prometheus_listener() const {
   ::google::protobuf::internal::TSanRead(&_impl_);
@@ -12265,16 +12382,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_prometheus_listener(
   }
   _impl_.prometheus_listener_ = reinterpret_cast<::xtcp_config::v1::ListenerEndpoint*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00040000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00100000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.prometheus_listener)
 }
 inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NULLABLE XtcpConfig::release_prometheus_listener() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
   ::xtcp_config::v1::ListenerEndpoint* released = _impl_.prometheus_listener_;
   _impl_.prometheus_listener_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -12294,7 +12411,7 @@ inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NULLABLE XtcpConfig::unsafe
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.prometheus_listener)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
   ::xtcp_config::v1::ListenerEndpoint* temp = _impl_.prometheus_listener_;
   _impl_.prometheus_listener_ = nullptr;
   return temp;
@@ -12309,7 +12426,7 @@ inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NONNULL XtcpConfig::_intern
 }
 inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NONNULL XtcpConfig::mutable_prometheus_listener()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00040000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00100000U);
   ::xtcp_config::v1::ListenerEndpoint* _msg = _internal_mutable_prometheus_listener();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.prometheus_listener)
   return _msg;
@@ -12326,9 +12443,9 @@ inline void XtcpConfig::set_allocated_prometheus_listener(::xtcp_config::v1::Lis
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00040000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00100000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00040000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
   }
 
   _impl_.prometheus_listener_ = reinterpret_cast<::xtcp_config::v1::ListenerEndpoint*>(value);
@@ -12337,14 +12454,14 @@ inline void XtcpConfig::set_allocated_prometheus_listener(::xtcp_config::v1::Lis
 
 // .xtcp_config.v1.ListenerAuth admin_listener_auth = 154 [json_name = "adminListenerAuth", (.buf.validate.field) = {
 inline bool XtcpConfig::has_admin_listener_auth() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00080000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00200000U);
   PROTOBUF_ASSUME(!value || _impl_.admin_listener_auth_ != nullptr);
   return value;
 }
 inline void XtcpConfig::clear_admin_listener_auth() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.admin_listener_auth_ != nullptr) _impl_.admin_listener_auth_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
 }
 inline const ::xtcp_config::v1::ListenerAuth& XtcpConfig::_internal_admin_listener_auth() const {
   ::google::protobuf::internal::TSanRead(&_impl_);
@@ -12363,16 +12480,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_admin_listener_auth(
   }
   _impl_.admin_listener_auth_ = reinterpret_cast<::xtcp_config::v1::ListenerAuth*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00080000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00200000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.admin_listener_auth)
 }
 inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NULLABLE XtcpConfig::release_admin_listener_auth() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
   ::xtcp_config::v1::ListenerAuth* released = _impl_.admin_listener_auth_;
   _impl_.admin_listener_auth_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -12392,7 +12509,7 @@ inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NULLABLE XtcpConfig::unsafe_are
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.admin_listener_auth)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
   ::xtcp_config::v1::ListenerAuth* temp = _impl_.admin_listener_auth_;
   _impl_.admin_listener_auth_ = nullptr;
   return temp;
@@ -12407,7 +12524,7 @@ inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NONNULL XtcpConfig::_internal_m
 }
 inline ::xtcp_config::v1::ListenerAuth* PROTOBUF_NONNULL XtcpConfig::mutable_admin_listener_auth()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00080000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00200000U);
   ::xtcp_config::v1::ListenerAuth* _msg = _internal_mutable_admin_listener_auth();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.admin_listener_auth)
   return _msg;
@@ -12424,9 +12541,9 @@ inline void XtcpConfig::set_allocated_admin_listener_auth(::xtcp_config::v1::Lis
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00080000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00200000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00080000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
   }
 
   _impl_.admin_listener_auth_ = reinterpret_cast<::xtcp_config::v1::ListenerAuth*>(value);
@@ -12437,7 +12554,7 @@ inline void XtcpConfig::set_allocated_admin_listener_auth(::xtcp_config::v1::Lis
 inline void XtcpConfig::clear_grpc_port() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.grpc_port_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000008U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000020U);
 }
 inline ::uint32_t XtcpConfig::grpc_port() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.grpc_port)
@@ -12445,7 +12562,7 @@ inline ::uint32_t XtcpConfig::grpc_port() const {
 }
 inline void XtcpConfig::set_grpc_port(::uint32_t value) {
   _internal_set_grpc_port(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000008U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000020U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.grpc_port)
 }
 inline ::uint32_t XtcpConfig::_internal_grpc_port() const {
@@ -12459,14 +12576,14 @@ inline void XtcpConfig::_internal_set_grpc_port(::uint32_t value) {
 
 // .xtcp_config.v1.ListenerEndpoint grpc_listener = 161 [json_name = "grpcListener", (.buf.validate.field) = {
 inline bool XtcpConfig::has_grpc_listener() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00100000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00400000U);
   PROTOBUF_ASSUME(!value || _impl_.grpc_listener_ != nullptr);
   return value;
 }
 inline void XtcpConfig::clear_grpc_listener() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.grpc_listener_ != nullptr) _impl_.grpc_listener_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
 }
 inline const ::xtcp_config::v1::ListenerEndpoint& XtcpConfig::_internal_grpc_listener() const {
   ::google::protobuf::internal::TSanRead(&_impl_);
@@ -12485,16 +12602,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_grpc_listener(
   }
   _impl_.grpc_listener_ = reinterpret_cast<::xtcp_config::v1::ListenerEndpoint*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00100000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00400000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.grpc_listener)
 }
 inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NULLABLE XtcpConfig::release_grpc_listener() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
   ::xtcp_config::v1::ListenerEndpoint* released = _impl_.grpc_listener_;
   _impl_.grpc_listener_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -12514,7 +12631,7 @@ inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NULLABLE XtcpConfig::unsafe
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.grpc_listener)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
   ::xtcp_config::v1::ListenerEndpoint* temp = _impl_.grpc_listener_;
   _impl_.grpc_listener_ = nullptr;
   return temp;
@@ -12529,7 +12646,7 @@ inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NONNULL XtcpConfig::_intern
 }
 inline ::xtcp_config::v1::ListenerEndpoint* PROTOBUF_NONNULL XtcpConfig::mutable_grpc_listener()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00100000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00400000U);
   ::xtcp_config::v1::ListenerEndpoint* _msg = _internal_mutable_grpc_listener();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.grpc_listener)
   return _msg;
@@ -12546,9 +12663,9 @@ inline void XtcpConfig::set_allocated_grpc_listener(::xtcp_config::v1::ListenerE
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00100000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00400000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00100000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
   }
 
   _impl_.grpc_listener_ = reinterpret_cast<::xtcp_config::v1::ListenerEndpoint*>(value);
@@ -12559,7 +12676,7 @@ inline void XtcpConfig::set_allocated_grpc_listener(::xtcp_config::v1::ListenerE
 inline void XtcpConfig::clear_pyroscope_url() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.pyroscope_url_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000040U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000080U);
 }
 inline const ::std::string& XtcpConfig::pyroscope_url() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -12569,13 +12686,13 @@ inline const ::std::string& XtcpConfig::pyroscope_url() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_pyroscope_url(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000040U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000080U);
   _impl_.pyroscope_url_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.pyroscope_url)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_pyroscope_url()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000040U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000080U);
   ::std::string* _s = _internal_mutable_pyroscope_url();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.pyroscope_url)
   return _s;
@@ -12595,10 +12712,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_pyroscope_u
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_pyroscope_url() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.pyroscope_url)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000040U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000080U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000040U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000080U);
   auto* released = _impl_.pyroscope_url_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.pyroscope_url_.Set("", GetArena());
@@ -12608,9 +12725,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_pyroscope_url() {
 inline void XtcpConfig::set_allocated_pyroscope_url(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000040U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000080U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000040U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000080U);
   }
   _impl_.pyroscope_url_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.pyroscope_url_.IsDefault()) {
@@ -12623,7 +12740,7 @@ inline void XtcpConfig::set_allocated_pyroscope_url(::std::string* PROTOBUF_NULL
 inline void XtcpConfig::clear_pyroscope_app_name() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.pyroscope_app_name_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000100U);
 }
 inline const ::std::string& XtcpConfig::pyroscope_app_name() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -12633,13 +12750,13 @@ inline const ::std::string& XtcpConfig::pyroscope_app_name() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_pyroscope_app_name(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[0], 0x00000010U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000100U);
   _impl_.pyroscope_app_name_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.pyroscope_app_name)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_pyroscope_app_name()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[0], 0x00000010U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000100U);
   ::std::string* _s = _internal_mutable_pyroscope_app_name();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.pyroscope_app_name)
   return _s;
@@ -12659,10 +12776,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_pyroscope_a
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_pyroscope_app_name() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.pyroscope_app_name)
-  if (!CheckHasBit(_impl_._has_bits_[0], 0x00000010U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000100U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000100U);
   auto* released = _impl_.pyroscope_app_name_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.pyroscope_app_name_.Set("", GetArena());
@@ -12672,9 +12789,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_pyroscope_app_name()
 inline void XtcpConfig::set_allocated_pyroscope_app_name(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[0], 0x00000010U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000100U);
   } else {
-    ClearHasBit(_impl_._has_bits_[0], 0x00000010U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000100U);
   }
   _impl_.pyroscope_app_name_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.pyroscope_app_name_.IsDefault()) {
@@ -12687,7 +12804,7 @@ inline void XtcpConfig::set_allocated_pyroscope_app_name(::std::string* PROTOBUF
 inline void XtcpConfig::clear_pyroscope_sample_hz() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.pyroscope_sample_hz_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000100U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000400U);
 }
 inline ::uint32_t XtcpConfig::pyroscope_sample_hz() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.pyroscope_sample_hz)
@@ -12695,7 +12812,7 @@ inline ::uint32_t XtcpConfig::pyroscope_sample_hz() const {
 }
 inline void XtcpConfig::set_pyroscope_sample_hz(::uint32_t value) {
   _internal_set_pyroscope_sample_hz(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000100U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000400U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.pyroscope_sample_hz)
 }
 inline ::uint32_t XtcpConfig::_internal_pyroscope_sample_hz() const {
@@ -12711,7 +12828,7 @@ inline void XtcpConfig::_internal_set_pyroscope_sample_hz(::uint32_t value) {
 inline void XtcpConfig::clear_pyroscope_upload_interval_sec() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.pyroscope_upload_interval_sec_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000200U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000800U);
 }
 inline ::uint32_t XtcpConfig::pyroscope_upload_interval_sec() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.pyroscope_upload_interval_sec)
@@ -12719,7 +12836,7 @@ inline ::uint32_t XtcpConfig::pyroscope_upload_interval_sec() const {
 }
 inline void XtcpConfig::set_pyroscope_upload_interval_sec(::uint32_t value) {
   _internal_set_pyroscope_upload_interval_sec(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000200U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000800U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.pyroscope_upload_interval_sec)
 }
 inline ::uint32_t XtcpConfig::_internal_pyroscope_upload_interval_sec() const {
@@ -12735,7 +12852,7 @@ inline void XtcpConfig::_internal_set_pyroscope_upload_interval_sec(::uint32_t v
 inline void XtcpConfig::clear_resolve_container_id() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.resolve_container_id_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000020U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000080U);
 }
 inline bool XtcpConfig::resolve_container_id() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.resolve_container_id)
@@ -12743,7 +12860,7 @@ inline bool XtcpConfig::resolve_container_id() const {
 }
 inline void XtcpConfig::set_resolve_container_id(bool value) {
   _internal_set_resolve_container_id(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000020U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000080U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.resolve_container_id)
 }
 inline bool XtcpConfig::_internal_resolve_container_id() const {
@@ -12759,7 +12876,7 @@ inline void XtcpConfig::_internal_set_resolve_container_id(bool value) {
 inline void XtcpConfig::clear_enrich_container_enable() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.enrich_container_enable_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000040U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000100U);
 }
 inline bool XtcpConfig::enrich_container_enable() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.enrich_container_enable)
@@ -12767,7 +12884,7 @@ inline bool XtcpConfig::enrich_container_enable() const {
 }
 inline void XtcpConfig::set_enrich_container_enable(bool value) {
   _internal_set_enrich_container_enable(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000040U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000100U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.enrich_container_enable)
 }
 inline bool XtcpConfig::_internal_enrich_container_enable() const {
@@ -12783,7 +12900,7 @@ inline void XtcpConfig::_internal_set_enrich_container_enable(bool value) {
 inline void XtcpConfig::clear_docker_socket_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.docker_socket_path_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000080U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000200U);
 }
 inline const ::std::string& XtcpConfig::docker_socket_path() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -12793,13 +12910,13 @@ inline const ::std::string& XtcpConfig::docker_socket_path() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_docker_socket_path(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000080U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000200U);
   _impl_.docker_socket_path_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.docker_socket_path)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_docker_socket_path()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000080U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000200U);
   ::std::string* _s = _internal_mutable_docker_socket_path();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.docker_socket_path)
   return _s;
@@ -12819,10 +12936,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_docker_sock
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_docker_socket_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.docker_socket_path)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000080U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000200U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000080U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000200U);
   auto* released = _impl_.docker_socket_path_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.docker_socket_path_.Set("", GetArena());
@@ -12832,9 +12949,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_docker_socket_path()
 inline void XtcpConfig::set_allocated_docker_socket_path(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000080U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000200U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000080U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000200U);
   }
   _impl_.docker_socket_path_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.docker_socket_path_.IsDefault()) {
@@ -12847,7 +12964,7 @@ inline void XtcpConfig::set_allocated_docker_socket_path(::std::string* PROTOBUF
 inline void XtcpConfig::clear_enrich_lldp_enable() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.enrich_lldp_enable_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000080U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00000200U);
 }
 inline bool XtcpConfig::enrich_lldp_enable() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.enrich_lldp_enable)
@@ -12855,7 +12972,7 @@ inline bool XtcpConfig::enrich_lldp_enable() const {
 }
 inline void XtcpConfig::set_enrich_lldp_enable(bool value) {
   _internal_set_enrich_lldp_enable(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000080U);
+  SetHasBit(_impl_._has_bits_[2], 0x00000200U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.enrich_lldp_enable)
 }
 inline bool XtcpConfig::_internal_enrich_lldp_enable() const {
@@ -12871,7 +12988,7 @@ inline void XtcpConfig::_internal_set_enrich_lldp_enable(bool value) {
 inline void XtcpConfig::clear_lldpd_socket_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.lldpd_socket_path_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000100U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000400U);
 }
 inline const ::std::string& XtcpConfig::lldpd_socket_path() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -12881,13 +12998,13 @@ inline const ::std::string& XtcpConfig::lldpd_socket_path() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_lldpd_socket_path(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000100U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000400U);
   _impl_.lldpd_socket_path_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.lldpd_socket_path)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_lldpd_socket_path()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000100U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000400U);
   ::std::string* _s = _internal_mutable_lldpd_socket_path();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.lldpd_socket_path)
   return _s;
@@ -12907,10 +13024,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_lldpd_socke
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_lldpd_socket_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.lldpd_socket_path)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000100U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000400U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000100U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000400U);
   auto* released = _impl_.lldpd_socket_path_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.lldpd_socket_path_.Set("", GetArena());
@@ -12920,9 +13037,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_lldpd_socket_path()
 inline void XtcpConfig::set_allocated_lldpd_socket_path(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000100U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000400U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000100U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000400U);
   }
   _impl_.lldpd_socket_path_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.lldpd_socket_path_.IsDefault()) {
@@ -12935,7 +13052,7 @@ inline void XtcpConfig::set_allocated_lldpd_socket_path(::std::string* PROTOBUF_
 inline void XtcpConfig::clear_lldpd_version_hint() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.lldpd_version_hint_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000200U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000800U);
 }
 inline const ::std::string& XtcpConfig::lldpd_version_hint() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -12945,13 +13062,13 @@ inline const ::std::string& XtcpConfig::lldpd_version_hint() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_lldpd_version_hint(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000200U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000800U);
   _impl_.lldpd_version_hint_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.lldpd_version_hint)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_lldpd_version_hint()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000200U);
+  SetHasBit(_impl_._has_bits_[1], 0x00000800U);
   ::std::string* _s = _internal_mutable_lldpd_version_hint();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.lldpd_version_hint)
   return _s;
@@ -12971,10 +13088,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_lldpd_versi
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_lldpd_version_hint() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.lldpd_version_hint)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000200U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000800U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000200U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00000800U);
   auto* released = _impl_.lldpd_version_hint_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.lldpd_version_hint_.Set("", GetArena());
@@ -12984,9 +13101,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_lldpd_version_hint()
 inline void XtcpConfig::set_allocated_lldpd_version_hint(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000200U);
+    SetHasBit(_impl_._has_bits_[1], 0x00000800U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000200U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00000800U);
   }
   _impl_.lldpd_version_hint_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.lldpd_version_hint_.IsDefault()) {
@@ -12999,7 +13116,7 @@ inline void XtcpConfig::set_allocated_lldpd_version_hint(::std::string* PROTOBUF
 inline void XtcpConfig::clear_enrich_nic_enable() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.enrich_nic_enable_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000800U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00002000U);
 }
 inline bool XtcpConfig::enrich_nic_enable() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.enrich_nic_enable)
@@ -13007,7 +13124,7 @@ inline bool XtcpConfig::enrich_nic_enable() const {
 }
 inline void XtcpConfig::set_enrich_nic_enable(bool value) {
   _internal_set_enrich_nic_enable(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000800U);
+  SetHasBit(_impl_._has_bits_[2], 0x00002000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.enrich_nic_enable)
 }
 inline bool XtcpConfig::_internal_enrich_nic_enable() const {
@@ -13023,7 +13140,7 @@ inline void XtcpConfig::_internal_set_enrich_nic_enable(bool value) {
 inline void XtcpConfig::clear_uplink_count() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.uplink_count_ = 0u;
-  ClearHasBit(_impl_._has_bits_[2], 0x00000400U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00001000U);
 }
 inline ::uint32_t XtcpConfig::uplink_count() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.uplink_count)
@@ -13031,7 +13148,7 @@ inline ::uint32_t XtcpConfig::uplink_count() const {
 }
 inline void XtcpConfig::set_uplink_count(::uint32_t value) {
   _internal_set_uplink_count(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00000400U);
+  SetHasBit(_impl_._has_bits_[2], 0x00001000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.uplink_count)
 }
 inline ::uint32_t XtcpConfig::_internal_uplink_count() const {
@@ -13119,7 +13236,7 @@ XtcpConfig::_internal_mutable_uplink_interfaces() {
 inline void XtcpConfig::clear_populate_nsid() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.populate_nsid_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00001000U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00004000U);
 }
 inline bool XtcpConfig::populate_nsid() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.populate_nsid)
@@ -13127,7 +13244,7 @@ inline bool XtcpConfig::populate_nsid() const {
 }
 inline void XtcpConfig::set_populate_nsid(bool value) {
   _internal_set_populate_nsid(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00001000U);
+  SetHasBit(_impl_._has_bits_[2], 0x00004000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.populate_nsid)
 }
 inline bool XtcpConfig::_internal_populate_nsid() const {
@@ -13143,7 +13260,7 @@ inline void XtcpConfig::_internal_set_populate_nsid(bool value) {
 inline void XtcpConfig::clear_enrich_asn_enable() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.enrich_asn_enable_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00002000U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00008000U);
 }
 inline bool XtcpConfig::enrich_asn_enable() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.enrich_asn_enable)
@@ -13151,7 +13268,7 @@ inline bool XtcpConfig::enrich_asn_enable() const {
 }
 inline void XtcpConfig::set_enrich_asn_enable(bool value) {
   _internal_set_enrich_asn_enable(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00002000U);
+  SetHasBit(_impl_._has_bits_[2], 0x00008000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.enrich_asn_enable)
 }
 inline bool XtcpConfig::_internal_enrich_asn_enable() const {
@@ -13167,7 +13284,7 @@ inline void XtcpConfig::_internal_set_enrich_asn_enable(bool value) {
 inline void XtcpConfig::clear_asn_db_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.asn_db_path_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000400U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00001000U);
 }
 inline const ::std::string& XtcpConfig::asn_db_path() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -13177,13 +13294,13 @@ inline const ::std::string& XtcpConfig::asn_db_path() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_asn_db_path(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000400U);
+  SetHasBit(_impl_._has_bits_[1], 0x00001000U);
   _impl_.asn_db_path_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.asn_db_path)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_asn_db_path()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000400U);
+  SetHasBit(_impl_._has_bits_[1], 0x00001000U);
   ::std::string* _s = _internal_mutable_asn_db_path();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.asn_db_path)
   return _s;
@@ -13203,10 +13320,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_asn_db_path
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_asn_db_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.asn_db_path)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000400U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00001000U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000400U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00001000U);
   auto* released = _impl_.asn_db_path_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.asn_db_path_.Set("", GetArena());
@@ -13216,9 +13333,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_asn_db_path() {
 inline void XtcpConfig::set_allocated_asn_db_path(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000400U);
+    SetHasBit(_impl_._has_bits_[1], 0x00001000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000400U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00001000U);
   }
   _impl_.asn_db_path_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.asn_db_path_.IsDefault()) {
@@ -13229,7 +13346,7 @@ inline void XtcpConfig::set_allocated_asn_db_path(::std::string* PROTOBUF_NULLAB
 
 // .google.protobuf.Duration asn_refresh_interval = 242 [json_name = "asnRefreshInterval"];
 inline bool XtcpConfig::has_asn_refresh_interval() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00200000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00800000U);
   PROTOBUF_ASSUME(!value || _impl_.asn_refresh_interval_ != nullptr);
   return value;
 }
@@ -13250,16 +13367,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_asn_refresh_interval(
   }
   _impl_.asn_refresh_interval_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00200000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00800000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.asn_refresh_interval)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_asn_refresh_interval() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
   ::google::protobuf::Duration* released = _impl_.asn_refresh_interval_;
   _impl_.asn_refresh_interval_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -13279,7 +13396,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.asn_refresh_interval)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
   ::google::protobuf::Duration* temp = _impl_.asn_refresh_interval_;
   _impl_.asn_refresh_interval_ = nullptr;
   return temp;
@@ -13294,7 +13411,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_asn_refresh_interval()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00200000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00800000U);
   ::google::protobuf::Duration* _msg = _internal_mutable_asn_refresh_interval();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.asn_refresh_interval)
   return _msg;
@@ -13311,9 +13428,9 @@ inline void XtcpConfig::set_allocated_asn_refresh_interval(::google::protobuf::D
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00200000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00800000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00200000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
   }
 
   _impl_.asn_refresh_interval_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -13324,7 +13441,7 @@ inline void XtcpConfig::set_allocated_asn_refresh_interval(::google::protobuf::D
 inline void XtcpConfig::clear_ipmeta_bootstrap_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.ipmeta_bootstrap_path_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00000800U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
 }
 inline const ::std::string& XtcpConfig::ipmeta_bootstrap_path() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -13334,13 +13451,13 @@ inline const ::std::string& XtcpConfig::ipmeta_bootstrap_path() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_ipmeta_bootstrap_path(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00000800U);
+  SetHasBit(_impl_._has_bits_[1], 0x00002000U);
   _impl_.ipmeta_bootstrap_path_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.ipmeta_bootstrap_path)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_ipmeta_bootstrap_path()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00000800U);
+  SetHasBit(_impl_._has_bits_[1], 0x00002000U);
   ::std::string* _s = _internal_mutable_ipmeta_bootstrap_path();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.ipmeta_bootstrap_path)
   return _s;
@@ -13360,10 +13477,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_ipmeta_boot
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_ipmeta_bootstrap_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.ipmeta_bootstrap_path)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00000800U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00002000U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00000800U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
   auto* released = _impl_.ipmeta_bootstrap_path_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.ipmeta_bootstrap_path_.Set("", GetArena());
@@ -13373,9 +13490,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_ipmeta_bootstrap_pat
 inline void XtcpConfig::set_allocated_ipmeta_bootstrap_path(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00000800U);
+    SetHasBit(_impl_._has_bits_[1], 0x00002000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00000800U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00002000U);
   }
   _impl_.ipmeta_bootstrap_path_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.ipmeta_bootstrap_path_.IsDefault()) {
@@ -13388,7 +13505,7 @@ inline void XtcpConfig::set_allocated_ipmeta_bootstrap_path(::std::string* PROTO
 inline void XtcpConfig::clear_ipmeta_cache_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.ipmeta_cache_path_.ClearToEmpty();
-  ClearHasBit(_impl_._has_bits_[1], 0x00001000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
 }
 inline const ::std::string& XtcpConfig::ipmeta_cache_path() const
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
@@ -13398,13 +13515,13 @@ inline const ::std::string& XtcpConfig::ipmeta_cache_path() const
 template <typename Arg_, typename... Args_>
 PROTOBUF_ALWAYS_INLINE void XtcpConfig::set_ipmeta_cache_path(Arg_&& arg, Args_... args) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
-  SetHasBit(_impl_._has_bits_[1], 0x00001000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00004000U);
   _impl_.ipmeta_cache_path_.Set(static_cast<Arg_&&>(arg), args..., GetArena());
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.ipmeta_cache_path)
 }
 inline ::std::string* PROTOBUF_NONNULL XtcpConfig::mutable_ipmeta_cache_path()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00001000U);
+  SetHasBit(_impl_._has_bits_[1], 0x00004000U);
   ::std::string* _s = _internal_mutable_ipmeta_cache_path();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.ipmeta_cache_path)
   return _s;
@@ -13424,10 +13541,10 @@ inline ::std::string* PROTOBUF_NONNULL XtcpConfig::_internal_mutable_ipmeta_cach
 inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_ipmeta_cache_path() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.ipmeta_cache_path)
-  if (!CheckHasBit(_impl_._has_bits_[1], 0x00001000U)) {
+  if (!CheckHasBit(_impl_._has_bits_[1], 0x00004000U)) {
     return nullptr;
   }
-  ClearHasBit(_impl_._has_bits_[1], 0x00001000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
   auto* released = _impl_.ipmeta_cache_path_.Release();
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString()) {
     _impl_.ipmeta_cache_path_.Set("", GetArena());
@@ -13437,9 +13554,9 @@ inline ::std::string* PROTOBUF_NULLABLE XtcpConfig::release_ipmeta_cache_path()
 inline void XtcpConfig::set_allocated_ipmeta_cache_path(::std::string* PROTOBUF_NULLABLE value) {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00001000U);
+    SetHasBit(_impl_._has_bits_[1], 0x00004000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00001000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x00004000U);
   }
   _impl_.ipmeta_cache_path_.SetAllocated(value, GetArena());
   if (::google::protobuf::internal::DebugHardenForceCopyDefaultString() && _impl_.ipmeta_cache_path_.IsDefault()) {
@@ -13452,7 +13569,7 @@ inline void XtcpConfig::set_allocated_ipmeta_cache_path(::std::string* PROTOBUF_
 inline void XtcpConfig::clear_enrich_locality_enable() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.enrich_locality_enable_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00004000U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00010000U);
 }
 inline bool XtcpConfig::enrich_locality_enable() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.enrich_locality_enable)
@@ -13460,7 +13577,7 @@ inline bool XtcpConfig::enrich_locality_enable() const {
 }
 inline void XtcpConfig::set_enrich_locality_enable(bool value) {
   _internal_set_enrich_locality_enable(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00004000U);
+  SetHasBit(_impl_._has_bits_[2], 0x00010000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.enrich_locality_enable)
 }
 inline bool XtcpConfig::_internal_enrich_locality_enable() const {
@@ -13474,7 +13591,7 @@ inline void XtcpConfig::_internal_set_enrich_locality_enable(bool value) {
 
 // .google.protobuf.Duration locality_refresh_interval = 246 [json_name = "localityRefreshInterval"];
 inline bool XtcpConfig::has_locality_refresh_interval() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00400000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x01000000U);
   PROTOBUF_ASSUME(!value || _impl_.locality_refresh_interval_ != nullptr);
   return value;
 }
@@ -13495,16 +13612,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_locality_refresh_interval(
   }
   _impl_.locality_refresh_interval_ = reinterpret_cast<::google::protobuf::Duration*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00400000U);
+    SetHasBit(_impl_._has_bits_[1], 0x01000000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x01000000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.locality_refresh_interval)
 }
 inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::release_locality_refresh_interval() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x01000000U);
   ::google::protobuf::Duration* released = _impl_.locality_refresh_interval_;
   _impl_.locality_refresh_interval_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -13524,7 +13641,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NULLABLE XtcpConfig::unsafe_arena_
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.locality_refresh_interval)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x01000000U);
   ::google::protobuf::Duration* temp = _impl_.locality_refresh_interval_;
   _impl_.locality_refresh_interval_ = nullptr;
   return temp;
@@ -13539,7 +13656,7 @@ inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::_internal_muta
 }
 inline ::google::protobuf::Duration* PROTOBUF_NONNULL XtcpConfig::mutable_locality_refresh_interval()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00400000U);
+  SetHasBit(_impl_._has_bits_[1], 0x01000000U);
   ::google::protobuf::Duration* _msg = _internal_mutable_locality_refresh_interval();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.locality_refresh_interval)
   return _msg;
@@ -13556,9 +13673,9 @@ inline void XtcpConfig::set_allocated_locality_refresh_interval(::google::protob
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00400000U);
+    SetHasBit(_impl_._has_bits_[1], 0x01000000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00400000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x01000000U);
   }
 
