refactor(storage): new storage file structure

- new directory structure containing manifest.json and one json file per provider, by default.
- the manifest.json file can specify a filepath for each vpn provider
- each vpn provider json data file can contain the `"preferred": true` field to enforce it is used even if outdated, unless there is a version mismatch
- `STORAGE_SERVERS_DIRECTORY_PATH` replaces `STORAGE_FILEPATH` (which is now a migration source only). It sets the directory where server manifest and per-provider JSON files are stored (default: `/gluetun/servers/`).
- First-run migration: On startup, gluetun checks for the old /gluetun/servers.json file; if found and no new manifest exists, it automatically migrates all data to /gluetun/servers/ directory structure
- Silent fallback: If legacy file isn't found, uses the new directory path normally
- Legacy cleanup: After successful migration, attempts to remove the old fat JSON file (logs warning only if removal fails, e.g., read-only bind mounts)

Co-authored-by: Copilot <copilot@github.com>

Dockerfile

@@ -273,7 +273,7 @@ ENV VPN_SERVICE_PROVIDER=pia \
     PUBLICIP_API=ipinfo,ifconfigco,ip2location,cloudflare \
     PUBLICIP_API_TOKEN= \
     # Storage
-    STORAGE_FILEPATH=/gluetun/servers.json \
+    STORAGE_SERVERS_DIRECTORY_PATH=/gluetun/servers/ \
     # Pprof
     PPROF_ENABLED=no \
     PPROF_BLOCK_PROFILE_RATE=0 \

cmd/gluetun/main.go

@@ -171,7 +171,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 
 	defer fmt.Println(gluetunLogo)
 
-	announcementExp, err := time.Parse(time.RFC3339, "2026-04-30T00:00:00Z")
+	announcementExp, err := time.Parse(time.RFC3339, "2026-06-30T00:00:00Z")
 	if err != nil {
 		return err
 	}
@@ -182,7 +182,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 		Version:      buildInfo.Version,
 		Commit:       buildInfo.Commit,
 		Created:      buildInfo.Created,
-		Announcement: "Set BORINGPOLL_GLUETUNCOM=on to help combat AI slop and shutdown that scam website",
+		Announcement: "Your servers data files are now migrated to /gluetun/servers/",
 		AnnounceExp:  announcementExp,
 		// Sponsor information
 		PaypalUser:    "qmcgaw",
@@ -245,7 +245,8 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 
 	// TODO run this in a loop or in openvpn to reload from file without restarting
 	storageLogger := logger.New(log.SetComponent("storage"))
-	storage, err := storage.New(storageLogger, *allSettings.Storage.Filepath)
+	storage, err := storage.New(storageLogger, *allSettings.Storage.ServersPath,
+		*allSettings.Storage.LegacyServersFilepath)
 	if err != nil {
 		return err
 	}

go.mod

@@ -54,6 +54,7 @@ require (
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.60.1 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/qdm12/gluetun-servers v0.1.0
 	github.com/qdm12/goservices v0.1.1-0.20251104135713-6bee97bd4978 // indirect
 	github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
@@ -66,3 +67,5 @@ require (
 	kernel.org/pub/linux/libs/security/libcap/cap v1.2.70 // indirect
 	kernel.org/pub/linux/libs/security/libcap/psx v1.2.70 // indirect
 )
+
+replace github.com/qdm12/gluetun-servers => ./gluetun-servers //nolint:gomoddirectives

internal/cli/cli.go

@@ -1,11 +1,7 @@
 package cli
 
-type CLI struct {
+type CLI struct{}
-	repoServersPath string
-}
 
 func New() *CLI {
-	return &CLI{
+	return &CLI{}
-		repoServersPath: "./internal/storage/servers.json",
-	}
 }

internal/cli/formatservers.go

@@ -9,9 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
-	"github.com/qdm12/gluetun/internal/storage"
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
 )
@@ -80,10 +78,9 @@ func (c *CLI) FormatServers(args []string) error {
 		}
 	}
 
-	logger := newNoopLogger()
+	storage, err := setupStorage(newNoopLogger())
-	storage, err := storage.New(logger, constants.ServersData)
 	if err != nil {
-		return fmt.Errorf("creating servers storage: %w", err)
+		return fmt.Errorf("setting up storage: %w", err)
 	}
 
 	formatted, err := storage.Format(providerToFormat, format)

internal/cli/helpers.go

@@ -0,0 +1,39 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/qdm12/gluetun/internal/configuration/settings"
+	"github.com/qdm12/gluetun/internal/configuration/sources/files"
+	"github.com/qdm12/gluetun/internal/configuration/sources/secrets"
+	"github.com/qdm12/gluetun/internal/storage"
+	"github.com/qdm12/gosettings/reader"
+	"github.com/qdm12/gosettings/reader/sources/env"
+)
+
+type storageSetupLogger interface {
+	storage.Logger
+	files.Warner
+}
+
+func setupStorage(logger storageSetupLogger) (s *storage.Storage, err error) {
+	settingsReader := reader.New(reader.Settings{
+		Sources: []reader.Source{
+			secrets.New(logger),
+			files.New(logger),
+			env.New(env.Settings{}),
+		},
+	})
+	var settings settings.Storage
+	err = settings.Read(settingsReader)
+	if err != nil {
+		return nil, fmt.Errorf("reading storage settings: %w", err)
+	}
+	settings.SetDefaults()
+	storage, err := storage.New(logger, *settings.ServersPath,
+		*settings.LegacyServersFilepath)
+	if err != nil {
+		return nil, fmt.Errorf("creating storage: %w", err)
+	}
+	return storage, nil
+}