   _impl_.locality_refresh_interval_ = reinterpret_cast<::google::protobuf::Duration*>(value);
@@ -13569,7 +13686,7 @@ inline void XtcpConfig::set_allocated_locality_refresh_interval(::google::protob
 inline void XtcpConfig::clear_locality_events_enable() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   _impl_.locality_events_enable_ = false;
-  ClearHasBit(_impl_._has_bits_[2], 0x00008000U);
+  ClearHasBit(_impl_._has_bits_[2], 0x00020000U);
 }
 inline bool XtcpConfig::locality_events_enable() const {
   // @@protoc_insertion_point(field_get:xtcp_config.v1.XtcpConfig.locality_events_enable)
@@ -13577,7 +13694,7 @@ inline bool XtcpConfig::locality_events_enable() const {
 }
 inline void XtcpConfig::set_locality_events_enable(bool value) {
   _internal_set_locality_events_enable(value);
-  SetHasBit(_impl_._has_bits_[2], 0x00008000U);
+  SetHasBit(_impl_._has_bits_[2], 0x00020000U);
   // @@protoc_insertion_point(field_set:xtcp_config.v1.XtcpConfig.locality_events_enable)
 }
 inline bool XtcpConfig::_internal_locality_events_enable() const {
@@ -13591,14 +13708,14 @@ inline void XtcpConfig::_internal_set_locality_events_enable(bool value) {
 
 // .xtcp_config.v1.LinkMonitorConfig link_monitor = 250 [json_name = "linkMonitor"];
 inline bool XtcpConfig::has_link_monitor() const {
-  bool value = CheckHasBit(_impl_._has_bits_[1], 0x00800000U);
+  bool value = CheckHasBit(_impl_._has_bits_[1], 0x02000000U);
   PROTOBUF_ASSUME(!value || _impl_.link_monitor_ != nullptr);
   return value;
 }
 inline void XtcpConfig::clear_link_monitor() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
   if (_impl_.link_monitor_ != nullptr) _impl_.link_monitor_->Clear();
-  ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x02000000U);
 }
 inline const ::xtcp_config::v1::LinkMonitorConfig& XtcpConfig::_internal_link_monitor() const {
   ::google::protobuf::internal::TSanRead(&_impl_);
@@ -13617,16 +13734,16 @@ inline void XtcpConfig::unsafe_arena_set_allocated_link_monitor(
   }
   _impl_.link_monitor_ = reinterpret_cast<::xtcp_config::v1::LinkMonitorConfig*>(value);
   if (value != nullptr) {
-    SetHasBit(_impl_._has_bits_[1], 0x00800000U);
+    SetHasBit(_impl_._has_bits_[1], 0x02000000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x02000000U);
   }
   // @@protoc_insertion_point(field_unsafe_arena_set_allocated:xtcp_config.v1.XtcpConfig.link_monitor)
 }
 inline ::xtcp_config::v1::LinkMonitorConfig* PROTOBUF_NULLABLE XtcpConfig::release_link_monitor() {
   ::google::protobuf::internal::TSanWrite(&_impl_);
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x02000000U);
   ::xtcp_config::v1::LinkMonitorConfig* released = _impl_.link_monitor_;
   _impl_.link_monitor_ = nullptr;
   if (::google::protobuf::internal::DebugHardenForceCopyInRelease()) {
@@ -13646,7 +13763,7 @@ inline ::xtcp_config::v1::LinkMonitorConfig* PROTOBUF_NULLABLE XtcpConfig::unsaf
   ::google::protobuf::internal::TSanWrite(&_impl_);
   // @@protoc_insertion_point(field_release:xtcp_config.v1.XtcpConfig.link_monitor)
 
-  ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
+  ClearHasBit(_impl_._has_bits_[1], 0x02000000U);
   ::xtcp_config::v1::LinkMonitorConfig* temp = _impl_.link_monitor_;
   _impl_.link_monitor_ = nullptr;
   return temp;
@@ -13661,7 +13778,7 @@ inline ::xtcp_config::v1::LinkMonitorConfig* PROTOBUF_NONNULL XtcpConfig::_inter
 }
 inline ::xtcp_config::v1::LinkMonitorConfig* PROTOBUF_NONNULL XtcpConfig::mutable_link_monitor()
     ABSL_ATTRIBUTE_LIFETIME_BOUND {
-  SetHasBit(_impl_._has_bits_[1], 0x00800000U);
+  SetHasBit(_impl_._has_bits_[1], 0x02000000U);
   ::xtcp_config::v1::LinkMonitorConfig* _msg = _internal_mutable_link_monitor();
   // @@protoc_insertion_point(field_mutable:xtcp_config.v1.XtcpConfig.link_monitor)
   return _msg;
@@ -13678,9 +13795,9 @@ inline void XtcpConfig::set_allocated_link_monitor(::xtcp_config::v1::LinkMonito
     if (message_arena != submessage_arena) {
       value = ::google::protobuf::internal::GetOwnedMessage(message_arena, value, submessage_arena);
     }
-    SetHasBit(_impl_._has_bits_[1], 0x00800000U);
+    SetHasBit(_impl_._has_bits_[1], 0x02000000U);
   } else {
-    ClearHasBit(_impl_._has_bits_[1], 0x00800000U);
+    ClearHasBit(_impl_._has_bits_[1], 0x02000000U);
   }
 
   _impl_.link_monitor_ = reinterpret_cast<::xtcp_config::v1::LinkMonitorConfig*>(value);
diff --git a/gen/dart/xtcp_config/v1/xtcp_config.pb.dart b/gen/dart/xtcp_config/v1/xtcp_config.pb.dart
index 9a23a7faf..80c8564f9 100644
--- a/gen/dart/xtcp_config/v1/xtcp_config.pb.dart
+++ b/gen/dart/xtcp_config/v1/xtcp_config.pb.dart
@@ -1701,6 +1701,8 @@ class XtcpConfig extends $pb.GeneratedMessage {
     $core.String? s3AccessKey,
     $core.String? s3SecretKey,
     $core.bool? s3SkipBucketProbe,
+    $core.bool? s3AllowInsecure,
+    $core.String? s3CaFile,
     $core.int? s3ParquetFlushThresholdBytes,
     $1.Duration? s3FlushInterval,
     $core.int? s3FlushJitterPct,
@@ -1793,6 +1795,8 @@ class XtcpConfig extends $pb.GeneratedMessage {
     if (s3AccessKey != null) result.s3AccessKey = s3AccessKey;
     if (s3SecretKey != null) result.s3SecretKey = s3SecretKey;
     if (s3SkipBucketProbe != null) result.s3SkipBucketProbe = s3SkipBucketProbe;
+    if (s3AllowInsecure != null) result.s3AllowInsecure = s3AllowInsecure;
+    if (s3CaFile != null) result.s3CaFile = s3CaFile;
     if (s3ParquetFlushThresholdBytes != null)
       result.s3ParquetFlushThresholdBytes = s3ParquetFlushThresholdBytes;
     if (s3FlushInterval != null) result.s3FlushInterval = s3FlushInterval;
@@ -1928,6 +1932,8 @@ class XtcpConfig extends $pb.GeneratedMessage {
     ..aOS(104, _omitFieldNames ? '' : 's3AccessKey')
     ..aOS(105, _omitFieldNames ? '' : 's3SecretKey')
     ..aOB(106, _omitFieldNames ? '' : 's3SkipBucketProbe')
+    ..aOB(107, _omitFieldNames ? '' : 's3AllowInsecure')
+    ..aOS(108, _omitFieldNames ? '' : 's3CaFile')
     ..aI(110, _omitFieldNames ? '' : 's3ParquetFlushThresholdBytes',
         fieldType: $pb.PbFieldType.OU3)
     ..aOM<$1.Duration>(111, _omitFieldNames ? '' : 's3FlushInterval',
@@ -2516,6 +2522,31 @@ class XtcpConfig extends $pb.GeneratedMessage {
   @$pb.TagNumber(106)
   void clearS3SkipBucketProbe() => $_clearField(106);
 
+  /// Allow a plaintext http:// S3 endpoint. The credential and every
+  /// uploaded object would cross the network in the clear, so the daemon
+  /// refuses http:// unless this is set; a bare host:port and https:// both
+  /// use TLS. For local test fixtures only. Sets the xtcp2_s3_insecure gauge.
+  @$pb.TagNumber(107)
+  $core.bool get s3AllowInsecure => $_getBF(39);
+  @$pb.TagNumber(107)
+  set s3AllowInsecure($core.bool value) => $_setBool(39, value);
+  @$pb.TagNumber(107)
+  $core.bool hasS3AllowInsecure() => $_has(39);
+  @$pb.TagNumber(107)
+  void clearS3AllowInsecure() => $_clearField(107);
+
+  /// PEM bundle of CA certificates to trust for the S3 endpoint, in addition
+  /// to the system roots. For a private CA in front of an S3-compatible
+  /// store. Empty = system roots only.
+  @$pb.TagNumber(108)
+  $core.String get s3CaFile => $_getSZ(40);
+  @$pb.TagNumber(108)
+  set s3CaFile($core.String value) => $_setString(40, value);
+  @$pb.TagNumber(108)
+  $core.bool hasS3CaFile() => $_has(40);
+  @$pb.TagNumber(108)
+  void clearS3CaFile() => $_clearField(108);
+
   /// Soft cap on the in-memory Parquet builder's accumulated
   /// uncompressed row bytes before the worker finalizes the file and
   /// uploads. Default 0 → 63 MiB (S3ParquetFlushThresholdBytesCst).
@@ -2523,12 +2554,12 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// smaller per-file query latency) or up for fewer larger files
   /// (better compression ratio, more memory).
   @$pb.TagNumber(110)
-  $core.int get s3ParquetFlushThresholdBytes => $_getIZ(39);
+  $core.int get s3ParquetFlushThresholdBytes => $_getIZ(41);
   @$pb.TagNumber(110)
   set s3ParquetFlushThresholdBytes($core.int value) =>
-      $_setUnsignedInt32(39, value);
+      $_setUnsignedInt32(41, value);
   @$pb.TagNumber(110)
-  $core.bool hasS3ParquetFlushThresholdBytes() => $_has(39);
+  $core.bool hasS3ParquetFlushThresholdBytes() => $_has(41);
   @$pb.TagNumber(110)
   void clearS3ParquetFlushThresholdBytes() => $_clearField(110);
 
@@ -2536,25 +2567,25 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// after this long even if it hasn't reached the byte cap, bounding upload
   /// latency for low-volume hosts. 0 = derive as max(poll_frequency, 30m).
   @$pb.TagNumber(111)
-  $1.Duration get s3FlushInterval => $_getN(40);
+  $1.Duration get s3FlushInterval => $_getN(42);
   @$pb.TagNumber(111)
   set s3FlushInterval($1.Duration value) => $_setField(111, value);
   @$pb.TagNumber(111)
-  $core.bool hasS3FlushInterval() => $_has(40);
+  $core.bool hasS3FlushInterval() => $_has(42);
   @$pb.TagNumber(111)
   void clearS3FlushInterval() => $_clearField(111);
   @$pb.TagNumber(111)
-  $1.Duration ensureS3FlushInterval() => $_ensure(40);
+  $1.Duration ensureS3FlushInterval() => $_ensure(42);
 
   /// Maximum jitter as a percent of s3_flush_interval, applied to the first
   /// timed flush and each interval so the fleet doesn't ceiling-flush in
   /// lockstep. 0 disables. Default 20.
   @$pb.TagNumber(112)
-  $core.int get s3FlushJitterPct => $_getIZ(41);
+  $core.int get s3FlushJitterPct => $_getIZ(43);
   @$pb.TagNumber(112)
-  set s3FlushJitterPct($core.int value) => $_setUnsignedInt32(41, value);
+  set s3FlushJitterPct($core.int value) => $_setUnsignedInt32(43, value);
   @$pb.TagNumber(112)
-  $core.bool hasS3FlushJitterPct() => $_has(41);
+  $core.bool hasS3FlushJitterPct() => $_has(43);
   @$pb.TagNumber(112)
   void clearS3FlushJitterPct() => $_clearField(112);
 
@@ -2563,23 +2594,23 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// size-cap upload path even under uniform load. Downward-only, so an
   /// object never exceeds the in-memory byte bound. 0 disables. Default 20.
   @$pb.TagNumber(113)
-  $core.int get s3FlushThresholdJitterPct => $_getIZ(42);
+  $core.int get s3FlushThresholdJitterPct => $_getIZ(44);
   @$pb.TagNumber(113)
   set s3FlushThresholdJitterPct($core.int value) =>
-      $_setUnsignedInt32(42, value);
+      $_setUnsignedInt32(44, value);
   @$pb.TagNumber(113)
-  $core.bool hasS3FlushThresholdJitterPct() => $_has(42);
+  $core.bool hasS3FlushThresholdJitterPct() => $_has(44);
   @$pb.TagNumber(113)
   void clearS3FlushThresholdJitterPct() => $_clearField(113);
 
   /// Maximum S3 upload attempts (original + retries) before dropping the
   /// object. Retries use full-jitter exponential backoff. Default 10.
   @$pb.TagNumber(114)
-  $core.int get s3UploadMaxAttempts => $_getIZ(43);
+  $core.int get s3UploadMaxAttempts => $_getIZ(45);
   @$pb.TagNumber(114)
-  set s3UploadMaxAttempts($core.int value) => $_setUnsignedInt32(43, value);
+  set s3UploadMaxAttempts($core.int value) => $_setUnsignedInt32(45, value);
   @$pb.TagNumber(114)
-  $core.bool hasS3UploadMaxAttempts() => $_has(43);
+  $core.bool hasS3UploadMaxAttempts() => $_has(45);
   @$pb.TagNumber(114)
   void clearS3UploadMaxAttempts() => $_clearField(114);
 
@@ -2587,15 +2618,15 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// [0, window], window grows exponentially up to this cap). 0 = derive as
   /// clamp(poll_frequency/10, 1s, 1h).
   @$pb.TagNumber(115)
-  $1.Duration get s3UploadBackoffCap => $_getN(44);
+  $1.Duration get s3UploadBackoffCap => $_getN(46);
   @$pb.TagNumber(115)
   set s3UploadBackoffCap($1.Duration value) => $_setField(115, value);
   @$pb.TagNumber(115)
-  $core.bool hasS3UploadBackoffCap() => $_has(44);
+  $core.bool hasS3UploadBackoffCap() => $_has(46);
   @$pb.TagNumber(115)
   void clearS3UploadBackoffCap() => $_clearField(115);
   @$pb.TagNumber(115)
-  $1.Duration ensureS3UploadBackoffCap() => $_ensure(44);
+  $1.Duration ensureS3UploadBackoffCap() => $_ensure(46);
 
   /// Hostname override. When empty the daemon uses os.Hostname(); set this to
   /// stamp an explicit hostname on records — required in containers, where
@@ -2603,11 +2634,11 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// flag or XTCP_HOSTNAME env (NOT HOSTNAME, which Docker sets to the
   /// container id).
   @$pb.TagNumber(130)
-  $core.String get hostname => $_getSZ(45);
+  $core.String get hostname => $_getSZ(47);
   @$pb.TagNumber(130)
-  set hostname($core.String value) => $_setString(45, value);
+  set hostname($core.String value) => $_setString(47, value);
   @$pb.TagNumber(130)
-  $core.bool hasHostname() => $_has(45);
+  $core.bool hasHostname() => $_has(47);
   @$pb.TagNumber(130)
   void clearHostname() => $_clearField(130);
 
@@ -2615,31 +2646,31 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// region, site, …). Generic; stamped on every record's `location` field.
   /// Set via -location flag or LOCATION env.
   @$pb.TagNumber(131)
-  $core.String get location => $_getSZ(46);
+  $core.String get location => $_getSZ(48);
   @$pb.TagNumber(131)
-  set location($core.String value) => $_setString(46, value);
+  set location($core.String value) => $_setString(48, value);
   @$pb.TagNumber(131)
-  $core.bool hasLocation() => $_has(46);
+  $core.bool hasLocation() => $_has(48);
   @$pb.TagNumber(131)
   void clearLocation() => $_clearField(131);
 
   /// Label applied to the protobuf
   @$pb.TagNumber(132)
-  $core.String get label => $_getSZ(47);
+  $core.String get label => $_getSZ(49);
   @$pb.TagNumber(132)
-  set label($core.String value) => $_setString(47, value);
+  set label($core.String value) => $_setString(49, value);
   @$pb.TagNumber(132)
-  $core.bool hasLabel() => $_has(47);
+  $core.bool hasLabel() => $_has(49);
   @$pb.TagNumber(132)
   void clearLabel() => $_clearField(132);
 
   /// Tag applied to the protobuf
   @$pb.TagNumber(133)
-  $core.String get tag => $_getSZ(48);
+  $core.String get tag => $_getSZ(50);
   @$pb.TagNumber(133)
-  set tag($core.String value) => $_setString(48, value);
+  set tag($core.String value) => $_setString(50, value);
   @$pb.TagNumber(133)
-  $core.bool hasTag() => $_has(48);
+  $core.bool hasTag() => $_has(50);
   @$pb.TagNumber(133)
   void clearTag() => $_clearField(133);
 
@@ -2648,11 +2679,11 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// vars, not a user flag; informational only (debugging which binary produced a
   /// row). See XtcpFlatRecord.daemon_version.
   @$pb.TagNumber(134)
-  $core.String get daemonVersion => $_getSZ(49);
+  $core.String get daemonVersion => $_getSZ(51);
   @$pb.TagNumber(134)
-  set daemonVersion($core.String value) => $_setString(49, value);
+  set daemonVersion($core.String value) => $_setString(51, value);
   @$pb.TagNumber(134)
-  $core.bool hasDaemonVersion() => $_has(49);
+  $core.bool hasDaemonVersion() => $_has(51);
   @$pb.TagNumber(134)
   void clearDaemonVersion() => $_clearField(134);
 
@@ -2662,22 +2693,22 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// analogue of the host nftables TTL clamp. Set via -ipv4Ttl / IPV4_TTL.
   /// (cf. prometheus/exporter-toolkit#396.)
   @$pb.TagNumber(150)
-  $core.int get ipv4Ttl => $_getIZ(50);
+  $core.int get ipv4Ttl => $_getIZ(52);
   @$pb.TagNumber(150)
-  set ipv4Ttl($core.int value) => $_setUnsignedInt32(50, value);
+  set ipv4Ttl($core.int value) => $_setUnsignedInt32(52, value);
   @$pb.TagNumber(150)
-  $core.bool hasIpv4Ttl() => $_has(50);
+  $core.bool hasIpv4Ttl() => $_has(52);
   @$pb.TagNumber(150)
   void clearIpv4Ttl() => $_clearField(150);
 
   /// Outgoing IPv6 unicast hop limit for xtcp2's own TCP listeners. 0 = kernel
   /// default. Same intent as ipv4_ttl. Set via -ipv6HopLimit / IPV6_HOP_LIMIT.
   @$pb.TagNumber(151)
-  $core.int get ipv6HopLimit => $_getIZ(51);
+  $core.int get ipv6HopLimit => $_getIZ(53);
   @$pb.TagNumber(151)
-  set ipv6HopLimit($core.int value) => $_setUnsignedInt32(51, value);
+  set ipv6HopLimit($core.int value) => $_setUnsignedInt32(53, value);
   @$pb.TagNumber(151)
-  $core.bool hasIpv6HopLimit() => $_has(51);
+  $core.bool hasIpv6HopLimit() => $_has(53);
   @$pb.TagNumber(151)
   void clearIpv6HopLimit() => $_clearField(151);
 
@@ -2687,28 +2718,28 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// the read credential: it reaches only methods marked ACCESS_READ.
   /// Secrets are redacted from every ConfigService response.
   @$pb.TagNumber(152)
-  ListenerAuth get listenerAuth => $_getN(52);
+  ListenerAuth get listenerAuth => $_getN(54);
   @$pb.TagNumber(152)
   set listenerAuth(ListenerAuth value) => $_setField(152, value);
   @$pb.TagNumber(152)
-  $core.bool hasListenerAuth() => $_has(52);
+  $core.bool hasListenerAuth() => $_has(54);
   @$pb.TagNumber(152)
   void clearListenerAuth() => $_clearField(152);
   @$pb.TagNumber(152)
-  ListenerAuth ensureListenerAuth() => $_ensure(52);
+  ListenerAuth ensureListenerAuth() => $_ensure(54);
 
   /// Prometheus / pprof / health listener endpoint. When unset, the daemon
   /// keeps the legacy TCP behavior from -promListen / PROM_LISTEN.
   @$pb.TagNumber(153)
-  ListenerEndpoint get prometheusListener => $_getN(53);
+  ListenerEndpoint get prometheusListener => $_getN(55);
   @$pb.TagNumber(153)
   set prometheusListener(ListenerEndpoint value) => $_setField(153, value);
   @$pb.TagNumber(153)
-  $core.bool hasPrometheusListener() => $_has(53);
+  $core.bool hasPrometheusListener() => $_has(55);
   @$pb.TagNumber(153)
   void clearPrometheusListener() => $_clearField(153);
   @$pb.TagNumber(153)
-  ListenerEndpoint ensurePrometheusListener() => $_ensure(53);
+  ListenerEndpoint ensurePrometheusListener() => $_ensure(55);
 
   /// Admin credential. When set, ACCESS_ADMIN methods (ConfigService.Set, the
   /// runtime triggers, link-monitor rebaseline, /debug/pprof) require it, and
@@ -2716,38 +2747,38 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// listener_auth behaviour. Secrets are redacted from ConfigService
   /// responses.
   @$pb.TagNumber(154)
-  ListenerAuth get adminListenerAuth => $_getN(54);
+  ListenerAuth get adminListenerAuth => $_getN(56);
   @$pb.TagNumber(154)
   set adminListenerAuth(ListenerAuth value) => $_setField(154, value);
   @$pb.TagNumber(154)
-  $core.bool hasAdminListenerAuth() => $_has(54);
+  $core.bool hasAdminListenerAuth() => $_has(56);
   @$pb.TagNumber(154)
   void clearAdminListenerAuth() => $_clearField(154);
   @$pb.TagNumber(154)
-  ListenerAuth ensureAdminListenerAuth() => $_ensure(54);
+  ListenerAuth ensureAdminListenerAuth() => $_ensure(56);
 
   /// GRPC listening port
   @$pb.TagNumber(160)
-  $core.int get grpcPort => $_getIZ(55);
+  $core.int get grpcPort => $_getIZ(57);
   @$pb.TagNumber(160)
-  set grpcPort($core.int value) => $_setUnsignedInt32(55, value);
+  set grpcPort($core.int value) => $_setUnsignedInt32(57, value);
   @$pb.TagNumber(160)
-  $core.bool hasGrpcPort() => $_has(55);
+  $core.bool hasGrpcPort() => $_has(57);
   @$pb.TagNumber(160)
   void clearGrpcPort() => $_clearField(160);
 
   /// gRPC listener endpoint. When unset, the daemon keeps the legacy TCP
   /// behavior derived from grpc_port.
   @$pb.TagNumber(161)
-  ListenerEndpoint get grpcListener => $_getN(56);
+  ListenerEndpoint get grpcListener => $_getN(58);
   @$pb.TagNumber(161)
   set grpcListener(ListenerEndpoint value) => $_setField(161, value);
   @$pb.TagNumber(161)
-  $core.bool hasGrpcListener() => $_has(56);
+  $core.bool hasGrpcListener() => $_has(58);
   @$pb.TagNumber(161)
   void clearGrpcListener() => $_clearField(161);
   @$pb.TagNumber(161)
-  ListenerEndpoint ensureGrpcListener() => $_ensure(56);
+  ListenerEndpoint ensureGrpcListener() => $_ensure(58);
 
   /// Pyroscope continuous-profiling server URL (e.g.
   /// http://127.0.0.1:4040). When set, the daemon streams CPU,
@@ -2757,11 +2788,11 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// Grafana Cloud Pyroscope) and point xtcp2 at it for live profile
   /// data without restarts.
   @$pb.TagNumber(170)
-  $core.String get pyroscopeUrl => $_getSZ(57);
+  $core.String get pyroscopeUrl => $_getSZ(59);
   @$pb.TagNumber(170)
-  set pyroscopeUrl($core.String value) => $_setString(57, value);
+  set pyroscopeUrl($core.String value) => $_setString(59, value);
   @$pb.TagNumber(170)
-  $core.bool hasPyroscopeUrl() => $_has(57);
+  $core.bool hasPyroscopeUrl() => $_has(59);
   @$pb.TagNumber(170)
   void clearPyroscopeUrl() => $_clearField(170);
 
@@ -2770,34 +2801,34 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// Set per fleet/role for multi-host environments
   /// (e.g. "xtcp2.prod.iad", "xtcp2.staging.fra").
   @$pb.TagNumber(171)
-  $core.String get pyroscopeAppName => $_getSZ(58);
+  $core.String get pyroscopeAppName => $_getSZ(60);
   @$pb.TagNumber(171)
-  set pyroscopeAppName($core.String value) => $_setString(58, value);
+  set pyroscopeAppName($core.String value) => $_setString(60, value);
   @$pb.TagNumber(171)
-  $core.bool hasPyroscopeAppName() => $_has(58);
+  $core.bool hasPyroscopeAppName() => $_has(60);
   @$pb.TagNumber(171)
   void clearPyroscopeAppName() => $_clearField(171);
 
   /// CPU profile sampling rate in Hz. Default 100. The Pyroscope
   /// agent uses this to call runtime.SetCPUProfileRate at startup.
   @$pb.TagNumber(172)
-  $core.int get pyroscopeSampleHz => $_getIZ(59);
+  $core.int get pyroscopeSampleHz => $_getIZ(61);
   @$pb.TagNumber(172)
-  set pyroscopeSampleHz($core.int value) => $_setUnsignedInt32(59, value);
+  set pyroscopeSampleHz($core.int value) => $_setUnsignedInt32(61, value);
   @$pb.TagNumber(172)
-  $core.bool hasPyroscopeSampleHz() => $_has(59);
+  $core.bool hasPyroscopeSampleHz() => $_has(61);
   @$pb.TagNumber(172)
   void clearPyroscopeSampleHz() => $_clearField(172);
 
   /// Profile upload interval (seconds between batched profile
   /// pushes). Default 15 s.
   @$pb.TagNumber(173)
-  $core.int get pyroscopeUploadIntervalSec => $_getIZ(60);
+  $core.int get pyroscopeUploadIntervalSec => $_getIZ(62);
   @$pb.TagNumber(173)
   set pyroscopeUploadIntervalSec($core.int value) =>
-      $_setUnsignedInt32(60, value);
+      $_setUnsignedInt32(62, value);
   @$pb.TagNumber(173)
-  $core.bool hasPyroscopeUploadIntervalSec() => $_has(60);
+  $core.bool hasPyroscopeUploadIntervalSec() => $_has(62);
   @$pb.TagNumber(173)
   void clearPyroscopeUploadIntervalSec() => $_clearField(173);
 
@@ -2808,11 +2839,11 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// CONTAINER_ID_RESOLVE env. Needs /sys/fs/cgroup readable (mount it and run
   /// --cgroupns=host in a container).
   @$pb.TagNumber(200)
-  $core.bool get resolveContainerId => $_getBF(61);
+  $core.bool get resolveContainerId => $_getBF(63);
   @$pb.TagNumber(200)
-  set resolveContainerId($core.bool value) => $_setBool(61, value);
+  set resolveContainerId($core.bool value) => $_setBool(63, value);
   @$pb.TagNumber(200)
-  $core.bool hasResolveContainerId() => $_has(61);
+  $core.bool hasResolveContainerId() => $_has(63);
   @$pb.TagNumber(200)
   void clearResolveContainerId() => $_clearField(200);
 
@@ -2820,21 +2851,21 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// by joining the socket's owning netns inode against the Docker Engine API
   /// index over docker_socket_path. Default false.
   @$pb.TagNumber(201)
-  $core.bool get enrichContainerEnable => $_getBF(62);
+  $core.bool get enrichContainerEnable => $_getBF(64);
   @$pb.TagNumber(201)
-  set enrichContainerEnable($core.bool value) => $_setBool(62, value);
+  set enrichContainerEnable($core.bool value) => $_setBool(64, value);
   @$pb.TagNumber(201)
-  $core.bool hasEnrichContainerEnable() => $_has(62);
+  $core.bool hasEnrichContainerEnable() => $_has(64);
   @$pb.TagNumber(201)
   void clearEnrichContainerEnable() => $_clearField(201);
 
   /// Docker Engine API unix socket. Default "/run/docker.sock".
   @$pb.TagNumber(202)
-  $core.String get dockerSocketPath => $_getSZ(63);
+  $core.String get dockerSocketPath => $_getSZ(65);
   @$pb.TagNumber(202)
-  set dockerSocketPath($core.String value) => $_setString(63, value);
+  set dockerSocketPath($core.String value) => $_setString(65, value);
   @$pb.TagNumber(202)
-  $core.bool hasDockerSocketPath() => $_has(63);
+  $core.bool hasDockerSocketPath() => $_has(65);
   @$pb.TagNumber(202)
   void clearDockerSocketPath() => $_clearField(202);
 
@@ -2842,32 +2873,32 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// Enrich per-uplink LLDP neighbor labels by reading the lldpd control socket
   /// (lldpd_socket_path) once at startup. Default false.
   @$pb.TagNumber(210)
-  $core.bool get enrichLldpEnable => $_getBF(64);
+  $core.bool get enrichLldpEnable => $_getBF(66);
   @$pb.TagNumber(210)
-  set enrichLldpEnable($core.bool value) => $_setBool(64, value);
+  set enrichLldpEnable($core.bool value) => $_setBool(66, value);
   @$pb.TagNumber(210)
-  $core.bool hasEnrichLldpEnable() => $_has(64);
+  $core.bool hasEnrichLldpEnable() => $_has(66);
   @$pb.TagNumber(210)
   void clearEnrichLldpEnable() => $_clearField(210);
 
   /// lldpd control socket. Default "/run/lldpd.socket".
   @$pb.TagNumber(211)
-  $core.String get lldpdSocketPath => $_getSZ(65);
+  $core.String get lldpdSocketPath => $_getSZ(67);
   @$pb.TagNumber(211)
-  set lldpdSocketPath($core.String value) => $_setString(65, value);
+  set lldpdSocketPath($core.String value) => $_setString(67, value);
   @$pb.TagNumber(211)
-  $core.bool hasLldpdSocketPath() => $_has(65);
+  $core.bool hasLldpdSocketPath() => $_has(67);
   @$pb.TagNumber(211)
   void clearLldpdSocketPath() => $_clearField(211);
 
   /// Optional lldpd version hint ("1.0.13"/"1.0.18") selecting the struct-layout
   /// descriptor for the wire parser. Empty = auto-detect. Default "".
   @$pb.TagNumber(212)
-  $core.String get lldpdVersionHint => $_getSZ(66);
+  $core.String get lldpdVersionHint => $_getSZ(68);
   @$pb.TagNumber(212)
-  set lldpdVersionHint($core.String value) => $_setString(66, value);
+  set lldpdVersionHint($core.String value) => $_setString(68, value);
   @$pb.TagNumber(212)
-  $core.bool hasLldpdVersionHint() => $_has(66);
+  $core.bool hasLldpdVersionHint() => $_has(68);
   @$pb.TagNumber(212)
   void clearLldpdVersionHint() => $_clearField(212);
 
@@ -2875,38 +2906,38 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// Enrich per-uplink NIC labels (driver/model/pci/speed/firmware) from sysfs +
   /// the ethtool ioctl once at startup. Default false.
   @$pb.TagNumber(220)
-  $core.bool get enrichNicEnable => $_getBF(67);
+  $core.bool get enrichNicEnable => $_getBF(69);
   @$pb.TagNumber(220)
-  set enrichNicEnable($core.bool value) => $_setBool(67, value);
+  set enrichNicEnable($core.bool value) => $_setBool(69, value);
   @$pb.TagNumber(220)
-  $core.bool hasEnrichNicEnable() => $_has(67);
+  $core.bool hasEnrichNicEnable() => $_has(69);
   @$pb.TagNumber(220)
   void clearEnrichNicEnable() => $_clearField(220);
 
   /// Number of host uplink slots to populate (dual-homed hosts = 2). Default 2.
   @$pb.TagNumber(221)
-  $core.int get uplinkCount => $_getIZ(68);
+  $core.int get uplinkCount => $_getIZ(70);
   @$pb.TagNumber(221)
-  set uplinkCount($core.int value) => $_setUnsignedInt32(68, value);
+  set uplinkCount($core.int value) => $_setUnsignedInt32(70, value);
   @$pb.TagNumber(221)
-  $core.bool hasUplinkCount() => $_has(68);
+  $core.bool hasUplinkCount() => $_has(70);
   @$pb.TagNumber(221)
   void clearUplinkCount() => $_clearField(221);
 
   /// Explicit uplink interface names, slot order. Empty = auto-detect from the
   /// default IPv4/IPv6 routes.
   @$pb.TagNumber(222)
-  $pb.PbList<$core.String> get uplinkInterfaces => $_getList(69);
+  $pb.PbList<$core.String> get uplinkInterfaces => $_getList(71);
 
   /// -- nsid (230-239)
   /// Populate nsid (record field 32) best-effort via RTM_GETNSID. Usually 0 for
   /// Docker/containerd namespaces. Default false.
   @$pb.TagNumber(230)
-  $core.bool get populateNsid => $_getBF(70);
+  $core.bool get populateNsid => $_getBF(72);
   @$pb.TagNumber(230)
-  set populateNsid($core.bool value) => $_setBool(70, value);
+  set populateNsid($core.bool value) => $_setBool(72, value);
   @$pb.TagNumber(230)
-  $core.bool hasPopulateNsid() => $_has(70);
+  $core.bool hasPopulateNsid() => $_has(72);
   @$pb.TagNumber(230)
   void clearPopulateNsid() => $_clearField(230);
 
@@ -2917,47 +2948,47 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// enabled but asn_db_path is missing/unreadable, xtcp2 logs, bumps a counter,
   /// and leaves both columns empty. Default false.
   @$pb.TagNumber(240)
-  $core.bool get enrichAsnEnable => $_getBF(71);
+  $core.bool get enrichAsnEnable => $_getBF(73);
   @$pb.TagNumber(240)
-  set enrichAsnEnable($core.bool value) => $_setBool(71, value);
+  set enrichAsnEnable($core.bool value) => $_setBool(73, value);
   @$pb.TagNumber(240)
-  $core.bool hasEnrichAsnEnable() => $_has(71);
+  $core.bool hasEnrichAsnEnable() => $_has(73);
   @$pb.TagNumber(240)
   void clearEnrichAsnEnable() => $_clearField(240);
 
   /// Path to the ipfeed-collector Parquet artifact (prefix -> {asn,
   /// network_owner}). Default "".
   @$pb.TagNumber(241)
-  $core.String get asnDbPath => $_getSZ(72);
+  $core.String get asnDbPath => $_getSZ(74);
   @$pb.TagNumber(241)
-  set asnDbPath($core.String value) => $_setString(72, value);
+  set asnDbPath($core.String value) => $_setString(74, value);
   @$pb.TagNumber(241)
-  $core.bool hasAsnDbPath() => $_has(72);
+  $core.bool hasAsnDbPath() => $_has(74);
   @$pb.TagNumber(241)
   void clearAsnDbPath() => $_clearField(241);
 
   /// How often to reload asn_db_path in the background so a refreshed artifact
   /// is picked up without a restart. 0 = load once at startup, never reload.
   @$pb.TagNumber(242)
-  $1.Duration get asnRefreshInterval => $_getN(73);
+  $1.Duration get asnRefreshInterval => $_getN(75);
   @$pb.TagNumber(242)
   set asnRefreshInterval($1.Duration value) => $_setField(242, value);
   @$pb.TagNumber(242)
-  $core.bool hasAsnRefreshInterval() => $_has(73);
+  $core.bool hasAsnRefreshInterval() => $_has(75);
   @$pb.TagNumber(242)
   void clearAsnRefreshInterval() => $_clearField(242);
   @$pb.TagNumber(242)
-  $1.Duration ensureAsnRefreshInterval() => $_ensure(73);
+  $1.Duration ensureAsnRefreshInterval() => $_ensure(75);
 
   /// Optional zstd-compressed lookup artifact baked into the image and used at
   /// startup when no fresher writable cache is available. Default is supplied
   /// by the daemon CLI as /share/xtcp2/ipmeta/bootstrap.lookup.parquet.zst.
   @$pb.TagNumber(243)
-  $core.String get ipmetaBootstrapPath => $_getSZ(74);
+  $core.String get ipmetaBootstrapPath => $_getSZ(76);
   @$pb.TagNumber(243)
-  set ipmetaBootstrapPath($core.String value) => $_setString(74, value);
+  set ipmetaBootstrapPath($core.String value) => $_setString(76, value);
   @$pb.TagNumber(243)
-  $core.bool hasIpmetaBootstrapPath() => $_has(74);
+  $core.bool hasIpmetaBootstrapPath() => $_has(76);
   @$pb.TagNumber(243)
   void clearIpmetaBootstrapPath() => $_clearField(243);
 
@@ -2966,11 +2997,11 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// The companion previous.lookup.parquet.zst in the same directory is kept
   /// as a recovery fallback.
   @$pb.TagNumber(244)
-  $core.String get ipmetaCachePath => $_getSZ(75);
+  $core.String get ipmetaCachePath => $_getSZ(77);
   @$pb.TagNumber(244)
-  set ipmetaCachePath($core.String value) => $_setString(75, value);
+  set ipmetaCachePath($core.String value) => $_setString(77, value);
   @$pb.TagNumber(244)
-  $core.bool hasIpmetaCachePath() => $_has(75);
+  $core.bool hasIpmetaCachePath() => $_has(77);
   @$pb.TagNumber(244)
   void clearIpmetaCachePath() => $_clearField(244);
 
@@ -2983,11 +3014,11 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// Non-fatal: a per-namespace discovery failure just leaves that namespace's
   /// sockets unclassified (and is retried with backoff). Default false.
   @$pb.TagNumber(245)
-  $core.bool get enrichLocalityEnable => $_getBF(76);
+  $core.bool get enrichLocalityEnable => $_getBF(78);
   @$pb.TagNumber(245)
-  set enrichLocalityEnable($core.bool value) => $_setBool(76, value);
+  set enrichLocalityEnable($core.bool value) => $_setBool(78, value);
   @$pb.TagNumber(245)
-  $core.bool hasEnrichLocalityEnable() => $_has(76);
+  $core.bool hasEnrichLocalityEnable() => $_has(78);
   @$pb.TagNumber(245)
   void clearEnrichLocalityEnable() => $_clearField(245);
 
@@ -2996,15 +3027,15 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// namespaces are always snapshotted on the next reconcile regardless. 0 =
   /// discover once per namespace, never refresh. Daemon default 60s.
   @$pb.TagNumber(246)
-  $1.Duration get localityRefreshInterval => $_getN(77);
+  $1.Duration get localityRefreshInterval => $_getN(79);
   @$pb.TagNumber(246)
   set localityRefreshInterval($1.Duration value) => $_setField(246, value);
   @$pb.TagNumber(246)
-  $core.bool hasLocalityRefreshInterval() => $_has(77);
+  $core.bool hasLocalityRefreshInterval() => $_has(79);
   @$pb.TagNumber(246)
   void clearLocalityRefreshInterval() => $_clearField(246);
   @$pb.TagNumber(246)
-  $1.Duration ensureLocalityRefreshInterval() => $_ensure(77);
+  $1.Duration ensureLocalityRefreshInterval() => $_ensure(79);
 
   /// Keep each namespace's locality snapshot current from rtnetlink
   /// notifications (link, address and route changes) instead of waiting for
@@ -3012,25 +3043,25 @@ class XtcpConfig extends $pb.GeneratedMessage {
   /// locality_refresh_interval then becomes the backstop, a resync taken
   /// after that long. Needs enrich_locality_enable. Default false.
   @$pb.TagNumber(247)
-  $core.bool get localityEventsEnable => $_getBF(78);
+  $core.bool get localityEventsEnable => $_getBF(80);
   @$pb.TagNumber(247)
-  set localityEventsEnable($core.bool value) => $_setBool(78, value);
+  set localityEventsEnable($core.bool value) => $_setBool(80, value);
   @$pb.TagNumber(247)
-  $core.bool hasLocalityEventsEnable() => $_has(78);
+  $core.bool hasLocalityEventsEnable() => $_has(80);
   @$pb.TagNumber(247)
   void clearLocalityEventsEnable() => $_clearField(247);
 
   /// Physical link monitor; see LinkMonitorConfig.
   @$pb.TagNumber(250)
-  LinkMonitorConfig get linkMonitor => $_getN(79);
+  LinkMonitorConfig get linkMonitor => $_getN(81);
   @$pb.TagNumber(250)
   set linkMonitor(LinkMonitorConfig value) => $_setField(250, value);
   @$pb.TagNumber(250)
-  $core.bool hasLinkMonitor() => $_has(79);
+  $core.bool hasLinkMonitor() => $_has(81);
   @$pb.TagNumber(250)
   void clearLinkMonitor() => $_clearField(250);
   @$pb.TagNumber(250)
-  LinkMonitorConfig ensureLinkMonitor() => $_ensure(79);
+  LinkMonitorConfig ensureLinkMonitor() => $_ensure(81);
 }
 
 class EnabledDeserializers extends $pb.GeneratedMessage {
diff --git a/gen/dart/xtcp_config/v1/xtcp_config.pbjson.dart b/gen/dart/xtcp_config/v1/xtcp_config.pbjson.dart
index f0ec918d2..170d57380 100644
--- a/gen/dart/xtcp_config/v1/xtcp_config.pbjson.dart
+++ b/gen/dart/xtcp_config/v1/xtcp_config.pbjson.dart
@@ -954,6 +954,15 @@ const XtcpConfig$json = {
       '8': {},
       '10': 's3SkipBucketProbe'
     },
+    {
+      '1': 's3_allow_insecure',
+      '3': 107,
+      '4': 1,
+      '5': 8,
+      '8': {},
+      '10': 's3AllowInsecure'
+    },
+    {'1': 's3_ca_file', '3': 108, '4': 1, '5': 9, '8': {}, '10': 's3CaFile'},
     {
       '1': 's3_parquet_flush_threshold_bytes',
       '3': 110,
@@ -1271,53 +1280,55 @@ final $typed_data.Uint8List xtcpConfigDescriptor = $convert.base64Decode(
     'AQBSCHMzQnVja2V0EiMKCXMzX3ByZWZpeBhnIAEoCUIGukgDyAEAUghzM1ByZWZpeBIqCg1zM1'
     '9hY2Nlc3Nfa2V5GGggASgJQga6SAPIAQBSC3MzQWNjZXNzS2V5EioKDXMzX3NlY3JldF9rZXkY'
     'aSABKAlCBrpIA8gBAFILczNTZWNyZXRLZXkSNwoUczNfc2tpcF9idWNrZXRfcHJvYmUYaiABKA'
-    'hCBrpIA8gBAFIRczNTa2lwQnVja2V0UHJvYmUSTgogczNfcGFycXVldF9mbHVzaF90aHJlc2hv'
-    'bGRfYnl0ZXMYbiABKA1CBrpIA8gBAFIcczNQYXJxdWV0Rmx1c2hUaHJlc2hvbGRCeXRlcxJSCh'
-    'FzM19mbHVzaF9pbnRlcnZhbBhvIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkILukgI'
-    'yAEAqgECMgBSD3MzRmx1c2hJbnRlcnZhbBI5ChNzM19mbHVzaF9qaXR0ZXJfcGN0GHAgASgNQg'
-    'q6SAfIAQAqAhhkUhBzM0ZsdXNoSml0dGVyUGN0EkwKHXMzX2ZsdXNoX3RocmVzaG9sZF9qaXR0'
-    'ZXJfcGN0GHEgASgNQgq6SAfIAQAqAhhkUhlzM0ZsdXNoVGhyZXNob2xkSml0dGVyUGN0EkEKFn'
-    'MzX3VwbG9hZF9tYXhfYXR0ZW1wdHMYciABKA1CDLpICcgBACoEGGQoAVITczNVcGxvYWRNYXhB'
-    'dHRlbXB0cxJZChVzM191cGxvYWRfYmFja29mZl9jYXAYcyABKAsyGS5nb29nbGUucHJvdG9idW'
-    'YuRHVyYXRpb25CC7pICMgBAKoBAjIAUhJzM1VwbG9hZEJhY2tvZmZDYXASKAoIaG9zdG5hbWUY'
-    'ggEgASgJQgu6SAjIAQByAxj9AVIIaG9zdG5hbWUSKAoIbG9jYXRpb24YgwEgASgJQgu6SAjIAQ'
-    'ByAxj9AVIIbG9jYXRpb24SIQoFbGFiZWwYhAEgASgJQgq6SAfIAQByAhgoUgVsYWJlbBIdCgN0'
-    'YWcYhQEgASgJQgq6SAfIAQByAhgoUgN0YWcSMwoOZGFlbW9uX3ZlcnNpb24YhgEgASgJQgu6SA'
-    'jIAQByAxj9AVINZGFlbW9uVmVyc2lvbhInCghpcHY0X3R0bBiWASABKA1CC7pICMgBACoDGP8B'
-    'UgdpcHY0VHRsEjIKDmlwdjZfaG9wX2xpbWl0GJcBIAEoDUILukgIyAEAKgMY/wFSDGlwdjZIb3'
-    'BMaW1pdBJKCg1saXN0ZW5lcl9hdXRoGJgBIAEoCzIcLnh0Y3BfY29uZmlnLnYxLkxpc3RlbmVy'
-    'QXV0aEIGukgDyAEAUgxsaXN0ZW5lckF1dGgSWgoTcHJvbWV0aGV1c19saXN0ZW5lchiZASABKA'
-    'syIC54dGNwX2NvbmZpZy52MS5MaXN0ZW5lckVuZHBvaW50Qga6SAPIAQBSEnByb21ldGhldXNM'
-    'aXN0ZW5lchJVChNhZG1pbl9saXN0ZW5lcl9hdXRoGJoBIAEoCzIcLnh0Y3BfY29uZmlnLnYxLk'
-    'xpc3RlbmVyQXV0aEIGukgDyAEAUhFhZG1pbkxpc3RlbmVyQXV0aBIsCglncnBjX3BvcnQYoAEg'
-    'ASgNQg66SAvIAQEqBhj//wMoAVIIZ3JwY1BvcnQSTgoNZ3JwY19saXN0ZW5lchihASABKAsyIC'
-    '54dGNwX2NvbmZpZy52MS5MaXN0ZW5lckVuZHBvaW50Qga6SAPIAQBSDGdycGNMaXN0ZW5lchIs'
-    'Cg1weXJvc2NvcGVfdXJsGKoBIAEoCUIGukgDyAEAUgxweXJvc2NvcGVVcmwSNQoScHlyb3Njb3'
-    'BlX2FwcF9uYW1lGKsBIAEoCUIGukgDyAEAUhBweXJvc2NvcGVBcHBOYW1lEjcKE3B5cm9zY29w'
-    'ZV9zYW1wbGVfaHoYrAEgASgNQga6SAPIAQBSEXB5cm9zY29wZVNhbXBsZUh6EkoKHXB5cm9zY2'
-    '9wZV91cGxvYWRfaW50ZXJ2YWxfc2VjGK0BIAEoDUIGukgDyAEAUhpweXJvc2NvcGVVcGxvYWRJ'
-    'bnRlcnZhbFNlYxI5ChRyZXNvbHZlX2NvbnRhaW5lcl9pZBjIASABKAhCBrpIA8gBAFIScmVzb2'
-    'x2ZUNvbnRhaW5lcklkEjcKF2VucmljaF9jb250YWluZXJfZW5hYmxlGMkBIAEoCFIVZW5yaWNo'
-    'Q29udGFpbmVyRW5hYmxlEjcKEmRvY2tlcl9zb2NrZXRfcGF0aBjKASABKAlCCLpIBXIDGP8BUh'
-    'Bkb2NrZXJTb2NrZXRQYXRoEi0KEmVucmljaF9sbGRwX2VuYWJsZRjSASABKAhSEGVucmljaExs'
-    'ZHBFbmFibGUSNQoRbGxkcGRfc29ja2V0X3BhdGgY0wEgASgJQgi6SAVyAxj/AVIPbGxkcGRTb2'
-    'NrZXRQYXRoEjYKEmxsZHBkX3ZlcnNpb25faGludBjUASABKAlCB7pIBHICGBBSEGxsZHBkVmVy'
-    'c2lvbkhpbnQSKwoRZW5yaWNoX25pY19lbmFibGUY3AEgASgIUg9lbnJpY2hOaWNFbmFibGUSKw'
-    'oMdXBsaW5rX2NvdW50GN0BIAEoDUIHukgEKgIYAlILdXBsaW5rQ291bnQSNgoRdXBsaW5rX2lu'
-    'dGVyZmFjZXMY3gEgAygJQgi6SAWSAQIQAlIQdXBsaW5rSW50ZXJmYWNlcxIkCg1wb3B1bGF0ZV'
-    '9uc2lkGOYBIAEoCFIMcG9wdWxhdGVOc2lkEisKEWVucmljaF9hc25fZW5hYmxlGPABIAEoCFIP'
-    'ZW5yaWNoQXNuRW5hYmxlEikKC2Fzbl9kYl9wYXRoGPEBIAEoCUIIukgFcgMY/wFSCWFzbkRiUG'
-    'F0aBJMChRhc25fcmVmcmVzaF9pbnRlcnZhbBjyASABKAsyGS5nb29nbGUucHJvdG9idWYuRHVy'
-    'YXRpb25SEmFzblJlZnJlc2hJbnRlcnZhbBI9ChVpcG1ldGFfYm9vdHN0cmFwX3BhdGgY8wEgAS'
-    'gJQgi6SAVyAxj/AVITaXBtZXRhQm9vdHN0cmFwUGF0aBI1ChFpcG1ldGFfY2FjaGVfcGF0aBj0'
-    'ASABKAlCCLpIBXIDGP8BUg9pcG1ldGFDYWNoZVBhdGgSNQoWZW5yaWNoX2xvY2FsaXR5X2VuYW'
-    'JsZRj1ASABKAhSFGVucmljaExvY2FsaXR5RW5hYmxlElYKGWxvY2FsaXR5X3JlZnJlc2hfaW50'
-    'ZXJ2YWwY9gEgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uUhdsb2NhbGl0eVJlZnJlc2'
-    'hJbnRlcnZhbBI1ChZsb2NhbGl0eV9ldmVudHNfZW5hYmxlGPcBIAEoCFIUbG9jYWxpdHlFdmVu'
-    'dHNFbmFibGUSRQoMbGlua19tb25pdG9yGPoBIAEoCzIhLnh0Y3BfY29uZmlnLnYxLkxpbmtNb2'
-    '5pdG9yQ29uZmlnUgtsaW5rTW9uaXRvcjpzukhwGm4KD1h0Y3BDb25maWcucG9sbBIyUG9sbCB0'
-    'aW1lb3V0IG11c3QgYmUgbGVzcyB0aGFuIHBvbGwgcG9sbF9mcmVxdWVuY3kaJ3RoaXMucG9sbF'
-    '9mcmVxdWVuY3kgPiB0aGlzLnBvbGxfdGltZW91dA==');
+    'hCBrpIA8gBAFIRczNTa2lwQnVja2V0UHJvYmUSMgoRczNfYWxsb3dfaW5zZWN1cmUYayABKAhC'
+    'BrpIA8gBAFIPczNBbGxvd0luc2VjdXJlEikKCnMzX2NhX2ZpbGUYbCABKAlCC7pICMgBAHIDGI'
+    'AgUghzM0NhRmlsZRJOCiBzM19wYXJxdWV0X2ZsdXNoX3RocmVzaG9sZF9ieXRlcxhuIAEoDUIG'
+    'ukgDyAEAUhxzM1BhcnF1ZXRGbHVzaFRocmVzaG9sZEJ5dGVzElIKEXMzX2ZsdXNoX2ludGVydm'
+    'FsGG8gASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQgu6SAjIAQCqAQIyAFIPczNGbHVz'
+    'aEludGVydmFsEjkKE3MzX2ZsdXNoX2ppdHRlcl9wY3QYcCABKA1CCrpIB8gBACoCGGRSEHMzRm'
+    'x1c2hKaXR0ZXJQY3QSTAodczNfZmx1c2hfdGhyZXNob2xkX2ppdHRlcl9wY3QYcSABKA1CCrpI'
+    'B8gBACoCGGRSGXMzRmx1c2hUaHJlc2hvbGRKaXR0ZXJQY3QSQQoWczNfdXBsb2FkX21heF9hdH'
+    'RlbXB0cxhyIAEoDUIMukgJyAEAKgQYZCgBUhNzM1VwbG9hZE1heEF0dGVtcHRzElkKFXMzX3Vw'
+    'bG9hZF9iYWNrb2ZmX2NhcBhzIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkILukgIyA'
+    'EAqgECMgBSEnMzVXBsb2FkQmFja29mZkNhcBIoCghob3N0bmFtZRiCASABKAlCC7pICMgBAHID'
+    'GP0BUghob3N0bmFtZRIoCghsb2NhdGlvbhiDASABKAlCC7pICMgBAHIDGP0BUghsb2NhdGlvbh'
+    'IhCgVsYWJlbBiEASABKAlCCrpIB8gBAHICGChSBWxhYmVsEh0KA3RhZxiFASABKAlCCrpIB8gB'
+    'AHICGChSA3RhZxIzCg5kYWVtb25fdmVyc2lvbhiGASABKAlCC7pICMgBAHIDGP0BUg1kYWVtb2'
+    '5WZXJzaW9uEicKCGlwdjRfdHRsGJYBIAEoDUILukgIyAEAKgMY/wFSB2lwdjRUdGwSMgoOaXB2'
+    'Nl9ob3BfbGltaXQYlwEgASgNQgu6SAjIAQAqAxj/AVIMaXB2NkhvcExpbWl0EkoKDWxpc3Rlbm'
+    'VyX2F1dGgYmAEgASgLMhwueHRjcF9jb25maWcudjEuTGlzdGVuZXJBdXRoQga6SAPIAQBSDGxp'
+    'c3RlbmVyQXV0aBJaChNwcm9tZXRoZXVzX2xpc3RlbmVyGJkBIAEoCzIgLnh0Y3BfY29uZmlnLn'
+    'YxLkxpc3RlbmVyRW5kcG9pbnRCBrpIA8gBAFIScHJvbWV0aGV1c0xpc3RlbmVyElUKE2FkbWlu'
+    'X2xpc3RlbmVyX2F1dGgYmgEgASgLMhwueHRjcF9jb25maWcudjEuTGlzdGVuZXJBdXRoQga6SA'
+    'PIAQBSEWFkbWluTGlzdGVuZXJBdXRoEiwKCWdycGNfcG9ydBigASABKA1CDrpIC8gBASoGGP//'
+    'AygBUghncnBjUG9ydBJOCg1ncnBjX2xpc3RlbmVyGKEBIAEoCzIgLnh0Y3BfY29uZmlnLnYxLk'
+    'xpc3RlbmVyRW5kcG9pbnRCBrpIA8gBAFIMZ3JwY0xpc3RlbmVyEiwKDXB5cm9zY29wZV91cmwY'
+    'qgEgASgJQga6SAPIAQBSDHB5cm9zY29wZVVybBI1ChJweXJvc2NvcGVfYXBwX25hbWUYqwEgAS'
+    'gJQga6SAPIAQBSEHB5cm9zY29wZUFwcE5hbWUSNwoTcHlyb3Njb3BlX3NhbXBsZV9oehisASAB'
+    'KA1CBrpIA8gBAFIRcHlyb3Njb3BlU2FtcGxlSHoSSgodcHlyb3Njb3BlX3VwbG9hZF9pbnRlcn'
+    'ZhbF9zZWMYrQEgASgNQga6SAPIAQBSGnB5cm9zY29wZVVwbG9hZEludGVydmFsU2VjEjkKFHJl'
+    'c29sdmVfY29udGFpbmVyX2lkGMgBIAEoCEIGukgDyAEAUhJyZXNvbHZlQ29udGFpbmVySWQSNw'
+    'oXZW5yaWNoX2NvbnRhaW5lcl9lbmFibGUYyQEgASgIUhVlbnJpY2hDb250YWluZXJFbmFibGUS'
+    'NwoSZG9ja2VyX3NvY2tldF9wYXRoGMoBIAEoCUIIukgFcgMY/wFSEGRvY2tlclNvY2tldFBhdG'
+    'gSLQoSZW5yaWNoX2xsZHBfZW5hYmxlGNIBIAEoCFIQZW5yaWNoTGxkcEVuYWJsZRI1ChFsbGRw'
+    'ZF9zb2NrZXRfcGF0aBjTASABKAlCCLpIBXIDGP8BUg9sbGRwZFNvY2tldFBhdGgSNgoSbGxkcG'
+    'RfdmVyc2lvbl9oaW50GNQBIAEoCUIHukgEcgIYEFIQbGxkcGRWZXJzaW9uSGludBIrChFlbnJp'
+    'Y2hfbmljX2VuYWJsZRjcASABKAhSD2VucmljaE5pY0VuYWJsZRIrCgx1cGxpbmtfY291bnQY3Q'
+    'EgASgNQge6SAQqAhgCUgt1cGxpbmtDb3VudBI2ChF1cGxpbmtfaW50ZXJmYWNlcxjeASADKAlC'
+    'CLpIBZIBAhACUhB1cGxpbmtJbnRlcmZhY2VzEiQKDXBvcHVsYXRlX25zaWQY5gEgASgIUgxwb3'
+    'B1bGF0ZU5zaWQSKwoRZW5yaWNoX2Fzbl9lbmFibGUY8AEgASgIUg9lbnJpY2hBc25FbmFibGUS'
+    'KQoLYXNuX2RiX3BhdGgY8QEgASgJQgi6SAVyAxj/AVIJYXNuRGJQYXRoEkwKFGFzbl9yZWZyZX'
+    'NoX2ludGVydmFsGPIBIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvblISYXNuUmVmcmVz'
+    'aEludGVydmFsEj0KFWlwbWV0YV9ib290c3RyYXBfcGF0aBjzASABKAlCCLpIBXIDGP8BUhNpcG'
+    '1ldGFCb290c3RyYXBQYXRoEjUKEWlwbWV0YV9jYWNoZV9wYXRoGPQBIAEoCUIIukgFcgMY/wFS'
+    'D2lwbWV0YUNhY2hlUGF0aBI1ChZlbnJpY2hfbG9jYWxpdHlfZW5hYmxlGPUBIAEoCFIUZW5yaW'
+    'NoTG9jYWxpdHlFbmFibGUSVgoZbG9jYWxpdHlfcmVmcmVzaF9pbnRlcnZhbBj2ASABKAsyGS5n'
+    'b29nbGUucHJvdG9idWYuRHVyYXRpb25SF2xvY2FsaXR5UmVmcmVzaEludGVydmFsEjUKFmxvY2'
+    'FsaXR5X2V2ZW50c19lbmFibGUY9wEgASgIUhRsb2NhbGl0eUV2ZW50c0VuYWJsZRJFCgxsaW5r'
+    'X21vbml0b3IY+gEgASgLMiEueHRjcF9jb25maWcudjEuTGlua01vbml0b3JDb25maWdSC2xpbm'
+    'tNb25pdG9yOnO6SHAabgoPWHRjcENvbmZpZy5wb2xsEjJQb2xsIHRpbWVvdXQgbXVzdCBiZSBs'
+    'ZXNzIHRoYW4gcG9sbCBwb2xsX2ZyZXF1ZW5jeRondGhpcy5wb2xsX2ZyZXF1ZW5jeSA+IHRoaX'
+    'MucG9sbF90aW1lb3V0');
 