internal/cli/nooplogger.go

@@ -6,5 +6,7 @@ func newNoopLogger() *noopLogger {
 	return new(noopLogger)
 }
 
-func (l *noopLogger) Info(string) {}
+func (l *noopLogger) Info(string)          {}
-func (l *noopLogger) Warn(string) {}
+func (l *noopLogger) Infof(string, ...any) {}
+func (l *noopLogger) Warn(string)          {}
+func (l *noopLogger) Warnf(string, ...any) {}

internal/cli/openvpnconfig.go

@@ -9,12 +9,10 @@ import (
 	"time"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
-	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/netlink"
 	"github.com/qdm12/gluetun/internal/openvpn/extract"
 	"github.com/qdm12/gluetun/internal/provider"
-	"github.com/qdm12/gluetun/internal/storage"
 	"github.com/qdm12/gluetun/internal/updater/resolver"
 	"github.com/qdm12/gosettings/reader"
 )
@@ -49,9 +47,9 @@ type IPv6Checker interface {
 func (c *CLI) OpenvpnConfig(logger OpenvpnConfigLogger, reader *reader.Reader,
 	ipv6Checker IPv6Checker,
 ) error {
-	storage, err := storage.New(logger, constants.ServersData)
+	storage, err := setupStorage(newNoopLogger())
 	if err != nil {
-		return err
+		return fmt.Errorf("setting up storage: %w", err)
 	}
 
 	var allSettings settings.Settings

internal/cli/update.go

@@ -13,19 +13,16 @@ import (
 	"github.com/qdm12/dns/v2/pkg/doh"
 	dnsprovider "github.com/qdm12/dns/v2/pkg/provider"
 	"github.com/qdm12/gluetun/internal/configuration/settings"
-	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gluetun/internal/constants/providers"
 	"github.com/qdm12/gluetun/internal/openvpn/extract"
 	"github.com/qdm12/gluetun/internal/provider"
 	"github.com/qdm12/gluetun/internal/publicip/api"
-	"github.com/qdm12/gluetun/internal/storage"
 	"github.com/qdm12/gluetun/internal/updater"
 	"github.com/qdm12/gluetun/internal/updater/resolver"
 	"github.com/qdm12/gluetun/internal/updater/unzip"
 )
 
 var (
-	ErrModeUnspecified     = errors.New("at least one of -enduser or -maintainer must be specified")
 	ErrNoProviderSpecified = errors.New("no provider was specified")
 	ErrUsernameMissing     = errors.New("username is required for this provider")
 	ErrPasswordMissing     = errors.New("password is required for this provider")
@@ -33,18 +30,19 @@ var (
 
 type UpdaterLogger interface {
 	Info(s string)
+	Infof(format string, args ...any)
 	Warn(s string)
+	Warnf(format string, args ...any)
 	Error(s string)
 }
 
 func (c *CLI) Update(ctx context.Context, args []string, logger UpdaterLogger) error {
 	options := settings.Updater{}
-	var endUserMode, maintainerMode, updateAll bool
+	var endUserMode, updateAll bool
 	var dnsServer, csvProviders, ipToken, protonUsername, protonEmail, protonPassword string
 	flagSet := flag.NewFlagSet("update", flag.ExitOnError)
-	flagSet.BoolVar(&endUserMode, "enduser", false, "Write results to /gluetun/servers.json (for end users)")
+	flagSet.BoolVar(&endUserMode, "enduser", false, // TODO v4: remove
-	flagSet.BoolVar(&maintainerMode, "maintainer", false,
+		"Write results to /gluetun/servers/ (for end users)")
-		"Write results to ./internal/storage/servers.json to modify the program (for maintainers)")
 	flagSet.StringVar(&dnsServer, "dns", "", "no longer used, your DNS will use DoH with Cloudflare and Google")
 	const defaultMinRatio = 0.8
 	flagSet.Float64Var(&options.MinRatio, "minratio", defaultMinRatio,
@@ -64,10 +62,6 @@ func (c *CLI) Update(ctx context.Context, args []string, logger UpdaterLogger) e
 		logger.Warn("The -dns flag is no longer used, your DNS will use DoH with Cloudflare and Google")
 	}
 
-	if !endUserMode && !maintainerMode {
-		return fmt.Errorf("%w", ErrModeUnspecified)
-	}
-
 	if updateAll {
 		options.Providers = providers.All()
 	} else {
@@ -94,11 +88,7 @@ func (c *CLI) Update(ctx context.Context, args []string, logger UpdaterLogger) e
 		return fmt.Errorf("options validation failed: %w", err)
 	}
 
-	serversDataPath := constants.ServersData
+	storage, err := setupStorage(logger)
-	if maintainerMode {
-		serversDataPath = ""
-	}
-	storage, err := storage.New(logger, serversDataPath)
 	if err != nil {
 		return fmt.Errorf("creating servers storage: %w", err)
 	}
@@ -140,12 +130,5 @@ func (c *CLI) Update(ctx context.Context, args []string, logger UpdaterLogger) e
 		return fmt.Errorf("updating server information: %w", err)
 	}
 