 @$core.Deprecated('Use enabledDeserializersDescriptor instead')
 const EnabledDeserializers$json = {
diff --git a/gen/go/xtcp_config/xtcp_config.pb.go b/gen/go/xtcp_config/xtcp_config.pb.go
index 00d26a141..7b94e166e 100644
--- a/gen/go/xtcp_config/xtcp_config.pb.go
+++ b/gen/go/xtcp_config/xtcp_config.pb.go
@@ -1492,6 +1492,15 @@ type XtcpConfig struct {
 	// daemon can start without list permission. Default false keeps the
 	// fail-fast probe for normal deployments.
 	S3SkipBucketProbe bool `protobuf:"varint,106,opt,name=s3_skip_bucket_probe,json=s3SkipBucketProbe,proto3" json:"s3_skip_bucket_probe,omitempty"`
+	// Allow a plaintext http:// S3 endpoint. The credential and every
+	// uploaded object would cross the network in the clear, so the daemon
+	// refuses http:// unless this is set; a bare host:port and https:// both
+	// use TLS. For local test fixtures only. Sets the xtcp2_s3_insecure gauge.
+	S3AllowInsecure bool `protobuf:"varint,107,opt,name=s3_allow_insecure,json=s3AllowInsecure,proto3" json:"s3_allow_insecure,omitempty"`
+	// PEM bundle of CA certificates to trust for the S3 endpoint, in addition
+	// to the system roots. For a private CA in front of an S3-compatible
+	// store. Empty = system roots only.
+	S3CaFile string `protobuf:"bytes,108,opt,name=s3_ca_file,json=s3CaFile,proto3" json:"s3_ca_file,omitempty"`
 	// Soft cap on the in-memory Parquet builder's accumulated
 	// uncompressed row bytes before the worker finalizes the file and
 	// uploads. Default 0 → 63 MiB (S3ParquetFlushThresholdBytesCst).
@@ -1972,6 +1981,20 @@ func (x *XtcpConfig) GetS3SkipBucketProbe() bool {
 	return false
 }
 
+func (x *XtcpConfig) GetS3AllowInsecure() bool {
+	if x != nil {
+		return x.S3AllowInsecure
+	}
+	return false
+}
+
+func (x *XtcpConfig) GetS3CaFile() string {
+	if x != nil {
+		return x.S3CaFile
+	}
+	return ""
+}
+
 func (x *XtcpConfig) GetS3ParquetFlushThresholdBytes() uint32 {
 	if x != nil {
 		return x.S3ParquetFlushThresholdBytes
@@ -2402,7 +2425,7 @@ const file_xtcp_config_v1_xtcp_config_proto_rawDesc = "" +
 	"\x0e_error_classesB\x15\n" +
 	"\x13_metrics_categoriesB\x1a\n" +
 	"\x18_metrics_interface_pathsB\x13\n" +
-	"\x11_metrics_all_path\"\x8b%\n" +
+	"\x11_metrics_all_path\"\xea%\n" +
 	"\n" +
 	"XtcpConfig\x12F\n" +
 	"\x17nl_timeout_milliseconds\x18\n" +
@@ -2461,7 +2484,10 @@ const file_xtcp_config_v1_xtcp_config_proto_rawDesc = "" +
 	"\ts3_prefix\x18g \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\bs3Prefix\x12*\n" +
 	"\rs3_access_key\x18h \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\vs3AccessKey\x12*\n" +
 	"\rs3_secret_key\x18i \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\vs3SecretKey\x127\n" +
-	"\x14s3_skip_bucket_probe\x18j \x01(\bB\x06\xbaH\x03\xc8\x01\x00R\x11s3SkipBucketProbe\x12N\n" +
+	"\x14s3_skip_bucket_probe\x18j \x01(\bB\x06\xbaH\x03\xc8\x01\x00R\x11s3SkipBucketProbe\x122\n" +
+	"\x11s3_allow_insecure\x18k \x01(\bB\x06\xbaH\x03\xc8\x01\x00R\x0fs3AllowInsecure\x12)\n" +
+	"\n" +
+	"s3_ca_file\x18l \x01(\tB\v\xbaH\b\xc8\x01\x00r\x03\x18\x80 R\bs3CaFile\x12N\n" +
 	" s3_parquet_flush_threshold_bytes\x18n \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1cs3ParquetFlushThresholdBytes\x12R\n" +
 	"\x11s3_flush_interval\x18o \x01(\v2\x19.google.protobuf.DurationB\v\xbaH\b\xc8\x01\x00\xaa\x01\x022\x00R\x0fs3FlushInterval\x129\n" +
 	"\x13s3_flush_jitter_pct\x18p \x01(\rB\n" +
diff --git a/gen/go/xtcp_config/xtcp_config_vtproto.pb.go b/gen/go/xtcp_config/xtcp_config_vtproto.pb.go
index 77de82fc4..880854d89 100644
--- a/gen/go/xtcp_config/xtcp_config_vtproto.pb.go
+++ b/gen/go/xtcp_config/xtcp_config_vtproto.pb.go
@@ -1510,6 +1510,27 @@ func (m *XtcpConfig) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0xf0
 	}
+	if len(m.S3CaFile) > 0 {
+		i -= len(m.S3CaFile)
+		copy(dAtA[i:], m.S3CaFile)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.S3CaFile)))
+		i--
+		dAtA[i] = 0x6
+		i--
+		dAtA[i] = 0xe2
+	}
+	if m.S3AllowInsecure {
+		i--
+		if m.S3AllowInsecure {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x6
+		i--
+		dAtA[i] = 0xd8
+	}
 	if m.S3SkipBucketProbe {
 		i--
 		if m.S3SkipBucketProbe {
@@ -2426,6 +2447,13 @@ func (m *XtcpConfig) SizeVT() (n int) {
 	if m.S3SkipBucketProbe {
 		n += 3
 	}
+	if m.S3AllowInsecure {
+		n += 3
+	}
+	l = len(m.S3CaFile)
+	if l > 0 {
+		n += 2 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
 	if m.S3ParquetFlushThresholdBytes != 0 {
 		n += 2 + protohelpers.SizeOfVarint(uint64(m.S3ParquetFlushThresholdBytes))
 	}
@@ -6196,6 +6224,58 @@ func (m *XtcpConfig) UnmarshalVT(dAtA []byte) error {
 				}
 			}
 			m.S3SkipBucketProbe = bool(v != 0)
+		case 107:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field S3AllowInsecure", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.S3AllowInsecure = bool(v != 0)
+		case 108:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field S3CaFile", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.S3CaFile = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		case 110:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field S3ParquetFlushThresholdBytes", wireType)
diff --git a/gen/openapi/xtcp_config/v1/xtcp_config.swagger.json b/gen/openapi/xtcp_config/v1/xtcp_config.swagger.json
index 71e500af7..0ced49bd5 100644
--- a/gen/openapi/xtcp_config/v1/xtcp_config.swagger.json
+++ b/gen/openapi/xtcp_config/v1/xtcp_config.swagger.json
@@ -781,6 +781,14 @@
           "type": "boolean",
           "description": "Skip the startup S3 BucketExists probe. The probe issues a\nHeadBucket, which requires the s3:ListBucket permission. Set true\nwhen the upload credential is deliberately scoped to s3:PutObject\nonly (write-only key, e.g. a baked deployment credential) so the\ndaemon can start without list permission. Default false keeps the\nfail-fast probe for normal deployments."
         },
+        "s3AllowInsecure": {
+          "type": "boolean",
+          "description": "Allow a plaintext http:// S3 endpoint. The credential and every\nuploaded object would cross the network in the clear, so the daemon\nrefuses http:// unless this is set; a bare host:port and https:// both\nuse TLS. For local test fixtures only. Sets the xtcp2_s3_insecure gauge."
+        },
+        "s3CaFile": {
+          "type": "string",
+          "description": "PEM bundle of CA certificates to trust for the S3 endpoint, in addition\nto the system roots. For a private CA in front of an S3-compatible\nstore. Empty = system roots only."
+        },
         "s3ParquetFlushThresholdBytes": {
           "type": "integer",
           "format": "int64",
diff --git a/gen/python/xtcp_config/v1/xtcp_config_pb2.py b/gen/python/xtcp_config/v1/xtcp_config_pb2.py
index 7145e66e4..25fdeb721 100644
--- a/gen/python/xtcp_config/v1/xtcp_config_pb2.py
+++ b/gen/python/xtcp_config/v1/xtcp_config_pb2.py
@@ -28,7 +28,7 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n xtcp_config/v1/xtcp_config.proto\x12\x0extcp_config.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1cxtcp_auth/v1/xtcp_auth.proto\x1a\x1b\x62uf/validate/validate.proto\"\x0c\n\nGetRequest\"A\n\x0bGetResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"@\n\nSetRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"A\n\x0bSetResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\xb4\x02\n\x17SetPollFrequencyRequest\x12S\n\x0epoll_frequency\x18\x14 \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00\xc8\x01\x01R\rpollFrequency\x12O\n\x0cpoll_timeout\x18\x1e \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00\xc8\x01\x01R\x0bpollTimeout:s\xbaHp\x1an\n\x0fXtcpConfig.poll\x12\x32Poll timeout must be less than poll poll_frequency\x1a\'this.poll_timeout < this.poll_frequency\"N\n\x18SetPollFrequencyResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\x14\n\x12TriggerPollRequest\"\x15\n\x13TriggerPollResponse\"\x89\x01\n\x17TriggerPollBurstRequest\x12#\n\x05\x63ount\x18\n \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x01\xc8\x01\x01R\x05\x63ount\x12I\n\x08interval\x18\x14 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\t\"\x03\x08\x90\x1c\x32\x02\x08\x01\xc8\x01\x01R\x08interval\"g\n\x18TriggerPollBurstResponse\x12\x14\n\x05\x63ount\x18\n \x01(\rR\x05\x63ount\x12\x35\n\x08interval\x18\x14 \x01(\x0b\x32\x19.google.protobuf.DurationR\x08interval\"\xe3\x02\n\x12SetS3UploadRequest\x12R\n\x11s3_flush_interval\x18\n \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x0fs3FlushInterval\x12N\n s3_parquet_flush_threshold_bytes\x18\x14 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1cs3ParquetFlushThresholdBytes:\xa8\x01\xbaH\xa4\x01\x1a\xa1\x01\n\x16SetS3Upload.atLeastOne\x12=set s3_flush_interval and/or s3_parquet_flush_threshold_bytes\x1aHhas(this.s3_flush_interval) || this.s3_parquet_flush_threshold_bytes > 0\"I\n\x13SetS3UploadResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\xf4\x02\n\x17SetEnvelopeFlushRequest\x12K\n\x1e\x65nvelope_flush_threshold_bytes\x18\n \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1b\x65nvelopeFlushThresholdBytes\x12I\n\x1d\x65nvelope_flush_threshold_rows\x18\x14 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1a\x65nvelopeFlushThresholdRows:\xc0\x01\xbaH\xbc\x01\x1a\xb9\x01\n\x1bSetEnvelopeFlush.atLeastOne\x12Gset envelope_flush_threshold_bytes and/or envelope_flush_threshold_rows\x1aQthis.envelope_flush_threshold_bytes > 0 || this.envelope_flush_threshold_rows > 0\"N\n\x18SetEnvelopeFlushResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\x8a\x03\n\x10ListenerEndpoint\x12\x43\n\x07network\x18\x01 \x01(\x0e\x32\x1f.xtcp_config.v1.ListenerNetworkB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x07network\x12\"\n\x07\x61\x64\x64ress\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x04R\x07\x61\x64\x64ress\x12\x32\n\x10unix_socket_mode\x18\x03 \x01(\rB\x08\xbaH\x05*\x03\x18\xff\x03R\x0eunixSocketMode\x12\x37\n\x18unlink_stale_unix_socket\x18\x04 \x01(\x08R\x15unlinkStaleUnixSocket\x12\x32\n\x0fmax_connections\x18\x05 \x01(\rB\t\xbaH\x06*\x04\x18\xa0\x8d\x06R\x0emaxConnections\x12>\n\x16\x61\x63\x63\x65pt_rate_per_second\x18\x06 \x01(\rB\t\xbaH\x06*\x04\x18\xa0\x8d\x06R\x13\x61\x63\x63\x65ptRatePerSecond\x12,\n\x0c\x61\x63\x63\x65pt_burst\x18\x07 \x01(\rB\t\xbaH\x06*\x04\x18\xa0\x8d\x06R\x0b\x61\x63\x63\x65ptBurst\"\x98\x05\n\x0cListenerAuth\x12>\n\x04mode\x18\x01 \x01(\x0e\x32 .xtcp_config.v1.ListenerAuthModeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04mode\x12%\n\traw_token\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x08rawToken\x12\x30\n\x0fhmac_shared_key\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\rhmacSharedKey\x12G\n\x19signed_token_skew_minutes\x18\x04 \x01(\rB\x07\xbaH\x04*\x02\x18\x05H\x00R\x16signedTokenSkewMinutes\x88\x01\x01\x12Q\n\x12\x66\x61ilure_jitter_min\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationB\x08\xbaH\x05\xaa\x01\x02\x32\x00R\x10\x66\x61ilureJitterMin\x12Q\n\x12\x66\x61ilure_jitter_max\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationB\x08\xbaH\x05\xaa\x01\x02\x32\x00R\x10\x66\x61ilureJitterMax:\xe1\x01\xbaH\xdd\x01\x1a\xda\x01\n\x1aListenerAuth.failureJitter\x12\x46\x66\x61ilure_jitter_max must be greater than or equal to failure_jitter_min\x1at!has(this.failure_jitter_min) || !has(this.failure_jitter_max) || this.failure_jitter_max >= this.failure_jitter_minB\x1c\n\x1a_signed_token_skew_minutes\"\x9a\x0e\n\x11LinkMonitorConfig\x12\x16\n\x06\x65nable\x18\x01 \x01(\x08R\x06\x65nable\x12-\n\rbaseline_file\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0c\x62\x61selineFile\x12\x41\n\x06settle\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05\x32\x00R\x06settle\x12\x41\n\x06resync\x18\x04 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xf5$*\x00R\x06resync\x12P\n\x0estats_interval\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05*\x00R\rstatsInterval\x12-\n\rstats_include\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0cstatsInclude\x12-\n\rstats_exclude\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0cstatsExclude\x12/\n\x0enetstat_fields\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\rnetstatFields\x12\x44\n\x14max_speed_exceptions\x18\t \x03(\tB\x12\xbaH\x0f\x92\x01\x0c\x10\x80\x02\"\x07r\x05\x10\x01\x18\x80\x01R\x12maxSpeedExceptions\x12:\n\x14metrics_core_include\x18\n \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x12metricsCoreInclude\x12:\n\x14metrics_core_exclude\x18\x0b \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x12metricsCoreExclude\x12\x1f\n\x0bmetrics_all\x18\x0c \x01(\x08R\nmetricsAll\x12\x41\n\x0f\x63ollection_mode\x18\r \x01(\tB\x18\xbaH\x15r\x13R\x00R\x04pollR\ton-demandR\x0e\x63ollectionMode\x12P\n\x0ewatch_interval\x18\x0e \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05*\x00R\rwatchInterval\x12N\n\rslow_interval\x18\x0f \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05*\x00R\x0cslowInterval\x12M\n\ron_demand_ttl\x18\x10 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05\x32\x00R\x0bonDemandTtl\x12M\n\x0eon_demand_wait\x18\x11 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0c\xbaH\t\xaa\x01\x06\x1a\x02\x08\n*\x00R\x0conDemandWait\x12L\n\x0c\x65rror_window\x18\x12 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00R\x0b\x65rrorWindow\x12J\n\x0b\x66lap_window\x18\x13 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00R\nflapWindow\x12\\\n\rerror_classes\x18\x14 \x01(\tB2\xbaH/r-\x18@2)^((link|rdma|drop)(,(link|rdma|drop))*)?$H\x00R\x0c\x65rrorClasses\x88\x01\x01\x12-\n\rerror_exclude\x18\x15 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0c\x65rrorExclude\x12<\n\x12metrics_categories\x18\x16 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02H\x01R\x11metricsCategories\x88\x01\x01\x12;\n\x17metrics_interface_paths\x18\x17 \x01(\x08H\x02R\x15metricsInterfacePaths\x88\x01\x01\x12\x37\n\x10metrics_all_path\x18\x18 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02H\x03R\x0emetricsAllPath\x88\x01\x01\x12\x19\n\x08ip_paths\x18\x19 \x01(\x08R\x07ipPaths\x12-\n\x0cip_max_bytes\x18\x1a \x01(\rB\x0b\xbaH\x08*\x06\x18\x80\x80\x80\x80\x04R\nipMaxBytes\x12$\n\tip_listen\x18\x1b \x01(\tB\x07\xbaH\x04r\x02\x18@R\x08ipListen\x12P\n\x0elearn_deadline\x18\x1c \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05\x32\x00R\rlearnDeadlineB\x10\n\x0e_error_classesB\x15\n\x13_metrics_categoriesB\x1a\n\x18_metrics_interface_pathsB\x13\n\x11_metrics_all_path\"\x8b%\n\nXtcpConfig\x12\x46\n\x17nl_timeout_milliseconds\x18\n \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xa0\x8d\x06(\x00\xc8\x01\x01R\x15nlTimeoutMilliseconds\x12S\n\x0epoll_frequency\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$*\x00\xc8\x01\x01R\rpollFrequency\x12O\n\x0cpoll_timeout\x18\x0c \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$*\x00\xc8\x01\x01R\x0bpollTimeout\x12\x32\n\x0fpoll_jitter_pct\x18\r \x01(\rB\n\xbaH\x07*\x02\x18\x64\xc8\x01\x00R\rpollJitterPct\x12+\n\tmax_loops\x18\x0e \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xa0\x8d\x06(\x00\xc8\x01\x00R\x08maxLoops\x12,\n\nnetlinkers\x18\x0f \x01(\rB\x0c\xbaH\t*\x04\x18\x64(\x01\xc8\x01\x01R\nnetlinkers\x12H\n\x19netlinkers_done_chan_size\x18\x10 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x01\xc8\x01\x01R\x16netlinkersDoneChanSize\x12*\n\tnlmsg_seq\x18\x11 \x01(\rB\r\xbaH\n*\x05\x18\x90N(\x00\xc8\x01\x01R\x08nlmsgSeq\x12/\n\x0bpacket_size\x18\x12 \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xc0\x84=(\x00\xc8\x01\x00R\npacketSize\x12\x36\n\x10packet_size_mply\x18\x13 \x01(\rB\x0c\xbaH\t*\x04\x18\x64(\x00\xc8\x01\x00R\x0epacketSizeMply\x12(\n\x07modulus\x18\x14 \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xc0\x84=(\x01\xc8\x01\x01R\x07modulus\x12\x61\n\x15\x65nabled_deserializers\x18\x15 \x01(\x0b\x32$.xtcp_config.v1.EnabledDeserializersB\x06\xbaH\x03\xc8\x01\x00R\x14\x65nabledDeserializers\x12!\n\x08io_uring\x18\x16 \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x07ioUring\x12\x45\n\x18io_uring_recv_batch_size\x18\x17 \x01(\rB\r\xbaH\n*\x05\x18\x80 (\x01\xc8\x01\x00R\x14ioUringRecvBatchSize\x12\x43\n\x17io_uring_cqe_batch_size\x18\x18 \x01(\rB\r\xbaH\n*\x05\x18\x80 (\x01\xc8\x01\x00R\x13ioUringCqeBatchSize\x12W\n\x13reconcile_frequency\x18( \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x12reconcileFrequency\x12\x32\n\x15reconcile_before_poll\x18) \x01(\x08R\x13reconcileBeforePoll\x12.\n\x0bwrite_files\x18\x32 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x00\xc8\x01\x00R\nwriteFiles\x12/\n\x0c\x63\x61pture_path\x18\x33 \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18P\xc8\x01\x00R\x0b\x63\x61pturePath\x12\x37\n\x10\x64\x65st_write_files\x18\x34 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x00\xc8\x01\x00R\x0e\x64\x65stWriteFiles\x12.\n\x0b\x64\x65\x62ug_level\x18\x35 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x00\xc8\x01\x01R\ndebugLevel\x12\x31\n\x10\x64\x65\x62ug_prometheus\x18\x36 \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x0f\x64\x65\x62ugPrometheus\x12!\n\x04\x64\x65st\x18< \x01(\tB\r\xbaH\nr\x05\x10\x04\x18\x80\x04\xc8\x01\x01R\x04\x64\x65st\x12+\n\nmarshal_to\x18= \x01(\tB\x0c\xbaH\tr\x04\x10\x03\x18(\xc8\x01\x01R\tmarshalTo\x12\'\n\x0b\x63sv_columns\x18> \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\ncsvColumns\x12\x34\n\x0fxtcp_proto_file\x18? \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18P\xc8\x01\x00R\rxtcpProtoFile\x12K\n\x1e\x65nvelope_flush_threshold_bytes\x18@ \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1b\x65nvelopeFlushThresholdBytes\x12I\n\x1d\x65nvelope_flush_threshold_rows\x18\x41 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1a\x65nvelopeFlushThresholdRows\x12\"\n\x05topic\x18P \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18(\xc8\x01\x00R\x05topic\x12\x36\n\x10kafka_schema_url\x18Q \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18<\xc8\x01\x00R\x0ekafkaSchemaUrl\x12_\n\x15kafka_produce_timeout\x18R \x01(\x0b\x32\x19.google.protobuf.DurationB\x10\xbaH\r\xaa\x01\x07\"\x03\x08\xd8\x04\x32\x00\xc8\x01\x00R\x13kafkaProduceTimeout\x12\x33\n\x11kafka_compression\x18S \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x10kafkaCompression\x12\'\n\x0bs3_endpoint\x18\x64 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\ns3Endpoint\x12#\n\ts3_region\x18\x65 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x08s3Region\x12#\n\ts3_bucket\x18\x66 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x08s3Bucket\x12#\n\ts3_prefix\x18g \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x08s3Prefix\x12*\n\rs3_access_key\x18h \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x0bs3AccessKey\x12*\n\rs3_secret_key\x18i \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x0bs3SecretKey\x12\x37\n\x14s3_skip_bucket_probe\x18j \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x11s3SkipBucketProbe\x12N\n s3_parquet_flush_threshold_bytes\x18n \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1cs3ParquetFlushThresholdBytes\x12R\n\x11s3_flush_interval\x18o \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x0fs3FlushInterval\x12\x39\n\x13s3_flush_jitter_pct\x18p \x01(\rB\n\xbaH\x07*\x02\x18\x64\xc8\x01\x00R\x10s3FlushJitterPct\x12L\n\x1ds3_flush_threshold_jitter_pct\x18q \x01(\rB\n\xbaH\x07*\x02\x18\x64\xc8\x01\x00R\x19s3FlushThresholdJitterPct\x12\x41\n\x16s3_upload_max_attempts\x18r \x01(\rB\x0c\xbaH\t*\x04\x18\x64(\x01\xc8\x01\x00R\x13s3UploadMaxAttempts\x12Y\n\x15s3_upload_backoff_cap\x18s \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x12s3UploadBackoffCap\x12(\n\x08hostname\x18\x82\x01 \x01(\tB\x0b\xbaH\x08r\x03\x18\xfd\x01\xc8\x01\x00R\x08hostname\x12(\n\x08location\x18\x83\x01 \x01(\tB\x0b\xbaH\x08r\x03\x18\xfd\x01\xc8\x01\x00R\x08location\x12!\n\x05label\x18\x84\x01 \x01(\tB\n\xbaH\x07r\x02\x18(\xc8\x01\x00R\x05label\x12\x1d\n\x03tag\x18\x85\x01 \x01(\tB\n\xbaH\x07r\x02\x18(\xc8\x01\x00R\x03tag\x12\x33\n\x0e\x64\x61\x65mon_version\x18\x86\x01 \x01(\tB\x0b\xbaH\x08r\x03\x18\xfd\x01\xc8\x01\x00R\rdaemonVersion\x12\'\n\x08ipv4_ttl\x18\x96\x01 \x01(\rB\x0b\xbaH\x08*\x03\x18\xff\x01\xc8\x01\x00R\x07ipv4Ttl\x12\x32\n\x0eipv6_hop_limit\x18\x97\x01 \x01(\rB\x0b\xbaH\x08*\x03\x18\xff\x01\xc8\x01\x00R\x0cipv6HopLimit\x12J\n\rlistener_auth\x18\x98\x01 \x01(\x0b\x32\x1c.xtcp_config.v1.ListenerAuthB\x06\xbaH\x03\xc8\x01\x00R\x0clistenerAuth\x12Z\n\x13prometheus_listener\x18\x99\x01 \x01(\x0b\x32 .xtcp_config.v1.ListenerEndpointB\x06\xbaH\x03\xc8\x01\x00R\x12prometheusListener\x12U\n\x13\x61\x64min_listener_auth\x18\x9a\x01 \x01(\x0b\x32\x1c.xtcp_config.v1.ListenerAuthB\x06\xbaH\x03\xc8\x01\x00R\x11\x61\x64minListenerAuth\x12,\n\tgrpc_port\x18\xa0\x01 \x01(\rB\x0e\xbaH\x0b*\x06\x18\xff\xff\x03(\x01\xc8\x01\x01R\x08grpcPort\x12N\n\rgrpc_listener\x18\xa1\x01 \x01(\x0b\x32 .xtcp_config.v1.ListenerEndpointB\x06\xbaH\x03\xc8\x01\x00R\x0cgrpcListener\x12,\n\rpyroscope_url\x18\xaa\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x0cpyroscopeUrl\x12\x35\n\x12pyroscope_app_name\x18\xab\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x10pyroscopeAppName\x12\x37\n\x13pyroscope_sample_hz\x18\xac\x01 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x11pyroscopeSampleHz\x12J\n\x1dpyroscope_upload_interval_sec\x18\xad\x01 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1apyroscopeUploadIntervalSec\x12\x39\n\x14resolve_container_id\x18\xc8\x01 \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x12resolveContainerId\x12\x37\n\x17\x65nrich_container_enable\x18\xc9\x01 \x01(\x08R\x15\x65nrichContainerEnable\x12\x37\n\x12\x64ocker_socket_path\x18\xca\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x10\x64ockerSocketPath\x12-\n\x12\x65nrich_lldp_enable\x18\xd2\x01 \x01(\x08R\x10\x65nrichLldpEnable\x12\x35\n\x11lldpd_socket_path\x18\xd3\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x0flldpdSocketPath\x12\x36\n\x12lldpd_version_hint\x18\xd4\x01 \x01(\tB\x07\xbaH\x04r\x02\x18\x10R\x10lldpdVersionHint\x12+\n\x11\x65nrich_nic_enable\x18\xdc\x01 \x01(\x08R\x0f\x65nrichNicEnable\x12+\n\x0cuplink_count\x18\xdd\x01 \x01(\rB\x07\xbaH\x04*\x02\x18\x02R\x0buplinkCount\x12\x36\n\x11uplink_interfaces\x18\xde\x01 \x03(\tB\x08\xbaH\x05\x92\x01\x02\x10\x02R\x10uplinkInterfaces\x12$\n\rpopulate_nsid\x18\xe6\x01 \x01(\x08R\x0cpopulateNsid\x12+\n\x11\x65nrich_asn_enable\x18\xf0\x01 \x01(\x08R\x0f\x65nrichAsnEnable\x12)\n\x0b\x61sn_db_path\x18\xf1\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\tasnDbPath\x12L\n\x14\x61sn_refresh_interval\x18\xf2\x01 \x01(\x0b\x32\x19.google.protobuf.DurationR\x12\x61snRefreshInterval\x12=\n\x15ipmeta_bootstrap_path\x18\xf3\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x13ipmetaBootstrapPath\x12\x35\n\x11ipmeta_cache_path\x18\xf4\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x0fipmetaCachePath\x12\x35\n\x16\x65nrich_locality_enable\x18\xf5\x01 \x01(\x08R\x14\x65nrichLocalityEnable\x12V\n\x19locality_refresh_interval\x18\xf6\x01 \x01(\x0b\x32\x19.google.protobuf.DurationR\x17localityRefreshInterval\x12\x35\n\x16locality_events_enable\x18\xf7\x01 \x01(\x08R\x14localityEventsEnable\x12\x45\n\x0clink_monitor\x18\xfa\x01 \x01(\x0b\x32!.xtcp_config.v1.LinkMonitorConfigR\x0blinkMonitor:s\xbaHp\x1an\n\x0fXtcpConfig.poll\x12\x32Poll timeout must be less than poll poll_frequency\x1a\'this.poll_frequency > this.poll_timeout\"\x9f\x01\n\x14\x45nabledDeserializers\x12K\n\x07\x65nabled\x18\x01 \x03(\x0b\x32\x31.xtcp_config.v1.EnabledDeserializers.EnabledEntryR\x07\x65nabled\x1a:\n\x0c\x45nabledEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\x08R\x05value:\x02\x38\x01*h\n\x0fListenerNetwork\x12 \n\x1cLISTENER_NETWORK_UNSPECIFIED\x10\x00\x12\x18\n\x14LISTENER_NETWORK_TCP\x10\x01\x12\x19\n\x15LISTENER_NETWORK_UNIX\x10\x02*\xa1\x01\n\x10ListenerAuthMode\x12\"\n\x1eLISTENER_AUTH_MODE_UNSPECIFIED\x10\x00\x12\x1f\n\x1bLISTENER_AUTH_MODE_DISABLED\x10\x01\x12 \n\x1cLISTENER_AUTH_MODE_RAW_TOKEN\x10\x02\x12&\n\"LISTENER_AUTH_MODE_HMAC_UTC_MINUTE\x10\x03\x32\xa5\x07\n\rConfigService\x12\x61\n\x03Get\x12\x1a.xtcp_config.v1.GetRequest\x1a\x1b.xtcp_config.v1.GetResponse\"!\xc8\xf3\x18\x01\x82\xd3\xe4\x93\x02\x17\x1a\x12/ConfigService/Get:\x01*\x12\x61\n\x03Set\x12\x1a.xtcp_config.v1.SetRequest\x1a\x1b.xtcp_config.v1.SetResponse\"!\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02\x17\x1a\x12/ConfigService/Set:\x01*\x12\x95\x01\n\x10SetPollFrequency\x12\'.xtcp_config.v1.SetPollFrequencyRequest\x1a(.xtcp_config.v1.SetPollFrequencyResponse\".\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02$\x1a\x1f/ConfigService/SetPollFrequency:\x01*\x12\x81\x01\n\x0bTriggerPoll\x12\".xtcp_config.v1.TriggerPollRequest\x1a#.xtcp_config.v1.TriggerPollResponse\")\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02\x1f\x1a\x1a/ConfigService/TriggerPoll:\x01*\x12\x95\x01\n\x10TriggerPollBurst\x12\'.xtcp_config.v1.TriggerPollBurstRequest\x1a(.xtcp_config.v1.TriggerPollBurstResponse\".\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02$\x1a\x1f/ConfigService/TriggerPollBurst:\x01*\x12\x81\x01\n\x0bSetS3Upload\x12\".xtcp_config.v1.SetS3UploadRequest\x1a#.xtcp_config.v1.SetS3UploadResponse\")\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02\x1f\x1a\x1a/ConfigService/SetS3Upload:\x01*\x12\x95\x01\n\x10SetEnvelopeFlush\x12\'.xtcp_config.v1.SetEnvelopeFlushRequest\x1a(.xtcp_config.v1.SetEnvelopeFlushResponse\".\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02$\x1a\x1f/ConfigService/SetEnvelopeFlush:\x01*B\xaf\x01\n\x12\x63om.xtcp_config.v1B\x0fXtcpConfigProtoP\x01Z3github.com/randomizedcoder/xtcp2/gen/go/xtcp_config\xa2\x02\x03XXX\xaa\x02\rXtcpConfig.V1\xca\x02\rXtcpConfig\\V1\xe2\x02\x19XtcpConfig\\V1\\GPBMetadata\xea\x02\x0eXtcpConfig::V1b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n xtcp_config/v1/xtcp_config.proto\x12\x0extcp_config.v1\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/api/annotations.proto\x1a\x1cxtcp_auth/v1/xtcp_auth.proto\x1a\x1b\x62uf/validate/validate.proto\"\x0c\n\nGetRequest\"A\n\x0bGetResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"@\n\nSetRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"A\n\x0bSetResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\xb4\x02\n\x17SetPollFrequencyRequest\x12S\n\x0epoll_frequency\x18\x14 \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00\xc8\x01\x01R\rpollFrequency\x12O\n\x0cpoll_timeout\x18\x1e \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00\xc8\x01\x01R\x0bpollTimeout:s\xbaHp\x1an\n\x0fXtcpConfig.poll\x12\x32Poll timeout must be less than poll poll_frequency\x1a\'this.poll_timeout < this.poll_frequency\"N\n\x18SetPollFrequencyResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\x14\n\x12TriggerPollRequest\"\x15\n\x13TriggerPollResponse\"\x89\x01\n\x17TriggerPollBurstRequest\x12#\n\x05\x63ount\x18\n \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x01\xc8\x01\x01R\x05\x63ount\x12I\n\x08interval\x18\x14 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\t\"\x03\x08\x90\x1c\x32\x02\x08\x01\xc8\x01\x01R\x08interval\"g\n\x18TriggerPollBurstResponse\x12\x14\n\x05\x63ount\x18\n \x01(\rR\x05\x63ount\x12\x35\n\x08interval\x18\x14 \x01(\x0b\x32\x19.google.protobuf.DurationR\x08interval\"\xe3\x02\n\x12SetS3UploadRequest\x12R\n\x11s3_flush_interval\x18\n \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x0fs3FlushInterval\x12N\n s3_parquet_flush_threshold_bytes\x18\x14 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1cs3ParquetFlushThresholdBytes:\xa8\x01\xbaH\xa4\x01\x1a\xa1\x01\n\x16SetS3Upload.atLeastOne\x12=set s3_flush_interval and/or s3_parquet_flush_threshold_bytes\x1aHhas(this.s3_flush_interval) || this.s3_parquet_flush_threshold_bytes > 0\"I\n\x13SetS3UploadResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\xf4\x02\n\x17SetEnvelopeFlushRequest\x12K\n\x1e\x65nvelope_flush_threshold_bytes\x18\n \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1b\x65nvelopeFlushThresholdBytes\x12I\n\x1d\x65nvelope_flush_threshold_rows\x18\x14 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1a\x65nvelopeFlushThresholdRows:\xc0\x01\xbaH\xbc\x01\x1a\xb9\x01\n\x1bSetEnvelopeFlush.atLeastOne\x12Gset envelope_flush_threshold_bytes and/or envelope_flush_threshold_rows\x1aQthis.envelope_flush_threshold_bytes > 0 || this.envelope_flush_threshold_rows > 0\"N\n\x18SetEnvelopeFlushResponse\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\x1a.xtcp_config.v1.XtcpConfigR\x06\x63onfig\"\x8a\x03\n\x10ListenerEndpoint\x12\x43\n\x07network\x18\x01 \x01(\x0e\x32\x1f.xtcp_config.v1.ListenerNetworkB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x07network\x12\"\n\x07\x61\x64\x64ress\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x04R\x07\x61\x64\x64ress\x12\x32\n\x10unix_socket_mode\x18\x03 \x01(\rB\x08\xbaH\x05*\x03\x18\xff\x03R\x0eunixSocketMode\x12\x37\n\x18unlink_stale_unix_socket\x18\x04 \x01(\x08R\x15unlinkStaleUnixSocket\x12\x32\n\x0fmax_connections\x18\x05 \x01(\rB\t\xbaH\x06*\x04\x18\xa0\x8d\x06R\x0emaxConnections\x12>\n\x16\x61\x63\x63\x65pt_rate_per_second\x18\x06 \x01(\rB\t\xbaH\x06*\x04\x18\xa0\x8d\x06R\x13\x61\x63\x63\x65ptRatePerSecond\x12,\n\x0c\x61\x63\x63\x65pt_burst\x18\x07 \x01(\rB\t\xbaH\x06*\x04\x18\xa0\x8d\x06R\x0b\x61\x63\x63\x65ptBurst\"\x98\x05\n\x0cListenerAuth\x12>\n\x04mode\x18\x01 \x01(\x0e\x32 .xtcp_config.v1.ListenerAuthModeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x04mode\x12%\n\traw_token\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x08rawToken\x12\x30\n\x0fhmac_shared_key\x18\x03 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\rhmacSharedKey\x12G\n\x19signed_token_skew_minutes\x18\x04 \x01(\rB\x07\xbaH\x04*\x02\x18\x05H\x00R\x16signedTokenSkewMinutes\x88\x01\x01\x12Q\n\x12\x66\x61ilure_jitter_min\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationB\x08\xbaH\x05\xaa\x01\x02\x32\x00R\x10\x66\x61ilureJitterMin\x12Q\n\x12\x66\x61ilure_jitter_max\x18\x06 \x01(\x0b\x32\x19.google.protobuf.DurationB\x08\xbaH\x05\xaa\x01\x02\x32\x00R\x10\x66\x61ilureJitterMax:\xe1\x01\xbaH\xdd\x01\x1a\xda\x01\n\x1aListenerAuth.failureJitter\x12\x46\x66\x61ilure_jitter_max must be greater than or equal to failure_jitter_min\x1at!has(this.failure_jitter_min) || !has(this.failure_jitter_max) || this.failure_jitter_max >= this.failure_jitter_minB\x1c\n\x1a_signed_token_skew_minutes\"\x9a\x0e\n\x11LinkMonitorConfig\x12\x16\n\x06\x65nable\x18\x01 \x01(\x08R\x06\x65nable\x12-\n\rbaseline_file\x18\x02 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0c\x62\x61selineFile\x12\x41\n\x06settle\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05\x32\x00R\x06settle\x12\x41\n\x06resync\x18\x04 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xf5$*\x00R\x06resync\x12P\n\x0estats_interval\x18\x05 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05*\x00R\rstatsInterval\x12-\n\rstats_include\x18\x06 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0cstatsInclude\x12-\n\rstats_exclude\x18\x07 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0cstatsExclude\x12/\n\x0enetstat_fields\x18\x08 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\rnetstatFields\x12\x44\n\x14max_speed_exceptions\x18\t \x03(\tB\x12\xbaH\x0f\x92\x01\x0c\x10\x80\x02\"\x07r\x05\x10\x01\x18\x80\x01R\x12maxSpeedExceptions\x12:\n\x14metrics_core_include\x18\n \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x12metricsCoreInclude\x12:\n\x14metrics_core_exclude\x18\x0b \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x12metricsCoreExclude\x12\x1f\n\x0bmetrics_all\x18\x0c \x01(\x08R\nmetricsAll\x12\x41\n\x0f\x63ollection_mode\x18\r \x01(\tB\x18\xbaH\x15r\x13R\x00R\x04pollR\ton-demandR\x0e\x63ollectionMode\x12P\n\x0ewatch_interval\x18\x0e \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05*\x00R\rwatchInterval\x12N\n\rslow_interval\x18\x0f \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05*\x00R\x0cslowInterval\x12M\n\ron_demand_ttl\x18\x10 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05\x32\x00R\x0bonDemandTtl\x12M\n\x0eon_demand_wait\x18\x11 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0c\xbaH\t\xaa\x01\x06\x1a\x02\x08\n*\x00R\x0conDemandWait\x12L\n\x0c\x65rror_window\x18\x12 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00R\x0b\x65rrorWindow\x12J\n\x0b\x66lap_window\x18\x13 \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xf5$2\x00R\nflapWindow\x12\\\n\rerror_classes\x18\x14 \x01(\tB2\xbaH/r-\x18@2)^((link|rdma|drop)(,(link|rdma|drop))*)?$H\x00R\x0c\x65rrorClasses\x88\x01\x01\x12-\n\rerror_exclude\x18\x15 \x01(\tB\x08\xbaH\x05r\x03\x18\x80 R\x0c\x65rrorExclude\x12<\n\x12metrics_categories\x18\x16 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02H\x01R\x11metricsCategories\x88\x01\x01\x12;\n\x17metrics_interface_paths\x18\x17 \x01(\x08H\x02R\x15metricsInterfacePaths\x88\x01\x01\x12\x37\n\x10metrics_all_path\x18\x18 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02H\x03R\x0emetricsAllPath\x88\x01\x01\x12\x19\n\x08ip_paths\x18\x19 \x01(\x08R\x07ipPaths\x12-\n\x0cip_max_bytes\x18\x1a \x01(\rB\x0b\xbaH\x08*\x06\x18\x80\x80\x80\x80\x04R\nipMaxBytes\x12$\n\tip_listen\x18\x1b \x01(\tB\x07\xbaH\x04r\x02\x18@R\x08ipListen\x12P\n\x0elearn_deadline\x18\x1c \x01(\x0b\x32\x19.google.protobuf.DurationB\x0e\xbaH\x0b\xaa\x01\x08\"\x04\x08\x80\xa3\x05\x32\x00R\rlearnDeadlineB\x10\n\x0e_error_classesB\x15\n\x13_metrics_categoriesB\x1a\n\x18_metrics_interface_pathsB\x13\n\x11_metrics_all_path\"\xea%\n\nXtcpConfig\x12\x46\n\x17nl_timeout_milliseconds\x18\n \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xa0\x8d\x06(\x00\xc8\x01\x01R\x15nlTimeoutMilliseconds\x12S\n\x0epoll_frequency\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$*\x00\xc8\x01\x01R\rpollFrequency\x12O\n\x0cpoll_timeout\x18\x0c \x01(\x0b\x32\x19.google.protobuf.DurationB\x11\xbaH\x0e\xaa\x01\x08\"\x04\x08\x80\xf5$*\x00\xc8\x01\x01R\x0bpollTimeout\x12\x32\n\x0fpoll_jitter_pct\x18\r \x01(\rB\n\xbaH\x07*\x02\x18\x64\xc8\x01\x00R\rpollJitterPct\x12+\n\tmax_loops\x18\x0e \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xa0\x8d\x06(\x00\xc8\x01\x00R\x08maxLoops\x12,\n\nnetlinkers\x18\x0f \x01(\rB\x0c\xbaH\t*\x04\x18\x64(\x01\xc8\x01\x01R\nnetlinkers\x12H\n\x19netlinkers_done_chan_size\x18\x10 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x01\xc8\x01\x01R\x16netlinkersDoneChanSize\x12*\n\tnlmsg_seq\x18\x11 \x01(\rB\r\xbaH\n*\x05\x18\x90N(\x00\xc8\x01\x01R\x08nlmsgSeq\x12/\n\x0bpacket_size\x18\x12 \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xc0\x84=(\x00\xc8\x01\x00R\npacketSize\x12\x36\n\x10packet_size_mply\x18\x13 \x01(\rB\x0c\xbaH\t*\x04\x18\x64(\x00\xc8\x01\x00R\x0epacketSizeMply\x12(\n\x07modulus\x18\x14 \x01(\x04\x42\x0e\xbaH\x0b\x32\x06\x18\xc0\x84=(\x01\xc8\x01\x01R\x07modulus\x12\x61\n\x15\x65nabled_deserializers\x18\x15 \x01(\x0b\x32$.xtcp_config.v1.EnabledDeserializersB\x06\xbaH\x03\xc8\x01\x00R\x14\x65nabledDeserializers\x12!\n\x08io_uring\x18\x16 \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x07ioUring\x12\x45\n\x18io_uring_recv_batch_size\x18\x17 \x01(\rB\r\xbaH\n*\x05\x18\x80 (\x01\xc8\x01\x00R\x14ioUringRecvBatchSize\x12\x43\n\x17io_uring_cqe_batch_size\x18\x18 \x01(\rB\r\xbaH\n*\x05\x18\x80 (\x01\xc8\x01\x00R\x13ioUringCqeBatchSize\x12W\n\x13reconcile_frequency\x18( \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x12reconcileFrequency\x12\x32\n\x15reconcile_before_poll\x18) \x01(\x08R\x13reconcileBeforePoll\x12.\n\x0bwrite_files\x18\x32 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x00\xc8\x01\x00R\nwriteFiles\x12/\n\x0c\x63\x61pture_path\x18\x33 \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18P\xc8\x01\x00R\x0b\x63\x61pturePath\x12\x37\n\x10\x64\x65st_write_files\x18\x34 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x00\xc8\x01\x00R\x0e\x64\x65stWriteFiles\x12.\n\x0b\x64\x65\x62ug_level\x18\x35 \x01(\rB\r\xbaH\n*\x05\x18\xe8\x07(\x00\xc8\x01\x01R\ndebugLevel\x12\x31\n\x10\x64\x65\x62ug_prometheus\x18\x36 \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x0f\x64\x65\x62ugPrometheus\x12!\n\x04\x64\x65st\x18< \x01(\tB\r\xbaH\nr\x05\x10\x04\x18\x80\x04\xc8\x01\x01R\x04\x64\x65st\x12+\n\nmarshal_to\x18= \x01(\tB\x0c\xbaH\tr\x04\x10\x03\x18(\xc8\x01\x01R\tmarshalTo\x12\'\n\x0b\x63sv_columns\x18> \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\ncsvColumns\x12\x34\n\x0fxtcp_proto_file\x18? \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18P\xc8\x01\x00R\rxtcpProtoFile\x12K\n\x1e\x65nvelope_flush_threshold_bytes\x18@ \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1b\x65nvelopeFlushThresholdBytes\x12I\n\x1d\x65nvelope_flush_threshold_rows\x18\x41 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1a\x65nvelopeFlushThresholdRows\x12\"\n\x05topic\x18P \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18(\xc8\x01\x00R\x05topic\x12\x36\n\x10kafka_schema_url\x18Q \x01(\tB\x0c\xbaH\tr\x04\x10\x01\x18<\xc8\x01\x00R\x0ekafkaSchemaUrl\x12_\n\x15kafka_produce_timeout\x18R \x01(\x0b\x32\x19.google.protobuf.DurationB\x10\xbaH\r\xaa\x01\x07\"\x03\x08\xd8\x04\x32\x00\xc8\x01\x00R\x13kafkaProduceTimeout\x12\x33\n\x11kafka_compression\x18S \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x10kafkaCompression\x12\'\n\x0bs3_endpoint\x18\x64 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\ns3Endpoint\x12#\n\ts3_region\x18\x65 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x08s3Region\x12#\n\ts3_bucket\x18\x66 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x08s3Bucket\x12#\n\ts3_prefix\x18g \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x08s3Prefix\x12*\n\rs3_access_key\x18h \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x0bs3AccessKey\x12*\n\rs3_secret_key\x18i \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x0bs3SecretKey\x12\x37\n\x14s3_skip_bucket_probe\x18j \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x11s3SkipBucketProbe\x12\x32\n\x11s3_allow_insecure\x18k \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x0fs3AllowInsecure\x12)\n\ns3_ca_file\x18l \x01(\tB\x0b\xbaH\x08r\x03\x18\x80 \xc8\x01\x00R\x08s3CaFile\x12N\n s3_parquet_flush_threshold_bytes\x18n \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1cs3ParquetFlushThresholdBytes\x12R\n\x11s3_flush_interval\x18o \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x0fs3FlushInterval\x12\x39\n\x13s3_flush_jitter_pct\x18p \x01(\rB\n\xbaH\x07*\x02\x18\x64\xc8\x01\x00R\x10s3FlushJitterPct\x12L\n\x1ds3_flush_threshold_jitter_pct\x18q \x01(\rB\n\xbaH\x07*\x02\x18\x64\xc8\x01\x00R\x19s3FlushThresholdJitterPct\x12\x41\n\x16s3_upload_max_attempts\x18r \x01(\rB\x0c\xbaH\t*\x04\x18\x64(\x01\xc8\x01\x00R\x13s3UploadMaxAttempts\x12Y\n\x15s3_upload_backoff_cap\x18s \x01(\x0b\x32\x19.google.protobuf.DurationB\x0b\xbaH\x08\xaa\x01\x02\x32\x00\xc8\x01\x00R\x12s3UploadBackoffCap\x12(\n\x08hostname\x18\x82\x01 \x01(\tB\x0b\xbaH\x08r\x03\x18\xfd\x01\xc8\x01\x00R\x08hostname\x12(\n\x08location\x18\x83\x01 \x01(\tB\x0b\xbaH\x08r\x03\x18\xfd\x01\xc8\x01\x00R\x08location\x12!\n\x05label\x18\x84\x01 \x01(\tB\n\xbaH\x07r\x02\x18(\xc8\x01\x00R\x05label\x12\x1d\n\x03tag\x18\x85\x01 \x01(\tB\n\xbaH\x07r\x02\x18(\xc8\x01\x00R\x03tag\x12\x33\n\x0e\x64\x61\x65mon_version\x18\x86\x01 \x01(\tB\x0b\xbaH\x08r\x03\x18\xfd\x01\xc8\x01\x00R\rdaemonVersion\x12\'\n\x08ipv4_ttl\x18\x96\x01 \x01(\rB\x0b\xbaH\x08*\x03\x18\xff\x01\xc8\x01\x00R\x07ipv4Ttl\x12\x32\n\x0eipv6_hop_limit\x18\x97\x01 \x01(\rB\x0b\xbaH\x08*\x03\x18\xff\x01\xc8\x01\x00R\x0cipv6HopLimit\x12J\n\rlistener_auth\x18\x98\x01 \x01(\x0b\x32\x1c.xtcp_config.v1.ListenerAuthB\x06\xbaH\x03\xc8\x01\x00R\x0clistenerAuth\x12Z\n\x13prometheus_listener\x18\x99\x01 \x01(\x0b\x32 .xtcp_config.v1.ListenerEndpointB\x06\xbaH\x03\xc8\x01\x00R\x12prometheusListener\x12U\n\x13\x61\x64min_listener_auth\x18\x9a\x01 \x01(\x0b\x32\x1c.xtcp_config.v1.ListenerAuthB\x06\xbaH\x03\xc8\x01\x00R\x11\x61\x64minListenerAuth\x12,\n\tgrpc_port\x18\xa0\x01 \x01(\rB\x0e\xbaH\x0b*\x06\x18\xff\xff\x03(\x01\xc8\x01\x01R\x08grpcPort\x12N\n\rgrpc_listener\x18\xa1\x01 \x01(\x0b\x32 .xtcp_config.v1.ListenerEndpointB\x06\xbaH\x03\xc8\x01\x00R\x0cgrpcListener\x12,\n\rpyroscope_url\x18\xaa\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x0cpyroscopeUrl\x12\x35\n\x12pyroscope_app_name\x18\xab\x01 \x01(\tB\x06\xbaH\x03\xc8\x01\x00R\x10pyroscopeAppName\x12\x37\n\x13pyroscope_sample_hz\x18\xac\x01 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x11pyroscopeSampleHz\x12J\n\x1dpyroscope_upload_interval_sec\x18\xad\x01 \x01(\rB\x06\xbaH\x03\xc8\x01\x00R\x1apyroscopeUploadIntervalSec\x12\x39\n\x14resolve_container_id\x18\xc8\x01 \x01(\x08\x42\x06\xbaH\x03\xc8\x01\x00R\x12resolveContainerId\x12\x37\n\x17\x65nrich_container_enable\x18\xc9\x01 \x01(\x08R\x15\x65nrichContainerEnable\x12\x37\n\x12\x64ocker_socket_path\x18\xca\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x10\x64ockerSocketPath\x12-\n\x12\x65nrich_lldp_enable\x18\xd2\x01 \x01(\x08R\x10\x65nrichLldpEnable\x12\x35\n\x11lldpd_socket_path\x18\xd3\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x0flldpdSocketPath\x12\x36\n\x12lldpd_version_hint\x18\xd4\x01 \x01(\tB\x07\xbaH\x04r\x02\x18\x10R\x10lldpdVersionHint\x12+\n\x11\x65nrich_nic_enable\x18\xdc\x01 \x01(\x08R\x0f\x65nrichNicEnable\x12+\n\x0cuplink_count\x18\xdd\x01 \x01(\rB\x07\xbaH\x04*\x02\x18\x02R\x0buplinkCount\x12\x36\n\x11uplink_interfaces\x18\xde\x01 \x03(\tB\x08\xbaH\x05\x92\x01\x02\x10\x02R\x10uplinkInterfaces\x12$\n\rpopulate_nsid\x18\xe6\x01 \x01(\x08R\x0cpopulateNsid\x12+\n\x11\x65nrich_asn_enable\x18\xf0\x01 \x01(\x08R\x0f\x65nrichAsnEnable\x12)\n\x0b\x61sn_db_path\x18\xf1\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\tasnDbPath\x12L\n\x14\x61sn_refresh_interval\x18\xf2\x01 \x01(\x0b\x32\x19.google.protobuf.DurationR\x12\x61snRefreshInterval\x12=\n\x15ipmeta_bootstrap_path\x18\xf3\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x13ipmetaBootstrapPath\x12\x35\n\x11ipmeta_cache_path\x18\xf4\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\xff\x01R\x0fipmetaCachePath\x12\x35\n\x16\x65nrich_locality_enable\x18\xf5\x01 \x01(\x08R\x14\x65nrichLocalityEnable\x12V\n\x19locality_refresh_interval\x18\xf6\x01 \x01(\x0b\x32\x19.google.protobuf.DurationR\x17localityRefreshInterval\x12\x35\n\x16locality_events_enable\x18\xf7\x01 \x01(\x08R\x14localityEventsEnable\x12\x45\n\x0clink_monitor\x18\xfa\x01 \x01(\x0b\x32!.xtcp_config.v1.LinkMonitorConfigR\x0blinkMonitor:s\xbaHp\x1an\n\x0fXtcpConfig.poll\x12\x32Poll timeout must be less than poll poll_frequency\x1a\'this.poll_frequency > this.poll_timeout\"\x9f\x01\n\x14\x45nabledDeserializers\x12K\n\x07\x65nabled\x18\x01 \x03(\x0b\x32\x31.xtcp_config.v1.EnabledDeserializers.EnabledEntryR\x07\x65nabled\x1a:\n\x0c\x45nabledEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n\x05value\x18\x02 \x01(\x08R\x05value:\x02\x38\x01*h\n\x0fListenerNetwork\x12 \n\x1cLISTENER_NETWORK_UNSPECIFIED\x10\x00\x12\x18\n\x14LISTENER_NETWORK_TCP\x10\x01\x12\x19\n\x15LISTENER_NETWORK_UNIX\x10\x02*\xa1\x01\n\x10ListenerAuthMode\x12\"\n\x1eLISTENER_AUTH_MODE_UNSPECIFIED\x10\x00\x12\x1f\n\x1bLISTENER_AUTH_MODE_DISABLED\x10\x01\x12 \n\x1cLISTENER_AUTH_MODE_RAW_TOKEN\x10\x02\x12&\n\"LISTENER_AUTH_MODE_HMAC_UTC_MINUTE\x10\x03\x32\xa5\x07\n\rConfigService\x12\x61\n\x03Get\x12\x1a.xtcp_config.v1.GetRequest\x1a\x1b.xtcp_config.v1.GetResponse\"!\xc8\xf3\x18\x01\x82\xd3\xe4\x93\x02\x17\x1a\x12/ConfigService/Get:\x01*\x12\x61\n\x03Set\x12\x1a.xtcp_config.v1.SetRequest\x1a\x1b.xtcp_config.v1.SetResponse\"!\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02\x17\x1a\x12/ConfigService/Set:\x01*\x12\x95\x01\n\x10SetPollFrequency\x12\'.xtcp_config.v1.SetPollFrequencyRequest\x1a(.xtcp_config.v1.SetPollFrequencyResponse\".\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02$\x1a\x1f/ConfigService/SetPollFrequency:\x01*\x12\x81\x01\n\x0bTriggerPoll\x12\".xtcp_config.v1.TriggerPollRequest\x1a#.xtcp_config.v1.TriggerPollResponse\")\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02\x1f\x1a\x1a/ConfigService/TriggerPoll:\x01*\x12\x95\x01\n\x10TriggerPollBurst\x12\'.xtcp_config.v1.TriggerPollBurstRequest\x1a(.xtcp_config.v1.TriggerPollBurstResponse\".\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02$\x1a\x1f/ConfigService/TriggerPollBurst:\x01*\x12\x81\x01\n\x0bSetS3Upload\x12\".xtcp_config.v1.SetS3UploadRequest\x1a#.xtcp_config.v1.SetS3UploadResponse\")\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02\x1f\x1a\x1a/ConfigService/SetS3Upload:\x01*\x12\x95\x01\n\x10SetEnvelopeFlush\x12\'.xtcp_config.v1.SetEnvelopeFlushRequest\x1a(.xtcp_config.v1.SetEnvelopeFlushResponse\".\xc8\xf3\x18\x02\x82\xd3\xe4\x93\x02$\x1a\x1f/ConfigService/SetEnvelopeFlush:\x01*B\xaf\x01\n\x12\x63om.xtcp_config.v1B\x0fXtcpConfigProtoP\x01Z3github.com/randomizedcoder/xtcp2/gen/go/xtcp_config\xa2\x02\x03XXX\xaa\x02\rXtcpConfig.V1\xca\x02\rXtcpConfig\\V1\xe2\x02\x19XtcpConfig\\V1\\GPBMetadata\xea\x02\x0eXtcpConfig::V1b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -208,6 +208,10 @@
   _globals['_XTCPCONFIG'].fields_by_name['s3_secret_key']._serialized_options = b'\272H\003\310\001\000'
   _globals['_XTCPCONFIG'].fields_by_name['s3_skip_bucket_probe']._loaded_options = None
   _globals['_XTCPCONFIG'].fields_by_name['s3_skip_bucket_probe']._serialized_options = b'\272H\003\310\001\000'
+  _globals['_XTCPCONFIG'].fields_by_name['s3_allow_insecure']._loaded_options = None
+  _globals['_XTCPCONFIG'].fields_by_name['s3_allow_insecure']._serialized_options = b'\272H\003\310\001\000'
+  _globals['_XTCPCONFIG'].fields_by_name['s3_ca_file']._loaded_options = None
+  _globals['_XTCPCONFIG'].fields_by_name['s3_ca_file']._serialized_options = b'\272H\010r\003\030\200 \310\001\000'
   _globals['_XTCPCONFIG'].fields_by_name['s3_parquet_flush_threshold_bytes']._loaded_options = None
   _globals['_XTCPCONFIG'].fields_by_name['s3_parquet_flush_threshold_bytes']._serialized_options = b'\272H\003\310\001\000'
   _globals['_XTCPCONFIG'].fields_by_name['s3_flush_interval']._loaded_options = None
@@ -288,10 +292,10 @@
   _globals['_CONFIGSERVICE'].methods_by_name['SetS3Upload']._serialized_options = b'\310\363\030\002\202\323\344\223\002\037\032\032/ConfigService/SetS3Upload:\001*'
   _globals['_CONFIGSERVICE'].methods_by_name['SetEnvelopeFlush']._loaded_options = None
   _globals['_CONFIGSERVICE'].methods_by_name['SetEnvelopeFlush']._serialized_options = b'\310\363\030\002\202\323\344\223\002$\032\037/ConfigService/SetEnvelopeFlush:\001*'
-  _globals['_LISTENERNETWORK']._serialized_start=9753
-  _globals['_LISTENERNETWORK']._serialized_end=9857
-  _globals['_LISTENERAUTHMODE']._serialized_start=9860
-  _globals['_LISTENERAUTHMODE']._serialized_end=10021
+  _globals['_LISTENERNETWORK']._serialized_start=9848
+  _globals['_LISTENERNETWORK']._serialized_end=9952
+  _globals['_LISTENERAUTHMODE']._serialized_start=9955
+  _globals['_LISTENERAUTHMODE']._serialized_end=10116
   _globals['_GETREQUEST']._serialized_start=173
   _globals['_GETREQUEST']._serialized_end=185
   _globals['_GETRESPONSE']._serialized_start=187
@@ -327,11 +331,11 @@
   _globals['_LINKMONITORCONFIG']._serialized_start=3021
   _globals['_LINKMONITORCONFIG']._serialized_end=4839
   _globals['_XTCPCONFIG']._serialized_start=4842
-  _globals['_XTCPCONFIG']._serialized_end=9589
-  _globals['_ENABLEDDESERIALIZERS']._serialized_start=9592
-  _globals['_ENABLEDDESERIALIZERS']._serialized_end=9751
-  _globals['_ENABLEDDESERIALIZERS_ENABLEDENTRY']._serialized_start=9693
-  _globals['_ENABLEDDESERIALIZERS_ENABLEDENTRY']._serialized_end=9751
-  _globals['_CONFIGSERVICE']._serialized_start=10024
-  _globals['_CONFIGSERVICE']._serialized_end=10957
+  _globals['_XTCPCONFIG']._serialized_end=9684
+  _globals['_ENABLEDDESERIALIZERS']._serialized_start=9687
+  _globals['_ENABLEDDESERIALIZERS']._serialized_end=9846
+  _globals['_ENABLEDDESERIALIZERS_ENABLEDENTRY']._serialized_start=9788
+  _globals['_ENABLEDDESERIALIZERS_ENABLEDENTRY']._serialized_end=9846
+  _globals['_CONFIGSERVICE']._serialized_start=10119
+  _globals['_CONFIGSERVICE']._serialized_end=11052
 # @@protoc_insertion_point(module_scope)
diff --git a/gen/python/xtcp_config/v1/xtcp_config_pb2.pyi b/gen/python/xtcp_config/v1/xtcp_config_pb2.pyi
index e0a7a1bb9..9d6614ad6 100644
--- a/gen/python/xtcp_config/v1/xtcp_config_pb2.pyi
+++ b/gen/python/xtcp_config/v1/xtcp_config_pb2.pyi
@@ -216,7 +216,7 @@ class LinkMonitorConfig(_message.Message):
     def __init__(self, enable: _Optional[bool] = ..., baseline_file: _Optional[str] = ..., settle: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., resync: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., stats_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., stats_include: _Optional[str] = ..., stats_exclude: _Optional[str] = ..., netstat_fields: _Optional[str] = ..., max_speed_exceptions: _Optional[_Iterable[str]] = ..., metrics_core_include: _Optional[str] = ..., metrics_core_exclude: _Optional[str] = ..., metrics_all: _Optional[bool] = ..., collection_mode: _Optional[str] = ..., watch_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., slow_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., on_demand_ttl: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., on_demand_wait: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., error_window: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., flap_window: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., error_classes: _Optional[str] = ..., error_exclude: _Optional[str] = ..., metrics_categories: _Optional[str] = ..., metrics_interface_paths: _Optional[bool] = ..., metrics_all_path: _Optional[str] = ..., ip_paths: _Optional[bool] = ..., ip_max_bytes: _Optional[int] = ..., ip_listen: _Optional[str] = ..., learn_deadline: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ...) -> None: ...
 