-	if maintainerMode {
-		err := storage.FlushToFile(c.repoServersPath)
-		if err != nil {
-			return fmt.Errorf("writing servers data to embedded JSON file: %w", err)
-		}
-	}
-
 	return nil
 }

internal/configuration/settings/settings.go

@@ -132,7 +132,7 @@ func (s *Settings) SetDefaults() {
 	s.IPv6.setDefaults()
 	s.PublicIP.setDefaults()
 	s.Shadowsocks.setDefaults()
-	s.Storage.setDefaults()
+	s.Storage.SetDefaults()
 	s.System.setDefaults()
 	s.Version.setDefaults()
 	s.VPN.setDefaults()
@@ -213,7 +213,7 @@ func (s *Settings) Read(r *reader.Reader, warner Warner) (err error) {
 			return s.PublicIP.read(r, warner)
 		},
 		"shadowsocks": s.Shadowsocks.read,
-		"storage":     s.Storage.read,
+		"storage":     s.Storage.Read,
 		"system":      s.System.read,
 		"updater":     s.Updater.read,
 		"version":     s.Version.read,

internal/configuration/settings/settings_test.go

@@ -90,7 +90,7 @@ func Test_Settings_String(t *testing.T) {
 |   ├── Logging: yes
 |   └── Authentication file path: /gluetun/auth/config.toml
 ├── Storage settings:
-|   └── Filepath: /gluetun/servers.json
+|   └── Servers directory path: /gluetun/servers/
 ├── OS Alpine settings:
 |   ├── Process UID: 1000
 |   └── Process GID: 1000

internal/configuration/settings/storage.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"path/filepath"
 
+	"github.com/qdm12/gluetun/internal/constants"
 	"github.com/qdm12/gosettings"
 	"github.com/qdm12/gosettings/reader"
 	"github.com/qdm12/gotree"
@@ -11,15 +12,25 @@ import (
 
 // Storage contains settings to configure the storage.
 type Storage struct {
-	// Filepath is the path to the servers.json file. An empty string disables on-disk storage.
+	// ServersPath is the path to the servers files directory.
-	Filepath *string
+	// An empty string disables on-disk storage.
+	ServersPath *string
+	// LegacyServersFilepath is the legacy "fat" JSON filepath to migrate from.
+	// TODO v4: remove
+	LegacyServersFilepath *string
 }
 
 func (s Storage) validate() (err error) {
-	if *s.Filepath != "" { // optional
+	if *s.ServersPath != "" { // optional
-		_, err := filepath.Abs(*s.Filepath)
+		_, err := filepath.Abs(*s.ServersPath)
 		if err != nil {
-			return fmt.Errorf("filepath is not valid: %w", err)
+			return fmt.Errorf("servers path is not valid: %w", err)
+		}
+	}
+	if *s.LegacyServersFilepath != "" {
+		_, err := filepath.Abs(*s.LegacyServersFilepath)
+		if err != nil {
+			return fmt.Errorf("legacy servers filepath is not valid: %w", err)
 		}
 	}
 	return nil
@@ -27,17 +38,20 @@ func (s Storage) validate() (err error) {
 
 func (s *Storage) copy() (copied Storage) {
 	return Storage{
-		Filepath: gosettings.CopyPointer(s.Filepath),
+		ServersPath:           gosettings.CopyPointer(s.ServersPath),
+		LegacyServersFilepath: gosettings.CopyPointer(s.LegacyServersFilepath),
 	}
 }
 
 func (s *Storage) overrideWith(other Storage) {
-	s.Filepath = gosettings.OverrideWithPointer(s.Filepath, other.Filepath)
+	s.ServersPath = gosettings.OverrideWithPointer(s.ServersPath, other.ServersPath)
+	s.LegacyServersFilepath = gosettings.OverrideWithPointer(s.LegacyServersFilepath, other.LegacyServersFilepath)
 }
 
-func (s *Storage) setDefaults() {
+func (s *Storage) SetDefaults() {
-	const defaultFilepath = "/gluetun/servers.json"
+	const defaultServersPath = "/gluetun/servers/"
-	s.Filepath = gosettings.DefaultPointer(s.Filepath, defaultFilepath)
+	s.ServersPath = gosettings.DefaultPointer(s.ServersPath, defaultServersPath)
+	s.LegacyServersFilepath = gosettings.DefaultPointer(s.LegacyServersFilepath, constants.ServersDataLegacy)
 }
 
 func (s Storage) String() string {
@@ -45,15 +59,29 @@ func (s Storage) String() string {
 }
 
 func (s Storage) toLinesNode() (node *gotree.Node) {
-	if *s.Filepath == "" {
+	if *s.ServersPath == "" {
 		return gotree.New("Storage settings: disabled")
 	}
 	node = gotree.New("Storage settings:")
-	node.Appendf("Filepath: %s", *s.Filepath)
+	node.Appendf("Servers directory path: %s", *s.ServersPath)
+	if *s.LegacyServersFilepath != constants.ServersDataLegacy {
+		node.Appendf("Legacy servers filepath: %s", *s.LegacyServersFilepath)
+	}
 	return node
 }
 
-func (s *Storage) read(r *reader.Reader) (err error) {
+func (s *Storage) Read(r *reader.Reader) (err error) {
-	s.Filepath = r.Get("STORAGE_FILEPATH", reader.AcceptEmpty(true))
+	// Retro-compatibility:
+	// TODO v4: remove support for STORAGE_FILEPATH
+	filePath := r.Get("STORAGE_FILEPATH", reader.AcceptEmpty(true), reader.IsRetro("STORAGE_SERVERS_DIRECTORY_PATH"))
+	if filePath != nil {
+		s.LegacyServersFilepath = filePath
+		if *filePath == "" {
+			s.ServersPath = ptrTo("") // skip disk operations
+		}
+	}
+	if s.ServersPath == nil {
+		s.ServersPath = r.Get("STORAGE_SERVERS_DIRECTORY_PATH", reader.AcceptEmpty(true))
+	}
 	return nil
 }

internal/constants/paths.go

@@ -1,6 +1,6 @@
 package constants
 
 const (
-	// ServersData is the server information filepath.
+	// ServersDataLegacy is the old server information filepath.
-	ServersData = "/gluetun/servers.json"
+	ServersDataLegacy = "/gluetun/servers.json"
 )

internal/models/servers.go

@@ -155,6 +155,8 @@ func (a *AllServers) Count() (count int) {
 type Servers struct {
 	Version   uint16   `json:"version"`
 	Timestamp int64    `json:"timestamp"`
+	Preferred bool     `json:"preferred,omitempty"`
+	Filepath  string   `json:"filepath,omitempty"`
 	Servers   []Server `json:"servers,omitempty"`
 }
 

internal/storage/flush.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"sort"
@@ -9,44 +10,76 @@ import (
 	"github.com/qdm12/gluetun/internal/models"
 )
 
-// FlushToFile flushes the merged servers data to the file
+// flushToFile flushes the merged servers data to files
-// specified by path, as indented JSON.
+// using the manifest file path given. It is not thread-safe.
-func (s *Storage) FlushToFile(path string) error {
+func (s *Storage) flushToFile(manifestPath string) error {
-	s.mergedMutex.RLock()
+	const (
-	defer s.mergedMutex.RUnlock()
+		filePermission = 0o644
+		dirPermission  = 0o755
+	)
 
-	return s.flushToFile(path)
+	serversDirectoryPath := filepath.Dir(manifestPath)
-}
+	if err := os.MkdirAll(serversDirectoryPath, dirPermission); err != nil {
-
+		return fmt.Errorf("creating directory: %w", err)
-// flushToFile flushes the merged servers data to the file
-// specified by path, as indented JSON. It is not thread-safe.
-func (s *Storage) flushToFile(path string) error {
-	if path == "" {
-		return nil // no file to write to
-	}
-	const permission = 0o644
-	dirPath := filepath.Dir(path)
-	if err := os.MkdirAll(dirPath, permission); err != nil {
-		return err
 	}
 
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, permission)
+	for provider, providerServers := range s.mergedServers.ProviderToServers {
+		providerFilepath := providerServers.Filepath
+		if providerFilepath == "" {
+			providerFilepath = filepath.Join(serversDirectoryPath, provider+".json")
+		}
+
+		providerDirectoryPath := filepath.Dir(providerFilepath)
+		if err := os.MkdirAll(providerDirectoryPath, dirPermission); err != nil {
+			return fmt.Errorf("creating directory: %w", err)
+		}
+	}
+
+	metadata := map[string]any{"version": s.mergedServers.Version}
+
+	for provider, providerServers := range s.mergedServers.ProviderToServers {
+		sort.Sort(models.SortableServers(providerServers.Servers))
+
+		providerFilepath := providerServers.Filepath
+		if providerFilepath == "" {
+			providerFilepath = filepath.Join(serversDirectoryPath, provider+".json")
+		}
+
+		providerFile, err := os.OpenFile(providerFilepath,
+			os.O_CREATE|os.O_WRONLY|os.O_TRUNC, filePermission)
+		if err != nil {
+			return fmt.Errorf("opening servers data file for %s: %w", provider, err)
+		}
+
+		encoder := json.NewEncoder(providerFile)
+		encoder.SetIndent("", "  ")
+		err = encoder.Encode(providerServers)
+		if err != nil {
+			_ = providerFile.Close()
+			return fmt.Errorf("encoding servers data for %s: %w", provider, err)
+		}
+
+		err = providerFile.Close()
+		if err != nil {
+			return fmt.Errorf("closing servers data file for %s: %w", provider, err)
+		}
+
+		metadata[provider] = map[string]string{"filepath": providerFilepath}
+	}
+
+	serversFile, err := os.OpenFile(manifestPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, filePermission)
 	if err != nil {
 		return err
 	}
 
-	encoder := json.NewEncoder(file)
+	encoder := json.NewEncoder(serversFile)
 	encoder.SetIndent("", "  ")
 
-	for _, obj := range s.mergedServers.ProviderToServers {
+	err = encoder.Encode(metadata)
-		sort.Sort(models.SortableServers(obj.Servers))
-	}
-
-	err = encoder.Encode(&s.mergedServers)
 	if err != nil {
-		_ = file.Close()
+		_ = serversFile.Close()
 		return err
 	}
 
-	return file.Close()
+	return serversFile.Close()
 }

internal/storage/hardcoded.go

@@ -3,19 +3,50 @@ package storage
 import (
 	"embed"
 	"encoding/json"
+	"fmt"
+	"path"
 
+	serversmodule "github.com/qdm12/gluetun-servers/pkg/servers"
 	"github.com/qdm12/gluetun/internal/models"
 )
 