 class XtcpConfig(_message.Message):
-    __slots__ = ("nl_timeout_milliseconds", "poll_frequency", "poll_timeout", "poll_jitter_pct", "max_loops", "netlinkers", "netlinkers_done_chan_size", "nlmsg_seq", "packet_size", "packet_size_mply", "modulus", "enabled_deserializers", "io_uring", "io_uring_recv_batch_size", "io_uring_cqe_batch_size", "reconcile_frequency", "reconcile_before_poll", "write_files", "capture_path", "dest_write_files", "debug_level", "debug_prometheus", "dest", "marshal_to", "csv_columns", "xtcp_proto_file", "envelope_flush_threshold_bytes", "envelope_flush_threshold_rows", "topic", "kafka_schema_url", "kafka_produce_timeout", "kafka_compression", "s3_endpoint", "s3_region", "s3_bucket", "s3_prefix", "s3_access_key", "s3_secret_key", "s3_skip_bucket_probe", "s3_parquet_flush_threshold_bytes", "s3_flush_interval", "s3_flush_jitter_pct", "s3_flush_threshold_jitter_pct", "s3_upload_max_attempts", "s3_upload_backoff_cap", "hostname", "location", "label", "tag", "daemon_version", "ipv4_ttl", "ipv6_hop_limit", "listener_auth", "prometheus_listener", "admin_listener_auth", "grpc_port", "grpc_listener", "pyroscope_url", "pyroscope_app_name", "pyroscope_sample_hz", "pyroscope_upload_interval_sec", "resolve_container_id", "enrich_container_enable", "docker_socket_path", "enrich_lldp_enable", "lldpd_socket_path", "lldpd_version_hint", "enrich_nic_enable", "uplink_count", "uplink_interfaces", "populate_nsid", "enrich_asn_enable", "asn_db_path", "asn_refresh_interval", "ipmeta_bootstrap_path", "ipmeta_cache_path", "enrich_locality_enable", "locality_refresh_interval", "locality_events_enable", "link_monitor")
+    __slots__ = ("nl_timeout_milliseconds", "poll_frequency", "poll_timeout", "poll_jitter_pct", "max_loops", "netlinkers", "netlinkers_done_chan_size", "nlmsg_seq", "packet_size", "packet_size_mply", "modulus", "enabled_deserializers", "io_uring", "io_uring_recv_batch_size", "io_uring_cqe_batch_size", "reconcile_frequency", "reconcile_before_poll", "write_files", "capture_path", "dest_write_files", "debug_level", "debug_prometheus", "dest", "marshal_to", "csv_columns", "xtcp_proto_file", "envelope_flush_threshold_bytes", "envelope_flush_threshold_rows", "topic", "kafka_schema_url", "kafka_produce_timeout", "kafka_compression", "s3_endpoint", "s3_region", "s3_bucket", "s3_prefix", "s3_access_key", "s3_secret_key", "s3_skip_bucket_probe", "s3_allow_insecure", "s3_ca_file", "s3_parquet_flush_threshold_bytes", "s3_flush_interval", "s3_flush_jitter_pct", "s3_flush_threshold_jitter_pct", "s3_upload_max_attempts", "s3_upload_backoff_cap", "hostname", "location", "label", "tag", "daemon_version", "ipv4_ttl", "ipv6_hop_limit", "listener_auth", "prometheus_listener", "admin_listener_auth", "grpc_port", "grpc_listener", "pyroscope_url", "pyroscope_app_name", "pyroscope_sample_hz", "pyroscope_upload_interval_sec", "resolve_container_id", "enrich_container_enable", "docker_socket_path", "enrich_lldp_enable", "lldpd_socket_path", "lldpd_version_hint", "enrich_nic_enable", "uplink_count", "uplink_interfaces", "populate_nsid", "enrich_asn_enable", "asn_db_path", "asn_refresh_interval", "ipmeta_bootstrap_path", "ipmeta_cache_path", "enrich_locality_enable", "locality_refresh_interval", "locality_events_enable", "link_monitor")
     NL_TIMEOUT_MILLISECONDS_FIELD_NUMBER: _ClassVar[int]
     POLL_FREQUENCY_FIELD_NUMBER: _ClassVar[int]
     POLL_TIMEOUT_FIELD_NUMBER: _ClassVar[int]
@@ -256,6 +256,8 @@ class XtcpConfig(_message.Message):
     S3_ACCESS_KEY_FIELD_NUMBER: _ClassVar[int]
     S3_SECRET_KEY_FIELD_NUMBER: _ClassVar[int]
     S3_SKIP_BUCKET_PROBE_FIELD_NUMBER: _ClassVar[int]
+    S3_ALLOW_INSECURE_FIELD_NUMBER: _ClassVar[int]
+    S3_CA_FILE_FIELD_NUMBER: _ClassVar[int]
     S3_PARQUET_FLUSH_THRESHOLD_BYTES_FIELD_NUMBER: _ClassVar[int]
     S3_FLUSH_INTERVAL_FIELD_NUMBER: _ClassVar[int]
     S3_FLUSH_JITTER_PCT_FIELD_NUMBER: _ClassVar[int]
@@ -336,6 +338,8 @@ class XtcpConfig(_message.Message):
     s3_access_key: str
     s3_secret_key: str
     s3_skip_bucket_probe: bool
+    s3_allow_insecure: bool
+    s3_ca_file: str
     s3_parquet_flush_threshold_bytes: int
     s3_flush_interval: _duration_pb2.Duration
     s3_flush_jitter_pct: int
@@ -377,7 +381,7 @@ class XtcpConfig(_message.Message):
     locality_refresh_interval: _duration_pb2.Duration
     locality_events_enable: bool
     link_monitor: LinkMonitorConfig
-    def __init__(self, nl_timeout_milliseconds: _Optional[int] = ..., poll_frequency: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., poll_timeout: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., poll_jitter_pct: _Optional[int] = ..., max_loops: _Optional[int] = ..., netlinkers: _Optional[int] = ..., netlinkers_done_chan_size: _Optional[int] = ..., nlmsg_seq: _Optional[int] = ..., packet_size: _Optional[int] = ..., packet_size_mply: _Optional[int] = ..., modulus: _Optional[int] = ..., enabled_deserializers: _Optional[_Union[EnabledDeserializers, _Mapping]] = ..., io_uring: _Optional[bool] = ..., io_uring_recv_batch_size: _Optional[int] = ..., io_uring_cqe_batch_size: _Optional[int] = ..., reconcile_frequency: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., reconcile_before_poll: _Optional[bool] = ..., write_files: _Optional[int] = ..., capture_path: _Optional[str] = ..., dest_write_files: _Optional[int] = ..., debug_level: _Optional[int] = ..., debug_prometheus: _Optional[bool] = ..., dest: _Optional[str] = ..., marshal_to: _Optional[str] = ..., csv_columns: _Optional[str] = ..., xtcp_proto_file: _Optional[str] = ..., envelope_flush_threshold_bytes: _Optional[int] = ..., envelope_flush_threshold_rows: _Optional[int] = ..., topic: _Optional[str] = ..., kafka_schema_url: _Optional[str] = ..., kafka_produce_timeout: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., kafka_compression: _Optional[str] = ..., s3_endpoint: _Optional[str] = ..., s3_region: _Optional[str] = ..., s3_bucket: _Optional[str] = ..., s3_prefix: _Optional[str] = ..., s3_access_key: _Optional[str] = ..., s3_secret_key: _Optional[str] = ..., s3_skip_bucket_probe: _Optional[bool] = ..., s3_parquet_flush_threshold_bytes: _Optional[int] = ..., s3_flush_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., s3_flush_jitter_pct: _Optional[int] = ..., s3_flush_threshold_jitter_pct: _Optional[int] = ..., s3_upload_max_attempts: _Optional[int] = ..., s3_upload_backoff_cap: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., hostname: _Optional[str] = ..., location: _Optional[str] = ..., label: _Optional[str] = ..., tag: _Optional[str] = ..., daemon_version: _Optional[str] = ..., ipv4_ttl: _Optional[int] = ..., ipv6_hop_limit: _Optional[int] = ..., listener_auth: _Optional[_Union[ListenerAuth, _Mapping]] = ..., prometheus_listener: _Optional[_Union[ListenerEndpoint, _Mapping]] = ..., admin_listener_auth: _Optional[_Union[ListenerAuth, _Mapping]] = ..., grpc_port: _Optional[int] = ..., grpc_listener: _Optional[_Union[ListenerEndpoint, _Mapping]] = ..., pyroscope_url: _Optional[str] = ..., pyroscope_app_name: _Optional[str] = ..., pyroscope_sample_hz: _Optional[int] = ..., pyroscope_upload_interval_sec: _Optional[int] = ..., resolve_container_id: _Optional[bool] = ..., enrich_container_enable: _Optional[bool] = ..., docker_socket_path: _Optional[str] = ..., enrich_lldp_enable: _Optional[bool] = ..., lldpd_socket_path: _Optional[str] = ..., lldpd_version_hint: _Optional[str] = ..., enrich_nic_enable: _Optional[bool] = ..., uplink_count: _Optional[int] = ..., uplink_interfaces: _Optional[_Iterable[str]] = ..., populate_nsid: _Optional[bool] = ..., enrich_asn_enable: _Optional[bool] = ..., asn_db_path: _Optional[str] = ..., asn_refresh_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., ipmeta_bootstrap_path: _Optional[str] = ..., ipmeta_cache_path: _Optional[str] = ..., enrich_locality_enable: _Optional[bool] = ..., locality_refresh_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., locality_events_enable: _Optional[bool] = ..., link_monitor: _Optional[_Union[LinkMonitorConfig, _Mapping]] = ...) -> None: ...
+    def __init__(self, nl_timeout_milliseconds: _Optional[int] = ..., poll_frequency: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., poll_timeout: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., poll_jitter_pct: _Optional[int] = ..., max_loops: _Optional[int] = ..., netlinkers: _Optional[int] = ..., netlinkers_done_chan_size: _Optional[int] = ..., nlmsg_seq: _Optional[int] = ..., packet_size: _Optional[int] = ..., packet_size_mply: _Optional[int] = ..., modulus: _Optional[int] = ..., enabled_deserializers: _Optional[_Union[EnabledDeserializers, _Mapping]] = ..., io_uring: _Optional[bool] = ..., io_uring_recv_batch_size: _Optional[int] = ..., io_uring_cqe_batch_size: _Optional[int] = ..., reconcile_frequency: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., reconcile_before_poll: _Optional[bool] = ..., write_files: _Optional[int] = ..., capture_path: _Optional[str] = ..., dest_write_files: _Optional[int] = ..., debug_level: _Optional[int] = ..., debug_prometheus: _Optional[bool] = ..., dest: _Optional[str] = ..., marshal_to: _Optional[str] = ..., csv_columns: _Optional[str] = ..., xtcp_proto_file: _Optional[str] = ..., envelope_flush_threshold_bytes: _Optional[int] = ..., envelope_flush_threshold_rows: _Optional[int] = ..., topic: _Optional[str] = ..., kafka_schema_url: _Optional[str] = ..., kafka_produce_timeout: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., kafka_compression: _Optional[str] = ..., s3_endpoint: _Optional[str] = ..., s3_region: _Optional[str] = ..., s3_bucket: _Optional[str] = ..., s3_prefix: _Optional[str] = ..., s3_access_key: _Optional[str] = ..., s3_secret_key: _Optional[str] = ..., s3_skip_bucket_probe: _Optional[bool] = ..., s3_allow_insecure: _Optional[bool] = ..., s3_ca_file: _Optional[str] = ..., s3_parquet_flush_threshold_bytes: _Optional[int] = ..., s3_flush_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., s3_flush_jitter_pct: _Optional[int] = ..., s3_flush_threshold_jitter_pct: _Optional[int] = ..., s3_upload_max_attempts: _Optional[int] = ..., s3_upload_backoff_cap: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., hostname: _Optional[str] = ..., location: _Optional[str] = ..., label: _Optional[str] = ..., tag: _Optional[str] = ..., daemon_version: _Optional[str] = ..., ipv4_ttl: _Optional[int] = ..., ipv6_hop_limit: _Optional[int] = ..., listener_auth: _Optional[_Union[ListenerAuth, _Mapping]] = ..., prometheus_listener: _Optional[_Union[ListenerEndpoint, _Mapping]] = ..., admin_listener_auth: _Optional[_Union[ListenerAuth, _Mapping]] = ..., grpc_port: _Optional[int] = ..., grpc_listener: _Optional[_Union[ListenerEndpoint, _Mapping]] = ..., pyroscope_url: _Optional[str] = ..., pyroscope_app_name: _Optional[str] = ..., pyroscope_sample_hz: _Optional[int] = ..., pyroscope_upload_interval_sec: _Optional[int] = ..., resolve_container_id: _Optional[bool] = ..., enrich_container_enable: _Optional[bool] = ..., docker_socket_path: _Optional[str] = ..., enrich_lldp_enable: _Optional[bool] = ..., lldpd_socket_path: _Optional[str] = ..., lldpd_version_hint: _Optional[str] = ..., enrich_nic_enable: _Optional[bool] = ..., uplink_count: _Optional[int] = ..., uplink_interfaces: _Optional[_Iterable[str]] = ..., populate_nsid: _Optional[bool] = ..., enrich_asn_enable: _Optional[bool] = ..., asn_db_path: _Optional[str] = ..., asn_refresh_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., ipmeta_bootstrap_path: _Optional[str] = ..., ipmeta_cache_path: _Optional[str] = ..., enrich_locality_enable: _Optional[bool] = ..., locality_refresh_interval: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., locality_events_enable: _Optional[bool] = ..., link_monitor: _Optional[_Union[LinkMonitorConfig, _Mapping]] = ...) -> None: ...
 
 class EnabledDeserializers(_message.Message):
     __slots__ = ("enabled",)
diff --git a/nix/binaries.nix b/nix/binaries.nix
index e56524938..871a3d2ab 100644
--- a/nix/binaries.nix
+++ b/nix/binaries.nix
@@ -132,7 +132,7 @@ let
   # slim again — before the enrichment build tags, pkg/ipasn dragged parquet-go
   # into every one of them including `min`.
   xtcp2ByFlavor = lib.mapAttrs (
-    _dest: destList:
+    dest: destList:
     lib.mapAttrs (
       _enrich: enrichList:
       mkGoBinary {
@@ -146,6 +146,8 @@ let
         variant = "default";
         destinations = destList;
         enrichments = enrichList;
+        # Every slim flavor is a production build; `full` is development.
+        production = dest != "full";
       }
     ) versions.enrichmentFlavors
   ) versions.destinationFlavors;
@@ -271,6 +273,23 @@ let
   # `enrichments = [ ]` is there for exactly the same reason: untagged host
   # tests don't compile the enrich_asn / enrich_locality files either, so
   # including them here would add blocks the host profile can never cover.
+  # The netlink capture writer (-writeFiles / -capturePath) is a debugging
+  # tool that writes raw netlink replies — every socket's addresses — to disk.
+  # It is compiled in only here; no flavor or image carries the tag (see
+  # versions.optInOnlyTags and nix/checks/flavor-tags.nix). Full destinations
+  # and enrichers otherwise, so it is the development build plus capture.
+  xtcp2-capture = mkGoBinary {
+    name = "xtcp2";
+    inherit
+      src
+      commit
+      date
+      version
+      ;
+    variant = "default";
+    extraTags = [ "capture" ];
+  };
+
   xtcp2-cover = mkGoBinary {
     name = "xtcp2";
     inherit
@@ -298,6 +317,9 @@ defaultBinaries
   # Coverage-instrumented xtcp2 for the microvm coverage harness.
   inherit xtcp2-cover;
 
+  # Development build with the netlink capture writer compiled in.
+  inherit xtcp2-capture;
+
   # Joined builds.
   xtcp2-all = joins.default;
   xtcp2-all-debug = joins.debug;
diff --git a/nix/checks/default.nix b/nix/checks/default.nix
index 11d6ed084..517147053 100644
--- a/nix/checks/default.nix
+++ b/nix/checks/default.nix
@@ -95,6 +95,9 @@ in
   };
   go-sec = import ./go-sec.nix { inherit pkgs vendoredSource; };
 
+  # Slim flavors must not carry the debug writers (dest_file, capture).
+  flavor-tags = import ./flavor-tags.nix { inherit pkgs lib binaries; };
+
   # The lint ratchet, and the only check here that is GREEN at baseline. The
   # three tier checks above report a tier's whole finding list, which has been
   # non-empty for long enough that their red carries no information; this one
diff --git a/nix/checks/flavor-tags.nix b/nix/checks/flavor-tags.nix
new file mode 100644
index 000000000..efe2c6e36
--- /dev/null
+++ b/nix/checks/flavor-tags.nix
@@ -0,0 +1,85 @@
+# nix/checks/flavor-tags.nix
+#
+# Every slim (production) xtcp2 flavor must be marked production
+# (-X main.flavorProduction=true) and leave out the debug writers: the file
+# destination (`dest_file`, full flavor only) and the netlink capture writer
+# (`capture`, the dedicated xtcp2-capture attr only). The full flavor must
+# carry `dest_file` and not the production mark, and xtcp2-capture must carry
+# `capture`, so the check also proves the wiring exists at all.
+#
+# Tags come from the build settings Go records in each binary (`go version
+# -m`), which survive -s -w and strip, rather than symbol names. The
+# production mark is tested by behavior instead: -trimpath leaves -ldflags out
+# of those settings, so a production binary must refuse a credential flag
+# with exit 64 (`-v` keeps it from starting the daemon) and the full one must
+# not.
+#
+{
+  pkgs,
+  lib,
+  binaries,
+}:
+
+let
+  versions = import ../versions.nix { inherit pkgs; };
+
+  debugTags = map (d: "dest_${d}") versions.debugDestinations ++ versions.optInOnlyTags;
+
+  slim = lib.concatMap (
+    dest:
+    map (enrich: {
+      name = "${dest}-${enrich}";
+      bin = binaries.xtcp2OnlyByFlavor.${dest}.${enrich};
+    }) (builtins.attrNames versions.enrichmentFlavors)
+  ) (lib.remove "full" (builtins.attrNames versions.destinationFlavors));
+in
+pkgs.runCommand "xtcp2-flavor-tags"
+  {
+    nativeBuildInputs = [ versions.go ];
+  }
+  ''
+    export HOME=$(mktemp -d)
+    fail=0
+    tags_of() {
+      go version -m "$1/bin/xtcp2" | sed -n 's/^[[:space:]]*build[[:space:]]*-tags=//p'
+    }
+    has_tag() {
+      case ",$1," in *",$2,"*) return 0 ;; esac
+      return 1
+    }
+
+    ${lib.concatMapStrings (f: ''
+      t=$(tags_of ${f.bin})
+      for d in ${lib.concatStringsSep " " debugTags}; do
+        if has_tag "$t" "$d"; then
+          echo "FAIL: slim flavor ${f.name} carries debug tag $d (tags: $t)"
+          fail=1
+        fi
+      done
+    '') slim}
+
+    t=$(tags_of ${binaries.xtcp2})
+    has_tag "$t" dest_file || { echo "FAIL: full flavor lacks dest_file (tags: $t)"; fail=1; }
+    has_tag "$t" capture && { echo "FAIL: full flavor carries capture (tags: $t)"; fail=1; }
+
+    t=$(tags_of ${binaries.xtcp2-capture})
+    has_tag "$t" capture || { echo "FAIL: xtcp2-capture lacks capture (tags: $t)"; fail=1; }
+
+    # Production marker: every slim flavor refuses a credential flag; the
+    # full build only warns.
+    refuses_secret_flag() {
+      rc=0
+      env -i "$1/bin/xtcp2" -s3SecretKey x -v > /dev/null 2>&1 || rc=$?
+      [ "$rc" = 64 ]
+    }
+    ${lib.concatMapStrings (f: ''
+      refuses_secret_flag ${f.bin} \
+        || { echo "FAIL: slim flavor ${f.name} is not marked production"; fail=1; }
+    '') slim}
+    if refuses_secret_flag ${binaries.xtcp2}; then
+      echo "FAIL: full flavor is marked production"; fail=1
+    fi
+
+    [ "$fail" = 0 ] || exit 1
+    echo "ok: ${toString (builtins.length slim)} slim flavors free of: ${lib.concatStringsSep " " debugTags}" > $out
+  ''
diff --git a/nix/lib/mkGoBinary.nix b/nix/lib/mkGoBinary.nix
index 4cc7b50dc..d1d989ca2 100644
--- a/nix/lib/mkGoBinary.nix
+++ b/nix/lib/mkGoBinary.nix
@@ -66,6 +66,15 @@ in
   # coverage harness (nix/microvms/) to capture integration-test
   # coverage that unit tests alone can't reach.
   coverage ? false,
+  # Extra build tags beyond the destination and enrichment axes, e.g.
+  # [ "capture" ] for the netlink capture writer. Each tag is appended to the
+  # pname so the derivation is distinct from the plain build.
+  extraTags ? [ ],
+  # Production flavor: links -X main.flavorProduction=true, which makes
+  # xtcp2 refuse a credential passed as a flag (cmd/xtcp2/secrets.go). The
+  # slim per-destination flavors set it; the full (development) build and
+  # every other binary do not.
+  production ? false,
   # When coverage=true, the comma-separated package patterns whose code
   # gets instrumented. Defaults to the full xtcp2 namespace.
   coverPkg ? "github.com/randomizedcoder/xtcp2/...",
@@ -78,7 +87,10 @@ let
 
   # Resolve the effective destination list.
   effectiveDestinations =
-    if destinations == null then versions.allLibraryDestinations else destinations;
+    if destinations == null then
+      versions.allLibraryDestinations ++ versions.debugDestinations
+    else
+      destinations;
 
   # `dest_kafka`, `dest_nats`, … — one tag per included library destination.
   destinationTags = map (s: "dest_${s}") effectiveDestinations;
@@ -110,7 +122,9 @@ let
       "-" + lib.concatStringsSep "-" enrichments;
 in
 buildGoModule {
-  pname = "${name}${destSuffix}${enrichSuffix}${variantCfg.tagSuffix}${lib.optionalString coverage "-cover"}";
+  pname = "${name}${destSuffix}${enrichSuffix}${
+    lib.concatMapStrings (t: "-${t}") extraTags
+  }${variantCfg.tagSuffix}${lib.optionalString coverage "-cover"}";
   inherit
     version
     src
@@ -124,7 +138,7 @@ buildGoModule {
     CGO_ENABLED = if versions.cgoEnabled then "1" else "0";
   };
 