 //go:embed servers.json
 var allServersEmbedFS embed.FS
 
-func parseHardcodedServers() (allServers models.AllServers, err error) {
+func parseHardcodedServers() (allServers models.AllServers) {
 	f, err := allServersEmbedFS.Open("servers.json")
 	if err != nil {
-		return allServers, err
+		panic(err)
 	}
+	defer f.Close() // no-op
 	decoder := json.NewDecoder(f)
 	err = decoder.Decode(&allServers)
-	return allServers, err
+	if err != nil {
+		panic("decoding servers.json: " + err.Error())
+	}
+
+	for provider, metadata := range allServers.ProviderToServers {
+		filename := path.Base(metadata.Filepath)
+		providerFile, err := serversmodule.Files.Open(filename)
+		if err != nil {
+			panic(fmt.Sprintf("reading embedded provider file %s for %s: %s", filename, provider, err))
+		}
+		defer providerFile.Close() // no-op
+
+		var providerServers models.Servers
+		decoder := json.NewDecoder(providerFile)
+		err = decoder.Decode(&providerServers)
+		if err != nil {
+			panic(fmt.Sprintf("JSON decoding embedded provider file %s for %s: %s",
+				filename, provider, err))
+		} else if providerServers.Filepath != "" {
+			panic(fmt.Sprintf("embedded provider file %s for %s should not have filepath set",
+				filename, provider))
+		}
+
+		providerServers.Filepath = metadata.Filepath // inherit filepath from servers.json
+		allServers.ProviderToServers[provider] = providerServers
+	}
+
+	return allServers
 }

internal/storage/hardcoded_test.go

@@ -1,9 +1,13 @@
 package storage
 
 import (
+	"encoding/json"
+	"path"
 	"testing"
 
+	"github.com/qdm12/gluetun-servers/pkg/servers"
 	"github.com/qdm12/gluetun/internal/constants/providers"
+	"github.com/qdm12/gluetun/internal/models"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -11,9 +15,10 @@ import (
 func Test_parseHardcodedServers(t *testing.T) {
 	t.Parallel()
 
-	servers, err := parseHardcodedServers()
+	var servers models.AllServers
-
+	assert.NotPanics(t, func() {
-	require.NoError(t, err)
+		servers = parseHardcodedServers()
+	})
 
 	// all providers minus custom
 	allProviders := providers.All()
@@ -24,3 +29,35 @@ func Test_parseHardcodedServers(t *testing.T) {
 		assert.NotEmptyf(t, servers, "for provider %s", provider)
 	}
 }
+
+func Test_parseHardcodedServers_filepathsAndEmbeddedProviderFiles(t *testing.T) {
+	t.Parallel()
+
+	hardcodedServers := parseHardcodedServers()
+
+	allProviders := providers.All()
+	for _, provider := range allProviders {
+		providerServers, ok := hardcodedServers.ProviderToServers[provider]
+		require.Truef(t, ok, "for provider %s", provider)
+
+		require.NotEmptyf(t, providerServers.Filepath,
+			"embedded servers filepath should be set for provider %s", provider)
+
+		filename := path.Base(providerServers.Filepath)
+		file, err := servers.Files.Open(filename)
+		require.NoErrorf(t, err, "opening embedded provider file for %s", provider)
+
+		var fileServers struct {
+			Version   uint16            `json:"version"`
+			Timestamp int64             `json:"timestamp"`
+			Servers   []json.RawMessage `json:"servers"`
+		}
+		err = json.NewDecoder(file).Decode(&fileServers)
+		require.NoErrorf(t, err, "decoding embedded provider file for %s", provider)
+		require.NoError(t, file.Close())
+
+		assert.NotZerof(t, fileServers.Version, "for provider %s", provider)
+		assert.NotZerof(t, fileServers.Timestamp, "for provider %s", provider)
+		assert.NotEmptyf(t, fileServers.Servers, "for provider %s", provider)
+	}
+}

internal/storage/merge.go

@@ -30,6 +30,20 @@ func (s *Storage) mergeServers(hardcoded, persisted models.AllServers) models.Al
 func (s *Storage) mergeProviderServers(provider string,
 	hardcoded, persisted models.Servers,
 ) (merged models.Servers) {
+	if persisted.Preferred && persisted.Version != hardcoded.Version {
+		s.logger.Warn(fmt.Sprintf(
+			"persisted preferred %s servers are discarded because they have version %d and hardcoded servers have version %d",
+			provider, persisted.Version, hardcoded.Version))
+	}
+
+	// If persisted data is marked as preferred, use it regardless of timestamp
+	// (as long as versions match)
+	if persisted.Preferred && persisted.Version == hardcoded.Version && len(persisted.Servers) > 0 {
+		s.logger.Info(fmt.Sprintf(
+			"Using %s servers from file (marked as preferred)", provider))
+		return persisted
+	}
+
 	nowTimestamp := time.Now().Unix()
 	if persisted.Timestamp > nowTimestamp {
 		s.logger.Warn(fmt.Sprintf(

internal/storage/mocks_test.go

@@ -45,6 +45,23 @@ func (mr *MockLoggerMockRecorder) Info(arg0 interface{}) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), arg0)
 }
 
+// Infof mocks base method.
+func (m *MockLogger) Infof(arg0 string, arg1 ...interface{}) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0}
+	for _, a := range arg1 {
+		varargs = append(varargs, a)
+	}
+	m.ctrl.Call(m, "Infof", varargs...)
+}
+
+// Infof indicates an expected call of Infof.
+func (mr *MockLoggerMockRecorder) Infof(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0}, arg1...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Infof", reflect.TypeOf((*MockLogger)(nil).Infof), varargs...)
+}
+
 // Warn mocks base method.
 func (m *MockLogger) Warn(arg0 string) {
 	m.ctrl.T.Helper()

internal/storage/read.go

@@ -12,29 +12,30 @@ import (
 	"golang.org/x/text/language"
 )
 
-// readFromFile reads the servers from server.json.
+// readFromFile reads the servers data starting from the given manifest file path.
 // It only reads servers that have the same version as the hardcoded servers version
 // to avoid JSON decoding errors.
-func (s *Storage) readFromFile(filepath string, hardcodedVersions map[string]uint16) (
+func (s *Storage) readFromFile(manifestPath string, hardcodedVersions map[string]uint16) (
-	servers models.AllServers, err error,
+	servers models.AllServers, found bool, err error,
 ) {
-	file, err := os.Open(filepath)
+	file, err := os.Open(manifestPath)
 	if os.IsNotExist(err) {
-		return servers, nil
+		return servers, false, nil
 	} else if err != nil {
-		return servers, err
+		return servers, false, err
 	}
 
 	b, err := io.ReadAll(file)
 	if err != nil {
-		return servers, err
+		return servers, true, err
 	}
 
 	if err := file.Close(); err != nil {
-		return servers, err
+		return servers, true, err
 	}
 
-	return s.extractServersFromBytes(b, hardcodedVersions)
+	servers, err = s.extractServersFromBytes(b, hardcodedVersions)
+	return servers, true, err
 }
 
 func (s *Storage) extractServersFromBytes(b []byte, hardcodedVersions map[string]uint16) (
@@ -46,6 +47,12 @@ func (s *Storage) extractServersFromBytes(b []byte, hardcodedVersions map[string
 	}
 
 	// Note schema version is at map key "version" as number
+	if rawVersion, ok := rawMessages["version"]; ok {
+		err := json.Unmarshal(rawVersion, &servers.Version)
+		if err != nil {
+			return servers, fmt.Errorf("decoding servers schema version: %w", err)
+		}
+	}
 
 	allProviders := providers.All()
 	servers.ProviderToServers = make(map[string]models.Servers, len(allProviders))
@@ -86,25 +93,51 @@ func (s *Storage) readServers(provider string, hardcodedVersion uint16,
 ) {
 	provider = titleCaser.String(provider)
 
-	var versionObject struct {
+	var metadata struct {
-		Version uint16 `json:"version"`
+		Version   uint16 `json:"version"`
+		Timestamp int64  `json:"timestamp"`
+		Filepath  string `json:"filepath"`
 	}
 
-	err = json.Unmarshal(rawMessage, &versionObject)
+	err = json.Unmarshal(rawMessage, &metadata)
 	if err != nil {
 		return servers, false, fmt.Errorf("decoding servers version for provider %s: %w",
 			provider, err)
 	}
 
-	persistedVersion := versionObject.Version
+	if metadata.Filepath != "" {
+		providerFile, err := os.Open(metadata.Filepath)
+		if os.IsNotExist(err) {
+			return models.Servers{}, false, nil
+		} else if err != nil {
+			return models.Servers{}, false, fmt.Errorf("opening servers file %s for provider %s: %w",
+				metadata.Filepath, provider, err)
+		}
+		defer providerFile.Close()
 
-	versionsMatch = hardcodedVersion == persistedVersion
+		var referencedServers models.Servers
-	if !versionsMatch {
+		err = json.NewDecoder(providerFile).Decode(&referencedServers)
-		s.logger.Info(fmt.Sprintf(
+		if err != nil {
-			"%s servers from file discarded because they have "+
+			return models.Servers{}, false, fmt.Errorf("decoding servers file %s for provider %s: %w",
-				"version %d and hardcoded servers have version %d",
+				metadata.Filepath, provider, err)
-			provider, persistedVersion, hardcodedVersion))
+		}
-		return servers, versionsMatch, nil
+
+		versionsMatch = referencedServers.Version == hardcodedVersion
+		if !versionsMatch {
+			if referencedServers.Preferred {
+				s.logger.Warn(fmt.Sprintf(
+					"%s preferred servers from file %s discarded because they have version %d and hardcoded servers have version %d",
+					provider, metadata.Filepath, referencedServers.Version, hardcodedVersion))
+			} else {
+				s.logger.Info(fmt.Sprintf(
+					"%s servers from file %s discarded because they have version %d and hardcoded servers have version %d",
+					provider, metadata.Filepath, referencedServers.Version, hardcodedVersion))
+			}
+			return models.Servers{}, false, nil
+		}
+
+		referencedServers.Filepath = metadata.Filepath
+		return referencedServers, true, nil
 	}
 
 	err = json.Unmarshal(rawMessage, &servers)
@@ -113,5 +146,19 @@ func (s *Storage) readServers(provider string, hardcodedVersion uint16,
 			provider, err)
 	}
 
-	return servers, versionsMatch, nil
+	versionsMatch = servers.Version == hardcodedVersion
+	if !versionsMatch {
+		if servers.Preferred {
+			s.logger.Warn(fmt.Sprintf(
+				"%s preferred servers from file discarded because they have version %d and hardcoded servers have version %d",
+				provider, servers.Version, hardcodedVersion))
+		} else {
+			s.logger.Info(fmt.Sprintf(
+				"%s servers from file discarded because they have version %d and hardcoded servers have version %d",
+				provider, servers.Version, hardcodedVersion))
+		}
+		return servers, false, nil
+	}
+
+	return servers, true, nil
 }

internal/storage/read_test.go

@@ -7,6 +7,7 @@ import (
 	"github.com/golang/mock/gomock"
 	"github.com/qdm12/gluetun/internal/constants/providers"
 	"github.com/qdm12/gluetun/internal/models"
+	"github.com/qdm12/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -27,10 +28,15 @@ func populateProviderToVersion(providerToVersion map[string]uint16) map[string]u
 func Test_extractServersFromBytes(t *testing.T) {
 	t.Parallel()
 