-  tags = versions.buildTags ++ destinationTags ++ enrichmentTags;
+  tags = versions.buildTags ++ destinationTags ++ enrichmentTags ++ extraTags;
 
   ldflags =
     variantCfg.extraLdflags
@@ -133,6 +147,7 @@ buildGoModule {
       "-X main.date=${date}"
       "-X main.version=${version}"
     ]
+    ++ lib.optional production "-X main.flavorProduction=true"
     ++ extraLdflags;
 
   # Strip and trim paths. When coverage=true, also append `-cover` +
diff --git a/nix/microvms/mkVm.nix b/nix/microvms/mkVm.nix
index 5cb1e3a75..4b3b746c3 100644
--- a/nix/microvms/mkVm.nix
+++ b/nix/microvms/mkVm.nix
@@ -2266,6 +2266,8 @@ let
     [
       "-dest"
       "s3parquet:http://127.0.0.1:9000"
+      # The in-VM Garage fixture is plaintext http; xtcp2 refuses that without the opt-in.
+      "-s3AllowInsecure"
       "-marshal"
       "protobufList"
       "-frequency"
@@ -2320,6 +2322,8 @@ let
   xtcp2ClickPipeParquetArgs = [
     "-dest"
     "s3parquet:http://127.0.0.1:9000"
+    # The in-VM Garage fixture is plaintext http; xtcp2 refuses that without the opt-in.
+    "-s3AllowInsecure"
     "-marshal"
     "protobufList"
     "-frequency"
@@ -2538,6 +2542,8 @@ let
   xtcp2S3ParquetArgs = [
     "-dest"
     "s3parquet:http://127.0.0.1:9000"
+    # The in-VM Garage fixture is plaintext http; xtcp2 refuses that without the opt-in.
+    "-s3AllowInsecure"
     "-marshal"
     "protobufList"
     "-frequency"
diff --git a/nix/tests/go-test-flavors.nix b/nix/tests/go-test-flavors.nix
index e7198578e..18edbfd31 100644
--- a/nix/tests/go-test-flavors.nix
+++ b/nix/tests/go-test-flavors.nix
@@ -72,8 +72,18 @@ let
       tags = "dest_s3parquet enrich_asn enrich_locality";
     };
 
+    # Debug writers: the file destination (full flavor only) and the netlink
+    # capture writer (no shipped flavor). Their tagged tests and the
+    # compiled-in branches of the startup/Set refusals only build here.
+    file = {
+      tags = "dest_file";
+    };
+    capture = {
+      tags = "capture";
+    };
+
     all = {
-      tags = "dest_kafka dest_nats dest_nsq dest_valkey dest_s3parquet enrich_asn enrich_locality";
+      tags = "dest_kafka dest_nats dest_nsq dest_valkey dest_s3parquet dest_file capture enrich_asn enrich_locality";
     };
   };
 
diff --git a/nix/versions.nix b/nix/versions.nix
index d8168d873..6cc50a998 100644
--- a/nix/versions.nix
+++ b/nix/versions.nix
@@ -104,9 +104,10 @@
 
   # Destination flavors. Each maps to a list of `dest_<scheme>` build tags
   # appended to the binary's build. `null` means "all" — backward-compat
-  # default that pulls in every library destination (kafka/nats/nsq/valkey/s3parquet).
-  # Stdlib destinations (null/udp/unix/unixgram) are always compiled
-  # regardless of this list.
+  # default that pulls in every library destination (kafka/nats/nsq/valkey/s3parquet)
+  # plus the debug destinations below.
+  # Stdlib destinations (null/stdout/stderr/tcp/http/udp/unix/unixgram) are
+  # always compiled regardless of this list.
   #
   # See nix/binaries.nix for which flavors are surfaced as top-level attrs.
   destinationFlavors = {
@@ -130,6 +131,19 @@
     "s3parquet"
   ];
 
+  # Debug destinations: stdlib code, but they write wherever configuration
+  # points them, so they are tag-gated like the library destinations and
+  # compiled only into the full (development) flavor — `destinations = null`.
+  # No slim (production) flavor carries them; nix/checks/flavor-tags.nix
+  # enforces that.
+  debugDestinations = [ "file" ];
+
+  # Build tags that no shipped flavor or image carries. `capture` compiles in
+  # the netlink capture writer (-writeFiles), which writes raw netlink replies
+  # to disk; it is reachable only through the dedicated `xtcp2-capture` attr.
+  # nix/checks/flavor-tags.nix fails if one of these reaches a flavor.
+  optInOnlyTags = [ "capture" ];
+
   # Enrichment flavors — the third build axis, alongside buildVariants and
   # destinationFlavors. Each maps to a list of `enrich_<feature>` build tags.
   #
diff --git a/pkg/xtcp/build_support.go b/pkg/xtcp/build_support.go
new file mode 100644
index 000000000..9ba6fc36e
--- /dev/null
+++ b/pkg/xtcp/build_support.go
@@ -0,0 +1,32 @@
+package xtcp
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+// ErrNotCompiledIn marks a config that asks for a feature this binary was
+// built without. The CLI maps it to a usage exit; ConfigService.Set refuses
+// it, because Set re-execs the same binary and would hit the same wall.
+var ErrNotCompiledIn = errors.New("not compiled into this binary")
+
+// CheckBuildSupport reports whether c asks for a build-tag-gated debug writer
+// that is not in this binary: the netlink capture writer (`-tags capture`)
+// or a destination such as `file:` (`-tags dest_file`). An unknown scheme is
+// not its concern; validateInput reports that.
+func CheckBuildSupport(c *xtcp_config.XtcpConfig) error {
+	if c.GetWriteFiles() > 0 && !CaptureCompiledIn {
+		return fmt.Errorf("-writeFiles %d: the netlink capture writer is %w; "+
+			"it is a debugging tool that writes raw netlink packets to disk. "+
+			"Rebuild with '-tags capture' (or use the `xtcp2-capture` Nix attribute) to opt in",
+			c.GetWriteFiles(), ErrNotCompiledIn)
+	}
+	scheme, _, _ := strings.Cut(c.GetDest(), ":")
+	if _, status := lookupDestinationFactory(scheme); status == destLookupNotCompiledIn {
+		return fmt.Errorf("%w: %w", ErrNotCompiledIn, destinationLookupError(scheme, status))
+	}
+	return nil
+}
diff --git a/pkg/xtcp/build_support_test.go b/pkg/xtcp/build_support_test.go
new file mode 100644
index 000000000..9ccd79742
--- /dev/null
+++ b/pkg/xtcp/build_support_test.go
@@ -0,0 +1,101 @@
+package xtcp
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+// TestCheckBuildSupport covers the build-tag-gated debug writers. The rows
+// whose outcome depends on the tags compiled into the test binary derive
+// their expectation from CaptureCompiledIn and the destination registry, so
+// the same table is correct under every flavor leg.
+func TestCheckBuildSupport(t *testing.T) {
+	t.Parallel()
+	_, fileStatus := lookupDestinationFactory(schemeFile)
+	fileIn := fileStatus == destLookupFound
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		cfg         *xtcp_config.XtcpConfig
+		expected    bool // true = refused with ErrNotCompiledIn
+		wantHint    string
+	}{
+		{"writefiles_zero", "positive", "capture idle is always fine",
+			&xtcp_config.XtcpConfig{Dest: "null", WriteFiles: 0}, false, ""},
+		{"stderr_dest", "positive", "stdlib destination needs no tag",
+			&xtcp_config.XtcpConfig{Dest: "stderr"}, false, ""},
+		{"writefiles_armed", "negative", "capture armed needs -tags capture",
+			&xtcp_config.XtcpConfig{Dest: "null", WriteFiles: 5}, !CaptureCompiledIn, "-tags capture"},
+		{"file_dest", "negative", "file: needs -tags dest_file",
+			&xtcp_config.XtcpConfig{Dest: "file:/x"}, !fileIn, "-tags dest_file"},
+		{"writefiles_one", "boundary", "smallest armed budget is still refused",
+			&xtcp_config.XtcpConfig{Dest: "null", WriteFiles: 1}, !CaptureCompiledIn, "-tags capture"},
+		{"unknown_scheme", "corner", "unknown scheme is left to validateInput",
+			&xtcp_config.XtcpConfig{Dest: "bogus:x"}, false, ""},
+		{"nil_config", "corner", "nil config asks for nothing",
+			nil, false, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			t.Parallel()
+			err := CheckBuildSupport(tc.cfg)
+			if got := errors.Is(err, ErrNotCompiledIn); got != tc.expected {
+				t.Fatalf("%s: refused = %v, want %v (err: %v)", tc.description, got, tc.expected, err)
+			}
+			if err == nil && tc.expected {
+				t.Fatalf("%s: want an error", tc.description)
+			}
+			if err != nil && !strings.Contains(err.Error(), tc.wantHint) {
+				t.Errorf("%s: error %q lacks the rebuild hint %q", tc.description, err, tc.wantHint)
+			}
+		})
+	}
+}
+
+// TestConfigService_Set_debugWritersNotCompiledIn: Set re-execs the same
+// binary, so it refuses a config needing a debug writer this build lacks and
+// leaves the running daemon alone. With the tag compiled in, Set gets past
+// the guard (and stops at the missing reconfigure hook: Unavailable).
+func TestConfigService_Set_debugWritersNotCompiledIn(t *testing.T) {
+	_, fileStatus := lookupDestinationFactory(schemeFile)
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		mutate      func(*xtcp_config.XtcpConfig)
+		compiledIn  bool
+	}{
+		{"set_write_files", "negative", "write_files=1 needs the capture tag",
+			func(c *xtcp_config.XtcpConfig) { c.WriteFiles = 1 }, CaptureCompiledIn},
+		{"set_file_dest", "negative", "dest file: needs the dest_file tag",
+			func(c *xtcp_config.XtcpConfig) { c.Dest = "file:/tmp/x"; c.MarshalTo = "jsonl" },
+			fileStatus == destLookupFound},
+		{"set_write_files_zero", "boundary", "write_files=0 passes the guard on every build",
+			func(c *xtcp_config.XtcpConfig) { c.WriteFiles = 0 }, true},
+		{"set_stdlib_dest", "positive", "a stdlib destination passes the guard",
+			func(c *xtcp_config.XtcpConfig) { c.Dest = "stderr" }, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			c, _ := newConfigServiceFixture(t)
+			cfg := validSetConfig()
+			tc.mutate(cfg)
+			_, err := c.Set(context.Background(), &xtcp_config.SetRequest{Config: cfg})
+			want := codes.FailedPrecondition
+			if tc.compiledIn {
+				want = codes.Unavailable
+			}
+			if got := status.Code(err); got != want {
+				t.Errorf("%s: Set code = %v, want %v (err: %v)", tc.description, got, want, err)
+			}
+		})
+	}
+}
diff --git a/pkg/xtcp/destinations_file.go b/pkg/xtcp/destinations_file.go
index 5c2bbc052..f21c0f0df 100644
--- a/pkg/xtcp/destinations_file.go
+++ b/pkg/xtcp/destinations_file.go
@@ -1,3 +1,5 @@
+//go:build dest_file
+
 package xtcp
 
 import (
@@ -7,15 +9,11 @@ import (
 	"strings"
 )
 
-// stderr and file destinations: thin factories over the reusable writerDest.
-// Both are stdlib (no build tag). Pair with a line/tabular marshaller
-// (jsonl/csv/tsv/protoJson) — the marshaller frames each flush.
-
-// newStderrDest writes records to the process's stderr. Handy when stdout is
-// reserved for something else, or for `2>records.log`.
-func newStderrDest(_ context.Context, x *XTCP) (Destination, error) {
-	return &writerDest{x: x, w: os.Stderr, label: "destStderr"}, nil
-}
+// file destination: a thin factory over the reusable writerDest. It writes
+// records to a path chosen by configuration, so it is compiled in only with
+// `-tags dest_file` (the full/dev flavor); production flavors omit it. Pair
+// with a line/tabular marshaller (jsonl/csv/tsv/protoJson) — the marshaller
+// frames each flush.
 
 // newFileDest appends records to a file: `-dest file:/var/log/xtcp.jsonl`.
 // The file is created if missing and opened for append; the *os.File is
@@ -33,6 +31,5 @@ func newFileDest(_ context.Context, x *XTCP) (Destination, error) {
 }
 
 func init() {
-	RegisterDestination(schemeStderr, newStderrDest)
 	RegisterDestination(schemeFile, newFileDest)
 }
diff --git a/pkg/xtcp/destinations_file_test.go b/pkg/xtcp/destinations_file_test.go
index 14a1026fb..c3b56ba02 100644
--- a/pkg/xtcp/destinations_file_test.go
+++ b/pkg/xtcp/destinations_file_test.go
@@ -1,3 +1,5 @@
+//go:build dest_file
+
 package xtcp
 
 import (
@@ -43,3 +45,52 @@ func TestFileDest_send(t *testing.T) {
 		t.Errorf("file content = %q, want %q", got, want)
 	}
 }
+
+// TestFileDest writes payloads and reads them back from the file.
+func TestFileDest(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "out.jsonl")
+	x := newTestXTCP(t, "file:"+path)
+	dest, err := newFileDest(context.Background(), x)
+	if err != nil {
+		t.Fatalf("newFileDest: %v", err)
+	}
+	payload := []byte("hello\n")
+	if _, err := dest.Send(context.Background(), &payload); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+	if err := dest.Close(); err != nil {
+		t.Fatalf("Close: %v", err)
+	}
+	got, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "hello\n" {
+		t.Errorf("file content = %q, want %q", got, "hello\n")
+	}
+}
+
+func TestFileDest_emptyPath(t *testing.T) {
+	x := newTestXTCP(t, "file:")
+	if _, err := newFileDest(context.Background(), x); err == nil {
+		t.Fatal("expected error for empty file path")
+	}
+}
+
+// TestFileSchemeRegistered confirms the dest_file tag registers the scheme.
+func TestFileSchemeRegistered(t *testing.T) {
+	if _, status := lookupDestinationFactory(schemeFile); status != destLookupFound {
+		t.Errorf("scheme %q not registered (status %v)", schemeFile, status)
+	}
+}
+
+// TestValidateInput_fileDest: with the tag, `-dest file:<path>` validates.
+func TestValidateInput_fileDest(t *testing.T) {
+	x := newTestXTCP(t, "file:/var/log/xtcp.csv")
+	x.config.MarshalTo = MarshallerProtoJSON
+	x.config.Topic = "xtcp"
+	x.Marshallers.Store(MarshallerProtoJSON, struct{}{})
+	if err := x.validateInput(); err != nil {
+		t.Errorf("validateInput: %v", err)
+	}
+}
diff --git a/pkg/xtcp/destinations_s3parquet.go b/pkg/xtcp/destinations_s3parquet.go
index 92dd0259c..39825dbb8 100644
--- a/pkg/xtcp/destinations_s3parquet.go
+++ b/pkg/xtcp/destinations_s3parquet.go
@@ -6,11 +6,15 @@ import (
 	"bytes"
 	"context"
 	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
 	"log"
+	"net/http"
+	"os"
 	"path"
 	"strings"
 	"sync"
@@ -19,6 +23,7 @@ import (
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
 	"github.com/parquet-go/parquet-go"
+	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/protobuf/encoding/protodelim"
 
 	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
@@ -134,26 +139,80 @@ type envelopeBytes struct {
 	buf *[]byte
 }
 
+// s3InsecureGauge is 1 while the s3parquet destination talks plaintext http
+// to its endpoint (-s3AllowInsecure).
+var s3InsecureGauge = prometheus.NewGauge(prometheus.GaugeOpts{
+	Namespace: "xtcp2",
+	Subsystem: "s3",
+	Name:      "insecure",
+	Help:      "1 when the s3parquet endpoint is plaintext http (-s3AllowInsecure)",
+})
+
+func init() {
+	prometheus.MustRegister(s3InsecureGauge)
+}
+
+// s3TLSMinVersion is the oldest TLS version the S3 client accepts. minio's
+// default transport sets the same floor today; pinning it here keeps it if
+// the library default ever changes.
+const s3TLSMinVersion = tls.VersionTLS12
+
+// s3Transport is minio's default transport with the TLS floor pinned and,
+// when caFile is set, its PEM certificates trusted on top of the system
+// roots (a private CA in front of an S3-compatible store). A CA file that
+// cannot be read or holds no certificate is an error, not a silent fallback
+// to the system roots.
+func s3Transport(secure bool, caFile string) (*http.Transport, error) {
+	tr, err := minio.DefaultTransport(secure)
+	if err != nil {
+		return nil, fmt.Errorf("s3 transport: %w", err)
+	}
+	if !secure {
+		return tr, nil
+	}
+	if tr.TLSClientConfig == nil {
+		tr.TLSClientConfig = &tls.Config{}
+	}
+	tr.TLSClientConfig.MinVersion = s3TLSMinVersion
+	if caFile == "" {
+		return tr, nil
+	}
+	pem, err := os.ReadFile(caFile)
+	if err != nil {
+		return nil, fmt.Errorf("s3 CA file: %w", err)
+	}
+	pool, err := x509.SystemCertPool()
+	if err != nil || pool == nil {
+		pool = x509.NewCertPool()
+	}
+	if !pool.AppendCertsFromPEM(pem) {
+		return nil, fmt.Errorf("s3 CA file %q: no PEM certificate found", caFile)
+	}
+	tr.TLSClientConfig.RootCAs = pool
+	return tr, nil
+}
+
 // newS3ParquetDest dials MinIO/S3 from the configured endpoint + creds,
 // validates the bucket exists, and spawns the background worker. Fails
 // fast on config errors so a misconfigured deployment doesn't enter a
 // half-broken state.
 func newS3ParquetDest(ctx context.Context, x *XTCP) (Destination, error) {
-	endpoint := strings.TrimPrefix(x.config.Dest, schemeS3Parquet+":")
-	if endpoint == "" {
-		endpoint = x.config.S3Endpoint
+	// minio.New expects host:port without scheme; the Secure flag controls
+	// TLS. S3Endpoint refuses plaintext http:// unless S3AllowInsecure.
+	endpoint, secure, err := S3Endpoint(x.config)
+	if err != nil {
+		return nil, fmt.Errorf("newS3ParquetDest: %w", err)
 	}
-	if endpoint == "" {
-		return nil, errors.New("newS3ParquetDest endpoint is empty (set -dest s3parquet:<endpoint> or S3_ENDPOINT)")
+	transport, err := s3Transport(secure, x.config.S3CaFile)
+	if err != nil {
+		return nil, fmt.Errorf("newS3ParquetDest: %w", err)
 	}
-	// minio.New expects host:port without scheme. Strip http:// or https://
-	// for the Endpoint field; the boolean Secure flag controls TLS.
-	secure := false
-	if strings.HasPrefix(endpoint, "https://") {
-		secure = true
-		endpoint = strings.TrimPrefix(endpoint, "https://")
-	} else if strings.HasPrefix(endpoint, "http://") {
-		endpoint = strings.TrimPrefix(endpoint, "http://")
+	if secure {
+		s3InsecureGauge.Set(0)
+	} else {
+		s3InsecureGauge.Set(1)
+		log.Printf("WARNING: s3parquet endpoint %q is plaintext http (-s3AllowInsecure): the S3 credential "+
+			"and every uploaded object cross the network unencrypted. For local test fixtures only.", endpoint)
 	}
 
 	bucket := x.config.S3Bucket
@@ -168,9 +227,10 @@ func newS3ParquetDest(ctx context.Context, x *XTCP) (Destination, error) {
 	}
 
 	client, err := minio.New(endpoint, &minio.Options{
-		Creds:  credentials.NewStaticV4(accessKey, secretKey, ""),
-		Secure: secure,
-		Region: region,
+		Creds:     credentials.NewStaticV4(accessKey, secretKey, ""),
+		Secure:    secure,
+		Region:    region,
+		Transport: transport,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("newS3ParquetDest minio.New: %w", err)
diff --git a/pkg/xtcp/destinations_s3parquet_tls_test.go b/pkg/xtcp/destinations_s3parquet_tls_test.go
new file mode 100644
index 000000000..01e69b369
--- /dev/null
+++ b/pkg/xtcp/destinations_s3parquet_tls_test.go
@@ -0,0 +1,95 @@
+//go:build dest_s3parquet
+
+package xtcp
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// testCAPEM returns a freshly generated self-signed CA certificate in PEM.
+func testCAPEM(t *testing.T) []byte {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "xtcp2 test CA"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(time.Hour),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		KeyUsage:              x509.KeyUsageCertSign,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+}
+
+func TestS3Transport(t *testing.T) {
+	dir := t.TempDir()
+	write := func(name string, b []byte) string {
+		p := filepath.Join(dir, name)
+		if err := os.WriteFile(p, b, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return p
+	}
+	goodCA := write("ca.pem", testCAPEM(t))
+	notPEM := write("junk.pem", []byte("not a certificate"))
+
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		secure      bool
+		caFile      string
+		expected    string // "tls", "tls+ca", "plain", "error"
+	}{
+		{"tls_default", "positive", "TLS with system roots and the 1.2 floor", true, "", "tls"},
+		{"tls_ca_file", "positive", "a private CA is trusted on top", true, goodCA, "tls+ca"},
+		{"plaintext", "boundary", "plaintext has no TLS config to pin", false, goodCA, "plain"},
+		{"ca_missing", "negative", "an unreadable CA file is an error", true, filepath.Join(dir, "nope.pem"), "error"},
+		{"ca_not_pem", "corner", "a CA file with no certificate is an error", true, notPEM, "error"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			tr, err := s3Transport(tc.secure, tc.caFile)
+			if tc.expected == "error" {
+				if err == nil {
+					t.Fatalf("%s: want an error", tc.description)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("%s: %v", tc.description, err)
+			}
+			if tc.expected == "plain" {
+				if tr.TLSClientConfig != nil {
+					t.Errorf("%s: plaintext transport has a TLS config", tc.description)
+				}
+				return
+			}
+			if tr.TLSClientConfig == nil || tr.TLSClientConfig.MinVersion != tls.VersionTLS12 {
+				t.Fatalf("%s: TLS floor not pinned to 1.2: %+v", tc.description, tr.TLSClientConfig)
+			}
+			if got := tr.TLSClientConfig.RootCAs != nil; tc.expected == "tls+ca" && !got {
+				t.Errorf("%s: CA file not installed as RootCAs", tc.description)
+			}
+		})
+	}
+}
diff --git a/pkg/xtcp/destinations_stderr.go b/pkg/xtcp/destinations_stderr.go
new file mode 100644
index 000000000..267f68440
--- /dev/null
+++ b/pkg/xtcp/destinations_stderr.go
@@ -0,0 +1,20 @@
+package xtcp
+
+import (
+	"context"
+	"os"
+)
+
+// stderr destination: a thin factory over the reusable writerDest. Stdlib
+// (no build tag). Pair with a line/tabular marshaller (jsonl/csv/tsv/
+// protoJson) — the marshaller frames each flush.
+
+// newStderrDest writes records to the process's stderr. Handy when stdout is
+// reserved for something else, or for `2>records.log`.
+func newStderrDest(_ context.Context, x *XTCP) (Destination, error) {
+	return &writerDest{x: x, w: os.Stderr, label: "destStderr"}, nil
+}
+
+func init() {
+	RegisterDestination(schemeStderr, newStderrDest)
+}
diff --git a/pkg/xtcp/destinations_stream_test.go b/pkg/xtcp/destinations_stream_test.go
index bc2d7e591..bde72486b 100644
--- a/pkg/xtcp/destinations_stream_test.go
+++ b/pkg/xtcp/destinations_stream_test.go
@@ -8,7 +8,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"path/filepath"
 	"sync"
 	"testing"
 )
@@ -32,37 +31,6 @@ func TestStderrDestFactory(t *testing.T) {
 	}
 }
 
-// TestFileDest writes payloads and reads them back from the file.
-func TestFileDest(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "out.jsonl")
-	x := newTestXTCP(t, "file:"+path)
-	dest, err := newFileDest(context.Background(), x)
-	if err != nil {
-		t.Fatalf("newFileDest: %v", err)
-	}
-	payload := []byte("hello\n")
-	if _, err := dest.Send(context.Background(), &payload); err != nil {
-		t.Fatalf("Send: %v", err)
-	}
-	if err := dest.Close(); err != nil {
-		t.Fatalf("Close: %v", err)
-	}
-	got, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(got) != "hello\n" {
-		t.Errorf("file content = %q, want %q", got, "hello\n")
-	}
-}
-
-func TestFileDest_emptyPath(t *testing.T) {
-	x := newTestXTCP(t, "file:")
-	if _, err := newFileDest(context.Background(), x); err == nil {
-		t.Fatal("expected error for empty file path")
-	}
-}
-
 // TestTCPDest dials a listener, sends, and reads the bytes back verbatim.
 func TestTCPDest(t *testing.T) {
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
@@ -162,7 +130,7 @@ func TestHTTPDest_non2xx(t *testing.T) {
 
 // TestNewStreamSchemesRegistered confirms all new schemes resolve.
 func TestNewStreamSchemesRegistered(t *testing.T) {
-	for _, s := range []string{schemeStderr, schemeFile, schemeTCP, schemeHTTP, schemeHTTPS} {
+	for _, s := range []string{schemeStderr, schemeTCP, schemeHTTP, schemeHTTPS} {
 		if _, status := lookupDestinationFactory(s); status != destLookupFound {
 			t.Errorf("scheme %q not registered (status %v)", s, status)
 		}
diff --git a/pkg/xtcp/grpc_configService.go b/pkg/xtcp/grpc_configService.go
index 78df008cb..f18d93143 100644
--- a/pkg/xtcp/grpc_configService.go
+++ b/pkg/xtcp/grpc_configService.go
@@ -176,6 +176,18 @@ func (c *xtcpConfigService) Set(
 		return nil, status.Error(codes.FailedPrecondition, err.Error())
 	}
 
+	// Same reasoning for the build-tag-gated debug writers (the netlink
+	// capture writer, the file destination): a binary built without them
+	// cannot be restarted into using them.
+	if err := CheckBuildSupport(in.Config); err != nil {
+		c.pC.WithLabelValues("Set", "notCompiledIn", "error").Inc()
+		return nil, status.Error(codes.FailedPrecondition, err.Error())
+	}
+	if err := CheckS3Transport(in.Config); err != nil {
+		c.pC.WithLabelValues("Set", "s3Transport", "error").Inc()
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
 	// Secret preservation: an operator does Get → edit → Set, and Get redacts
 	// the S3 credentials (see below). Empty credential fields therefore mean
 	// "unchanged", not "clear" — inherit them from the running config so a
diff --git a/pkg/xtcp/grpc_configService_test.go b/pkg/xtcp/grpc_configService_test.go
index f385888e4..070167466 100644
--- a/pkg/xtcp/grpc_configService_test.go
+++ b/pkg/xtcp/grpc_configService_test.go
@@ -72,7 +72,7 @@ func validSetConfig() *xtcp_config.XtcpConfig {
 		NlmsgSeq:               1,
 		Modulus:                1,
 		MarshalTo:              "protobufList",
-		Dest:                   "kafka:127.0.0.1:9092",
+		Dest:                   "udp:127.0.0.1:13000",
 		DebugLevel:             111,
 		GrpcPort:               8080,
 		CapturePath:            "/tmp",
diff --git a/pkg/xtcp/init.go b/pkg/xtcp/init.go
index 3f0a15dbe..246615303 100644
--- a/pkg/xtcp/init.go
+++ b/pkg/xtcp/init.go
@@ -47,6 +47,8 @@ func (x *XTCP) Init(ctx context.Context) {
 		return
 	}
 
+	x.announceCapture()
+
 	// initChanenls first, so that signaling channels are ready
 	x.initChannels()
 
diff --git a/pkg/xtcp/input_validation_test.go b/pkg/xtcp/input_validation_test.go
index e98712de1..0f0cbb473 100644
--- a/pkg/xtcp/input_validation_test.go
+++ b/pkg/xtcp/input_validation_test.go
@@ -113,14 +113,6 @@ func TestValidateInput_happyPaths(t *testing.T) {
 				Topic:     "xtcp",
 			},
 		},
-		{
-			name: "file dest with path",
-			cfg: &xtcp_config.XtcpConfig{
-				MarshalTo: MarshallerProtoJSON,
-				Dest:      "file:/var/log/xtcp.csv",
-				Topic:     "xtcp",
-			},
-		},
 		{
 			name: "tcp dest host:port",
 			cfg: &xtcp_config.XtcpConfig{
diff --git a/pkg/xtcp/netlinker.go b/pkg/xtcp/netlinker.go
index 8d5b4163d..7c5f2393f 100644
--- a/pkg/xtcp/netlinker.go
+++ b/pkg/xtcp/netlinker.go
@@ -18,7 +18,6 @@ import (
 	"encoding/binary"
 	"log"
 	"net"
-	"os"
 	"runtime"
 	"sync"
 	"sync/atomic"
@@ -29,10 +28,8 @@ import (
 )
 
 const (
-	// Raw netlink captures carry host addresses: owner read/write only.
-	writeFilesPermissionsCst = 0o600
-	forceGCModulesCst        = 1000
-	nlmsgAlignToCst          = 4
+	forceGCModulesCst = 1000
+	nlmsgAlignToCst   = 4
 )
 