+	type logLine struct {
+		level   log.Level
+		message string
+	}
+
 	testCases := map[string]struct {
 		b                 []byte
 		hardcodedVersions map[string]uint16
-		logged            []string
+		logged            []logLine
 		persisted         models.AllServers
 		errMessage        string
 	}{
@@ -42,7 +48,9 @@ func Test_extractServersFromBytes(t *testing.T) {
 			b:                 []byte(`{"cyberghost": "garbage"}`),
 			hardcodedVersions: populateProviderToVersion(map[string]uint16{}),
 			errMessage: "decoding servers version for provider Cyberghost: " +
-				"json: cannot unmarshal string into Go value of type struct { Version uint16 \"json:\\\"version\\\"\" }",
+				"json: cannot unmarshal string into Go value of type struct { Version uint16 \"json:\\\"version\\\"\"; " +
+				"Timestamp int64 \"json:\\\"timestamp\\\"\"; " +
+				"Filepath string \"json:\\\"filepath\\\"\" }",
 		},
 		"bad servers array JSON": {
 			b: []byte(`{"cyberghost": {"version": 1, "servers": "garbage"}}`),
@@ -81,13 +89,30 @@ func Test_extractServersFromBytes(t *testing.T) {
 			hardcodedVersions: populateProviderToVersion(map[string]uint16{
 				providers.Cyberghost: 2,
 			}),
-			logged: []string{
+			logged: []logLine{
-				"Cyberghost servers from file discarded because they have version 1 and hardcoded servers have version 2",
+				{level: log.LevelInfo, message: "Cyberghost servers from file discarded because they have version 1" +
+					" and hardcoded servers have version 2"},
 			},
 			persisted: models.AllServers{
 				ProviderToServers: map[string]models.Servers{},
 			},
 		},
+		"preferred_different_versions": {
+			b: []byte(`{
+				"cyberghost": {"version": 1, "timestamp": 1, "preferred": true}
+			}`),
+			hardcodedVersions: populateProviderToVersion(map[string]uint16{
+				providers.Cyberghost: 2,
+			}),
+			logged: []logLine{
+				{level: log.LevelWarn, message: "Cyberghost preferred servers from file discarded because they have version 1" +
+					" and hardcoded servers have version 2"},
+			},
+			persisted: models.AllServers{
+				ProviderToServers: map[string]models.Servers{},
+			},
+			errMessage: "",
+		},
 	}
 
 	for name, testCase := range testCases {
@@ -98,7 +123,15 @@ func Test_extractServersFromBytes(t *testing.T) {
 			logger := NewMockLogger(ctrl)
 			var previousLogCall *gomock.Call
 			for _, logged := range testCase.logged {
-				call := logger.EXPECT().Info(logged)
+				var call *gomock.Call
+				switch logged.level { //nolint:exhaustive
+				case log.LevelInfo:
+					call = logger.EXPECT().Info(logged.message)
+				case log.LevelWarn:
+					call = logger.EXPECT().Warn(logged.message)
+				default:
+					t.Fatalf("invalid log level %d in test case", logged.level)
+				}
 				if previousLogCall != nil {
 					call.After(previousLogCall)
 				}

internal/storage/servers.go

@@ -2,6 +2,8 @@ package storage
 
 import (
 	"fmt"
+	"os"
+	"path/filepath"
 	"time"
 
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -10,12 +12,12 @@ import (
 
 // SetServers sets the given servers for the given provider
 // in the storage in-memory map and saves all the servers
-// to file.
+// to files.
 // Note the servers given are not copied so the caller must
 // NOT MUTATE them after calling this method.
 func (s *Storage) SetServers(provider string, servers []models.Server) (err error) {
 	if provider == providers.Custom {
-		return
+		return nil
 	}
 
 	s.mergedMutex.Lock()
@@ -26,10 +28,24 @@ func (s *Storage) SetServers(provider string, servers []models.Server) (err erro
 	serversObject.Servers = servers
 	s.mergedServers.ProviderToServers[provider] = serversObject
 
-	err = s.flushToFile(s.filepath)
+	if s.directoryPath == "" {
+		return nil // no disk writing
+	}
+
+	manifestPath := filepath.Join(s.directoryPath, manifestFilename)
+	err = s.flushToFile(manifestPath)
 	if err != nil {
 		return fmt.Errorf("saving servers to file: %w", err)
 	}
+
+	if !s.hasLegacy() {
+		return nil
+	}
+	s.logger.Infof("removing legacy %s which is now migrated to %s", s.legacyFilepath, s.directoryPath)
+	err = os.Remove(s.legacyFilepath)
+	if err != nil && !os.IsNotExist(err) {
+		s.logger.Warn("failed removing legacy servers file " + s.legacyFilepath + ": " + err.Error())
+	}
 	return nil
 }
 

internal/storage/storage.go

@@ -1,6 +1,8 @@
 package storage
 
 import (
+	"os"
+	"path/filepath"
 	"sync"
 
 	"github.com/qdm12/gluetun/internal/models"
@@ -14,31 +16,36 @@ type Storage struct {
 	// SyncServers method.
 	hardcodedServers models.AllServers
 	logger           Logger
-	filepath         string
+	directoryPath    string
+	legacyFilepath   string
 }
 
+const manifestFilename = "manifest.json"
+
 type Logger interface {
 	Info(s string)
+	Infof(format string, args ...any)
 	Warn(s string)
 }
 
 // New creates a new storage and reads the servers from the
-// embedded servers file and the file on disk.
+// embedded servers files and the files on disk.
-// Passing an empty filepath disables the reading and writing of
+// Passing an empty directoryPath disables the reading and writing of
 // servers.
-func New(logger Logger, filepath string) (storage *Storage, err error) {
+func New(logger Logger, directoryPath, legacyFilepath string) (storage *Storage, err error) {
-	// A unit test prevents any error from being returned
+	// A unit test prevents [parseHardcodedServers] from ever failing,
 	// and ensures all providers are part of the servers returned.
-	hardcodedServers, _ := parseHardcodedServers()
+	hardcodedServers := parseHardcodedServers()
 
 	storage = &Storage{
 		hardcodedServers: hardcodedServers,
 		mergedServers:    hardcodedServers,
 		logger:           logger,
-		filepath:         filepath,
+		directoryPath:    directoryPath,
+		legacyFilepath:   legacyFilepath,
 	}
 
-	if filepath != "" {
+	if directoryPath != "" {
 		if err := storage.syncServers(); err != nil {
 			return nil, err
 		}
@@ -46,3 +53,18 @@ func New(logger Logger, filepath string) (storage *Storage, err error) {
 
 	return storage, nil
 }
+
+// hasLegacy returns true if the legacy file `legacyFilepath` exists AND is
+// different from the manifest file defined by `directoryPath`/[manifestFilename].
+// This is used to determine if the legacy file should be read and removed after flushing servers data.
+func (s *Storage) hasLegacy() bool {
+	if s.legacyFilepath == "" {
+		return false
+	}
+	if filepath.Clean(filepath.Join(s.directoryPath, manifestFilename)) ==
+		filepath.Clean(s.legacyFilepath) {
+		return false
+	}
+	stat, err := os.Stat(s.legacyFilepath)
+	return err == nil && !stat.IsDir()
+}

internal/storage/sync.go

@@ -2,6 +2,8 @@ package storage
 
 import (
 	"fmt"
+	"os"
+	"path/filepath"
 	"reflect"
 
 	"github.com/qdm12/gluetun/internal/models"
@@ -14,18 +16,31 @@ func countServers(allServers models.AllServers) (count int) {
 	return count
 }
 
-// syncServers merges the hardcoded servers with the ones from the file.
+// syncServers merges the hardcoded servers with the ones from on disk files.
+// It assumes s.directoryPath is set.
 func (s *Storage) syncServers() (err error) {
 	hardcodedVersions := make(map[string]uint16, len(s.hardcodedServers.ProviderToServers))
 	for provider, servers := range s.hardcodedServers.ProviderToServers {
 		hardcodedVersions[provider] = servers.Version
 	}
 
-	serversOnFile, err := s.readFromFile(s.filepath, hardcodedVersions)
+	sourceManifestPath := filepath.Join(s.directoryPath, manifestFilename)
+	destinationManifestPath := sourceManifestPath
+	serversOnFile, found, err := s.readFromFile(sourceManifestPath, hardcodedVersions)
 	if err != nil {
 		return fmt.Errorf("reading servers from file: %w", err)
 	}
 
+	hasLegacy := s.hasLegacy()
+	if !found && hasLegacy {
+		sourceManifestPath = s.legacyFilepath
+		s.logger.Infof("reading legacy servers file %s and migrating it to directory %s", sourceManifestPath, s.directoryPath)
+		serversOnFile, _, err = s.readFromFile(sourceManifestPath, hardcodedVersions)
+		if err != nil {
+			return fmt.Errorf("reading servers from file: %w", err)
+		}
+	}
+
 	hardcodedCount := countServers(s.hardcodedServers)
 	countOnFile := countServers(serversOnFile)
 
@@ -34,13 +49,13 @@ func (s *Storage) syncServers() (err error) {
 
 	if countOnFile == 0 {
 		s.logger.Info(fmt.Sprintf(
-			"creating %s with %d hardcoded servers",
+			"writing servers data files to %s with %d hardcoded servers",
-			s.filepath, hardcodedCount))
+			s.directoryPath, hardcodedCount))
 		s.mergedServers = s.hardcodedServers
 	} else {
 		s.logger.Info(fmt.Sprintf(
-			"merging by most recent %d hardcoded servers and %d servers read from %s",
+			"merging by most recent %d hardcoded servers and %d servers read from manifest file %s",
-			hardcodedCount, countOnFile, s.filepath))
+			hardcodedCount, countOnFile, sourceManifestPath))
 
 		s.mergedServers = s.mergeServers(s.hardcodedServers, serversOnFile)
 	}
@@ -50,9 +65,18 @@ func (s *Storage) syncServers() (err error) {
 		return nil
 	}
 
-	err = s.flushToFile(s.filepath)
+	err = s.flushToFile(destinationManifestPath)
 	if err != nil {
-		s.logger.Warn("failed writing servers to file: " + err.Error())
+		s.logger.Warn("failed writing servers to destination manifest: " + err.Error())
+		return nil
+	}
+
+	migratedFromLegacy := hasLegacy && sourceManifestPath == s.legacyFilepath
+	if migratedFromLegacy {
+		err = os.Remove(sourceManifestPath)
+		if err != nil && !os.IsNotExist(err) {
+			s.logger.Warn("failed removing legacy servers file " + sourceManifestPath + ": " + err.Error())
+		}
 	}
 	return nil
 }