 // NetlinkerFunc runs the netlinkers for one fd until ctx is canceled,
@@ -67,38 +64,6 @@ func (x *XTCP) recvOneFromKernel(fd int, buf []byte) (n int, retry bool) {
 	return n, false
 }
 
-// captureToFileIfEnabled writes the packet to disk when the WriteFiles
-// budget is positive. Returns the updated budget — 0 means "stop trying
-// for the rest of this goroutine's life" (a write error disables
-// captures permanently rather than killing the daemon).
-func (x *XTCP) captureToFileIfEnabled(wf uint32, packet []byte, id uint32) uint32 {
-	if wf == 0 {
-		return wf
-	}
-	now := time.Now()
-	// Capture only the n bytes Recvfrom actually filled. Writing the
-	// raw *packetBuffer here used to dump the full pool-buffer size
-	// (e.g. 8 KiB), trailing the real packet with stale bytes from a
-	// previous Recvfrom — pcap-like consumers parsed garbage past
-	// the real end of the message.
-	err := os.WriteFile(
-		x.config.CapturePath+"netlink."+now.Format(time.RFC3339Nano),
-		packet,
-		writeFilesPermissionsCst)
-	if err == nil {
-		return wf - 1
-	}
-	// Diagnostic capture-to-file is a side feature; a disk-full /
-	// EACCES / etc. here must NOT take down the daemon (and every
-	// other netlinker for every other namespace with it). Stop
-	// capturing further packets and count the failure.
-	x.pC.WithLabelValues("Netlinker", "WriteFile", "error").Inc()
-	if x.debugLevel > 10 {
-		log.Printf("Netlinker %d WriteFile err (disabling further captures): %v", id, err)
-	}
-	return 0
-}
-
 // maybeForceGC fires runtime.GC every forceGCModulesCst packets. The
 // previous body fired on packets==0 too, forcing a GC before any work
 // was done; skip the zero case so it fires every Nth packet AFTER the
diff --git a/pkg/xtcp/netlinker_capture.go b/pkg/xtcp/netlinker_capture.go
new file mode 100644
index 000000000..7990e908f
--- /dev/null
+++ b/pkg/xtcp/netlinker_capture.go
@@ -0,0 +1,80 @@
+//go:build capture
+
+package xtcp
+
+import (
+	"log"
+	"os"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// The netlink capture writer is a debugging tool: it writes raw inet_diag
+// replies, which carry every socket's addresses, to disk. It is compiled in
+// only with `-tags capture` and no shipped flavor or image sets that tag.
+
+// CaptureCompiledIn reports whether this binary contains the netlink capture
+// writer (`-writeFiles` / `-capturePath`).
+const CaptureCompiledIn = true
+
+// Raw netlink captures carry host addresses: owner read/write only.
+const writeFilesPermissionsCst = 0o600
+
+// debugCaptureEnabled is 1 while this process is armed to write captures.
+var debugCaptureEnabled = prometheus.NewGauge(prometheus.GaugeOpts{
+	Namespace: "xtcp2",
+	Subsystem: "debug",
+	Name:      "capture_enabled",
+	Help:      "1 when the netlink capture writer is compiled in and armed (-writeFiles > 0)",
+})
+
+func init() {
+	prometheus.MustRegister(debugCaptureEnabled)
+}
+
+// announceCapture warns, once at Init, when the capture writer is armed.
+// Compiled in but idle (-writeFiles 0) it says nothing and the gauge is 0.
+func (x *XTCP) announceCapture() {
+	if x.config.GetWriteFiles() == 0 {
+		debugCaptureEnabled.Set(0)
+		return
+	}
+	debugCaptureEnabled.Set(1)
+	log.Printf("WARNING: netlink capture is ARMED: up to %d raw netlink packets per netlinker "+
+		"will be written under %q. Captures hold the addresses and ports of every socket on this "+
+		"host. This is a debugging feature; do not run it in production.",
+		x.config.GetWriteFiles(), x.config.GetCapturePath())
+}
+
+// captureToFileIfEnabled writes the packet to disk when the WriteFiles
+// budget is positive. Returns the updated budget — 0 means "stop trying
+// for the rest of this goroutine's life" (a write error disables
+// captures permanently rather than killing the daemon).
+func (x *XTCP) captureToFileIfEnabled(wf uint32, packet []byte, id uint32) uint32 {
+	if wf == 0 {
+		return wf
+	}
+	now := time.Now()
+	// Capture only the n bytes Recvfrom actually filled. Writing the
+	// raw *packetBuffer here used to dump the full pool-buffer size
+	// (e.g. 8 KiB), trailing the real packet with stale bytes from a
+	// previous Recvfrom — pcap-like consumers parsed garbage past
+	// the real end of the message.
+	err := os.WriteFile(
+		x.config.CapturePath+"netlink."+now.Format(time.RFC3339Nano),
+		packet,
+		writeFilesPermissionsCst)
+	if err == nil {
+		return wf - 1
+	}
+	// Diagnostic capture-to-file is a side feature; a disk-full /
+	// EACCES / etc. here must NOT take down the daemon (and every
+	// other netlinker for every other namespace with it). Stop
+	// capturing further packets and count the failure.
+	x.pC.WithLabelValues("Netlinker", "WriteFile", "error").Inc()
+	if x.debugLevel > 10 {
+		log.Printf("Netlinker %d WriteFile err (disabling further captures): %v", id, err)
+	}
+	return 0
+}
diff --git a/pkg/xtcp/netlinker_capture_test.go b/pkg/xtcp/netlinker_capture_test.go
new file mode 100644
index 000000000..02e932d20
--- /dev/null
+++ b/pkg/xtcp/netlinker_capture_test.go
@@ -0,0 +1,149 @@
+//go:build capture
+
+package xtcp
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+)
+
+// TestAnnounceCapture: armed, the capture writer warns and raises its gauge;
+// compiled in but idle it does neither.
+func TestAnnounceCapture(t *testing.T) {
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		writeFiles  uint32
+		expected    float64 // gauge; a warning is logged iff it is 1
+	}{
+		{"capture_compiled_warns", "positive", "armed: warning and gauge 1", 3, 1},
+		{"capture_compiled_idle", "negative", "idle: no warning, gauge 0", 0, 0},
+		{"capture_budget_one", "boundary", "the smallest budget still arms", 1, 1},
+		{"capture_rearm_then_idle", "corner", "an idle announce clears a prior armed gauge", 0, 0},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			x := newNetlinkerXTCP(t)
+			x.config.WriteFiles = tc.writeFiles
+			var buf bytes.Buffer
+			prev := log.Writer()
+			log.SetOutput(&buf)
+			t.Cleanup(func() { log.SetOutput(prev) })
+			debugCaptureEnabled.Set(1) // a stale armed value must not survive an idle announce
+			x.announceCapture()
+			if got := testutil.ToFloat64(debugCaptureEnabled); got != tc.expected {
+				t.Errorf("%s: gauge = %v, want %v", tc.description, got, tc.expected)
+			}
+			warned := strings.Contains(buf.String(), "netlink capture is ARMED")
+			if warned != (tc.expected == 1) {
+				t.Errorf("%s: warned = %v, log %q", tc.description, warned, buf.String())
+			}
+			if warned && !strings.Contains(buf.String(), x.config.CapturePath) {
+				t.Errorf("%s: warning does not name the capture path: %q", tc.description, buf.String())
+			}
+		})
+	}
+}
+
+// ───────────────────────────────────────────────────────────────────────
+// captureToFileIfEnabled — positive / negative / boundary / corner /
+// adversarial. Each row asserts the returned wf and whether a file was
+// created in CapturePath.
+// ───────────────────────────────────────────────────────────────────────
+
+func TestCaptureToFileIfEnabled_table(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name           string
+		category       string
+		inputWF        uint32
+		corruptPath    bool
+		wantWF         uint32
+		wantFileExists bool
+	}{
+		{"positive_writes_and_decrements", "positive", 3, false, 2, true},
+		{"positive_single_budget", "positive", 1, false, 0, true},
+		{"negative_zero_budget_noop", "negative", 0, false, 0, false},
+		{"boundary_max_uint32_decrements", "boundary", ^uint32(0), false, ^uint32(0) - 1, true},
+		{"corner_write_fails_resets_to_zero", "corner", 5, true, 0, false},
+		{"adversarial_repeated_write_fail_stays_zero", "adversarial", 0, true, 0, false},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			t.Parallel()
+			x := newNetlinkerXTCP(t)
+			if tc.corruptPath {
+				// Point CapturePath at a non-existent + unwritable dir
+				// so os.WriteFile fails. Cleanup is automatic via
+				// t.TempDir below the unwritable dir.
+				x.config.CapturePath = filepath.Join(t.TempDir(), "does_not_exist", "subdir") + string(os.PathSeparator) + "cap_"
+			}
+			payload := []byte("hello")
+			gotWF := x.captureToFileIfEnabled(tc.inputWF, payload, 7)
+			if gotWF != tc.wantWF {
+				t.Errorf("returned wf = %d, want %d", gotWF, tc.wantWF)
+			}
+			// Look for any "netlink." file under the capture dir.
+			capDir := filepath.Dir(x.config.CapturePath)
+			matched := false
+			if entries, err := os.ReadDir(capDir); err == nil {
+				for _, e := range entries {
+					if strings.HasPrefix(e.Name(), "netlink.") || strings.HasPrefix(e.Name(), "cap_netlink.") {
+						matched = true
+						break
+					}
+				}
+			}
+			if matched != tc.wantFileExists {
+				t.Errorf("file-exists = %v, want %v (capDir=%s)", matched, tc.wantFileExists, capDir)
+			}
+		})
+	}
+}
+
+// TestCaptureToFileIfEnabled_payloadLength pins bug-39-style behavior:
+// the file holds exactly len(packet) bytes, not the pool's full
+// capacity. This is the original reason for the captureToFile change.
+func TestCaptureToFileIfEnabled_payloadLength(t *testing.T) {
+	x := newNetlinkerXTCP(t)
+	x.captureToFileIfEnabled(1, []byte("abc"), 0)
+	entries, _ := os.ReadDir(filepath.Dir(x.config.CapturePath))
+	if len(entries) == 0 {
+		t.Fatal("expected one capture file, found none")
+	}
+	first := entries[0]
+	root, err := os.OpenRoot(filepath.Dir(x.config.CapturePath))
+	if err != nil {
+		t.Fatalf("open capture dir: %v", err)
+	}
+	t.Cleanup(func() {
+		if cerr := root.Close(); cerr != nil {
+			t.Errorf("close capture dir: %v", cerr)
+		}
+	})
+	data, err := root.ReadFile(first.Name())
+	if err != nil {
+		t.Fatalf("read capture: %v", err)
+	}
+	if string(data) != "abc" {
+		t.Errorf("capture contents = %q, want %q", data, "abc")
+	}
+}
+
+func BenchmarkCaptureToFileIfEnabled_off(b *testing.B) {
+	b.ReportAllocs()
+	x := newNetlinkerXTCP(&testing.T{})
+	payload := []byte("z")
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		x.captureToFileIfEnabled(0, payload, 1) // wf=0 → no I/O
+	}
+}
diff --git a/pkg/xtcp/netlinker_helpers_test.go b/pkg/xtcp/netlinker_helpers_test.go
index 30be0501f..9d596eca7 100644
--- a/pkg/xtcp/netlinker_helpers_test.go
+++ b/pkg/xtcp/netlinker_helpers_test.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"fmt"
 	"log"
-	"os"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -154,92 +153,6 @@ func TestRecvOneFromKernel_table(t *testing.T) {
 	})
 }
 
-// ───────────────────────────────────────────────────────────────────────
-// captureToFileIfEnabled — positive / negative / boundary / corner /
-// adversarial. Each row asserts the returned wf and whether a file was
-// created in CapturePath.
-// ───────────────────────────────────────────────────────────────────────
-
-func TestCaptureToFileIfEnabled_table(t *testing.T) {
-	t.Parallel()
-	cases := []struct {
-		name           string
-		category       string
-		inputWF        uint32
-		corruptPath    bool
-		wantWF         uint32
-		wantFileExists bool
-	}{
-		{"positive_writes_and_decrements", "positive", 3, false, 2, true},
-		{"positive_single_budget", "positive", 1, false, 0, true},
-		{"negative_zero_budget_noop", "negative", 0, false, 0, false},
-		{"boundary_max_uint32_decrements", "boundary", ^uint32(0), false, ^uint32(0) - 1, true},
-		{"corner_write_fails_resets_to_zero", "corner", 5, true, 0, false},
-		{"adversarial_repeated_write_fail_stays_zero", "adversarial", 0, true, 0, false},
-	}
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
-			t.Parallel()
-			x := newNetlinkerXTCP(t)
-			if tc.corruptPath {
-				// Point CapturePath at a non-existent + unwritable dir
-				// so os.WriteFile fails. Cleanup is automatic via
-				// t.TempDir below the unwritable dir.
-				x.config.CapturePath = filepath.Join(t.TempDir(), "does_not_exist", "subdir") + string(os.PathSeparator) + "cap_"
-			}
-			payload := []byte("hello")
-			gotWF := x.captureToFileIfEnabled(tc.inputWF, payload, 7)
-			if gotWF != tc.wantWF {
-				t.Errorf("returned wf = %d, want %d", gotWF, tc.wantWF)
-			}
-			// Look for any "netlink." file under the capture dir.
-			capDir := filepath.Dir(x.config.CapturePath)
-			matched := false
-			if entries, err := os.ReadDir(capDir); err == nil {
-				for _, e := range entries {
-					if strings.HasPrefix(e.Name(), "netlink.") || strings.HasPrefix(e.Name(), "cap_netlink.") {
-						matched = true
-						break
-					}
-				}
-			}
-			if matched != tc.wantFileExists {
-				t.Errorf("file-exists = %v, want %v (capDir=%s)", matched, tc.wantFileExists, capDir)
-			}
-		})
-	}
-}
-
-// TestCaptureToFileIfEnabled_payloadLength pins bug-39-style behavior:
-// the file holds exactly len(packet) bytes, not the pool's full
-// capacity. This is the original reason for the captureToFile change.
-func TestCaptureToFileIfEnabled_payloadLength(t *testing.T) {
-	x := newNetlinkerXTCP(t)
-	x.captureToFileIfEnabled(1, []byte("abc"), 0)
-	entries, _ := os.ReadDir(filepath.Dir(x.config.CapturePath))
-	if len(entries) == 0 {
-		t.Fatal("expected one capture file, found none")
-	}
-	first := entries[0]
-	root, err := os.OpenRoot(filepath.Dir(x.config.CapturePath))
-	if err != nil {
-		t.Fatalf("open capture dir: %v", err)
-	}
-	t.Cleanup(func() {
-		if cerr := root.Close(); cerr != nil {
-			t.Errorf("close capture dir: %v", cerr)
-		}
-	})
-	data, err := root.ReadFile(first.Name())
-	if err != nil {
-		t.Fatalf("read capture: %v", err)
-	}
-	if string(data) != "abc" {
-		t.Errorf("capture contents = %q, want %q", data, "abc")
-	}
-}
-
 // ───────────────────────────────────────────────────────────────────────
 // maybeForceGC — table covers the offset-modulus contract.
 // ───────────────────────────────────────────────────────────────────────
@@ -422,16 +335,6 @@ func BenchmarkLogRecvDebug_off(b *testing.B) {
 	}
 }
 
-func BenchmarkCaptureToFileIfEnabled_off(b *testing.B) {
-	b.ReportAllocs()
-	x := newNetlinkerXTCP(&testing.T{})
-	payload := []byte("z")
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		x.captureToFileIfEnabled(0, payload, 1) // wf=0 → no I/O
-	}
-}
-
 func BenchmarkRecvOneFromKernel_closedFD(b *testing.B) {
 	// Exercises the err-path (closed fd → syscall error, retry=true).
 	b.ReportAllocs()
diff --git a/pkg/xtcp/netlinker_nocapture.go b/pkg/xtcp/netlinker_nocapture.go
new file mode 100644
index 000000000..f2a199053
--- /dev/null
+++ b/pkg/xtcp/netlinker_nocapture.go
@@ -0,0 +1,16 @@
+//go:build !capture
+
+package xtcp
+
+// CaptureCompiledIn reports whether this binary contains the netlink capture
+// writer (`-writeFiles` / `-capturePath`). It is a debugging tool, compiled in
+// only with `-tags capture`; see netlinker_capture.go.
+const CaptureCompiledIn = false
+
+// announceCapture is a no-op: there is no capture writer to arm.
+func (x *XTCP) announceCapture() {}
+
+// captureToFileIfEnabled is a no-op without the capture build tag. Startup
+// and ConfigService.Set both refuse -writeFiles > 0 on this build (see
+// CheckBuildSupport), so the budget is always 0 here.
+func (x *XTCP) captureToFileIfEnabled(_ uint32, _ []byte, _ uint32) uint32 { return 0 }
diff --git a/pkg/xtcp/redact_secrets_test.go b/pkg/xtcp/redact_secrets_test.go
new file mode 100644
index 000000000..e8abd7263
--- /dev/null
+++ b/pkg/xtcp/redact_secrets_test.go
@@ -0,0 +1,92 @@
+package xtcp
+
+import (
+	"regexp"
+	"testing"
+
+	"google.golang.org/protobuf/reflect/protoreflect"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+// secretFieldName matches config field names that look like they hold a
+// credential.
+var secretFieldName = regexp.MustCompile(`(^|_)(key|token|secret|password|passwd|credential)s?($|_)`)
+
+// notSecretFields are matches that are not credentials. Adding a name here is
+// a reviewed decision; a new credential field must go in RedactSecrets.
+var notSecretFields = map[protoreflect.FullName]bool{}
+
+// fillSecretLike sets every string field of m (recursing into singular
+// message fields) whose name matches secretFieldName, and returns their
+// full names.
+func fillSecretLike(m protoreflect.Message, depth int) []protoreflect.FullName {
+	if depth > 8 {
+		return nil
+	}
+	var names []protoreflect.FullName
+	fields := m.Descriptor().Fields()
+	for i := 0; i < fields.Len(); i++ {
+		fd := fields.Get(i)
+		switch {
+		case fd.IsList() || fd.IsMap():
+			continue
+		case fd.Kind() == protoreflect.MessageKind:
+			names = append(names, fillSecretLike(m.Mutable(fd).Message(), depth+1)...)
+		case fd.Kind() == protoreflect.StringKind && secretFieldName.MatchString(string(fd.Name())):
+			m.Set(fd, protoreflect.ValueOfString("secret-value"))
+			names = append(names, fd.FullName())
+		}
+	}
+	return names
+}
+
+// TestRedactSecretsCoversSecretLikeFields fails when a config field whose
+// name looks like a credential is not blanked by RedactSecrets, which is what
+// ConfigService.Get, the Set response and the soft-restart handoff all rely
+// on. It also proves the walk finds the known credentials, so a regexp that
+// silently matched nothing would fail too.
+func TestRedactSecretsCoversSecretLikeFields(t *testing.T) {
+	cfg := &xtcp_config.XtcpConfig{}
+	names := fillSecretLike(cfg.ProtoReflect(), 0)
+
+	known := map[protoreflect.FullName]bool{
+		"xtcp_config.v1.XtcpConfig.s3_access_key":     false,
+		"xtcp_config.v1.XtcpConfig.s3_secret_key":     false,
+		"xtcp_config.v1.ListenerAuth.raw_token":       false,
+		"xtcp_config.v1.ListenerAuth.hmac_shared_key": false,
+	}
+	for _, n := range names {
+		if _, ok := known[n]; ok {
+			known[n] = true
+		}
+	}
+	for n, seen := range known {
+		if !seen {
+			t.Errorf("descriptor walk did not find known credential field %s", n)
+		}
+	}
+
+	RedactSecrets(cfg)
+	leaked := map[protoreflect.FullName]bool{}
+	var check func(m protoreflect.Message, depth int)
+	check = func(m protoreflect.Message, depth int) {
+		if depth > 8 {
+			return
+		}
+		m.Range(func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool {
+			switch {
+			case fd.IsList() || fd.IsMap():
+			case fd.Kind() == protoreflect.MessageKind:
+				check(v.Message(), depth+1)
+			case fd.Kind() == protoreflect.StringKind && v.String() == "secret-value" && !notSecretFields[fd.FullName()]:
+				leaked[fd.FullName()] = true
+			}
+			return true
+		})
+	}
+	check(cfg.ProtoReflect(), 0)
+	for n := range leaked {
+		t.Errorf("RedactSecrets does not blank %s: add it there (or, if it is not a credential, to notSecretFields)", n)
+	}
+}
diff --git a/pkg/xtcp/s3_endpoint.go b/pkg/xtcp/s3_endpoint.go
new file mode 100644
index 000000000..37efc739a
--- /dev/null
+++ b/pkg/xtcp/s3_endpoint.go
@@ -0,0 +1,65 @@
+package xtcp
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+// ErrInsecureTransport marks a config that would send a credential over a
+// plaintext connection without the operator opting in. The CLI maps it to a
+// usage exit; ConfigService.Set refuses it.
+var ErrInsecureTransport = errors.New("insecure transport")
+
+// S3Endpoint resolves the s3parquet endpoint to the host[:port] form minio
+// expects, and whether to use TLS. The endpoint is the address after
+// `s3parquet:` in Dest, else S3Endpoint (-s3Endpoint / S3_ENDPOINT).
+//
+//   - https://host[:port] and a bare host[:port] use TLS.
+//   - http://host[:port] is refused unless S3AllowInsecure is set: the access
+//     key signs every request and each object crosses the network, so
+//     plaintext is for local test fixtures only.
+//   - any other scheme is refused.
+func S3Endpoint(c *xtcp_config.XtcpConfig) (host string, secure bool, err error) {
+	endpoint := c.GetS3Endpoint()
+	if rest, ok := strings.CutPrefix(c.GetDest(), schemeS3Parquet+":"); ok && rest != "" {
+		endpoint = rest
+	}
+	if endpoint == "" {
+		return "", false, errors.New("s3parquet endpoint is empty (set -dest s3parquet:<endpoint> or S3_ENDPOINT)")
+	}
+	switch {
+	case strings.HasPrefix(endpoint, "https://"):
+		host, secure = strings.TrimPrefix(endpoint, "https://"), true
+	case strings.HasPrefix(endpoint, "http://"):
+		if !c.GetS3AllowInsecure() {
+			return "", false, fmt.Errorf("%w: s3parquet endpoint %q is plaintext http; the S3 credential and every "+
+				"object would cross the network unencrypted. Use https:// (or a bare host:port, which uses TLS), "+
+				"or set -s3AllowInsecure (S3_ALLOW_INSECURE=true) for a local test fixture", ErrInsecureTransport, endpoint)
+		}
+		host, secure = strings.TrimPrefix(endpoint, "http://"), false
+	case strings.Contains(endpoint, "://"):
+		scheme, _, _ := strings.Cut(endpoint, "://")
+		return "", false, fmt.Errorf("s3parquet endpoint %q: unsupported scheme %q (use https://, or http:// with -s3AllowInsecure)", endpoint, scheme)
+	default:
+		host, secure = endpoint, true
+	}
+	if host == "" {
+		return "", false, fmt.Errorf("s3parquet endpoint %q has no host", endpoint)
+	}
+	return host, secure, nil
+}
+
+// CheckS3Transport applies S3Endpoint's transport rules when Dest selects
+// s3parquet; any other destination passes. It runs at startup and in
+// ConfigService.Set, so a plaintext endpoint fails before the daemon starts
+// instead of when the destination is built.
+func CheckS3Transport(c *xtcp_config.XtcpConfig) error {
+	if scheme, _, _ := strings.Cut(c.GetDest(), ":"); scheme != schemeS3Parquet {
+		return nil
+	}
+	_, _, err := S3Endpoint(c)
+	return err
+}
diff --git a/pkg/xtcp/s3_endpoint_test.go b/pkg/xtcp/s3_endpoint_test.go
new file mode 100644
index 000000000..db6f51b9b
--- /dev/null
+++ b/pkg/xtcp/s3_endpoint_test.go
@@ -0,0 +1,93 @@
+package xtcp
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/randomizedcoder/xtcp2/gen/go/xtcp_config"
+)
+
+func TestS3Endpoint(t *testing.T) {
+	t.Parallel()
+	type want struct {
+		host     string
+		secure   bool
+		err      bool
+		insecure bool // err is ErrInsecureTransport
+	}
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		cfg         *xtcp_config.XtcpConfig
+		expected    want
+	}{
+		{"https_dest", "positive", "https:// in -dest uses TLS",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:https://s3.example:443"},
+			want{host: "s3.example:443", secure: true}},
+		{"s3_bare_endpoint", "boundary", "a bare host:port uses TLS (was plaintext)",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:s3.example:9000"},
+			want{host: "s3.example:9000", secure: true}},
+		{"endpoint_from_flag", "positive", "bare -dest s3parquet: falls back to S3Endpoint",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:", S3Endpoint: "https://s3.example"},
+			want{host: "s3.example", secure: true}},
+		{"s3_http_refused", "negative", "http:// without the opt-in is refused",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:http://127.0.0.1:9000"},
+			want{err: true, insecure: true}},
+		{"s3_http_flag_refused", "negative", "http:// via S3Endpoint is refused too",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet", S3Endpoint: "http://127.0.0.1:9000"},
+			want{err: true, insecure: true}},
+		{"s3_http_allowed", "positive", "http:// with -s3AllowInsecure is plaintext",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:http://127.0.0.1:9000", S3AllowInsecure: true},
+			want{host: "127.0.0.1:9000", secure: false}},
+		{"unknown_scheme", "negative", "another URL scheme is refused",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:ftp://s3.example"},
+			want{err: true}},
+		{"empty", "corner", "no endpoint anywhere",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:"},
+			want{err: true}},
+		{"scheme_only", "corner", "https:// with no host",
+			&xtcp_config.XtcpConfig{Dest: "s3parquet:https://"},
+			want{err: true}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			t.Parallel()
+			host, secure, err := S3Endpoint(tc.cfg)
+			if (err != nil) != tc.expected.err {
+				t.Fatalf("%s: err = %v, want err %v", tc.description, err, tc.expected.err)
+			}
+			if got := errors.Is(err, ErrInsecureTransport); got != tc.expected.insecure {
+				t.Errorf("%s: ErrInsecureTransport = %v, want %v (%v)", tc.description, got, tc.expected.insecure, err)
+			}
+			if err == nil && (host != tc.expected.host || secure != tc.expected.secure) {
+				t.Errorf("%s: got (%q, %v), want (%q, %v)", tc.description, host, secure, tc.expected.host, tc.expected.secure)
+			}
+		})
+	}
+}
+
+func TestCheckS3Transport(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name        string
+		category    string
+		description string
+		cfg         *xtcp_config.XtcpConfig
+		expected    bool // refused
+	}{
+		{"not_s3", "positive", "other destinations are not its concern", &xtcp_config.XtcpConfig{Dest: "kafka:b:9092"}, false},
+		{"s3_https", "positive", "https passes", &xtcp_config.XtcpConfig{Dest: "s3parquet:https://s3"}, false},
+		{"s3_http", "negative", "plaintext is refused", &xtcp_config.XtcpConfig{Dest: "s3parquet:http://s3"}, true},
+		{"http_dest", "corner", "the http destination is not s3parquet", &xtcp_config.XtcpConfig{Dest: "http://collector"}, false},
+		{"nil", "corner", "nil config", nil, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.category+"/"+tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := CheckS3Transport(tc.cfg) != nil; got != tc.expected {
+				t.Errorf("%s: refused = %v, want %v", tc.description, got, tc.expected)
+			}
+		})
+	}
+}
diff --git a/proto/xtcp_config/v1/xtcp_config.proto b/proto/xtcp_config/v1/xtcp_config.proto
index e3a914f64..d76b2f2f8 100644
--- a/proto/xtcp_config/v1/xtcp_config.proto
+++ b/proto/xtcp_config/v1/xtcp_config.proto
@@ -952,6 +952,22 @@ message XtcpConfig {
 		(buf.validate.field).required = false
 	];
 
+	// Allow a plaintext http:// S3 endpoint. The credential and every
+	// uploaded object would cross the network in the clear, so the daemon
+	// refuses http:// unless this is set; a bare host:port and https:// both
+	// use TLS. For local test fixtures only. Sets the xtcp2_s3_insecure gauge.
+	bool s3_allow_insecure                           = 107 [
+		(buf.validate.field).required = false
+	];
+
+	// PEM bundle of CA certificates to trust for the S3 endpoint, in addition
+	// to the system roots. For a private CA in front of an S3-compatible
+	// store. Empty = system roots only.
+	string s3_ca_file                                = 108 [
+		(buf.validate.field).required = false,
+		(buf.validate.field).string.max_len = 4096
+	];
+
 	// Soft cap on the in-memory Parquet builder's accumulated
 	// uncompressed row bytes before the worker finalizes the file and
 	// uploads. Default 0 → 63 MiB (S3ParquetFlushThresholdBytesCst).