# Profiles & iCloud Sync

## Why do profile changes need a VPN restart?

MintFlow profiles are not interpreted directly by the running VPN tunnel.

When you activate a profile, MintFlow compiles the text profile into an internal runtime database. That compiled database is what the packet tunnel, DNS server, routing engine, L3 VPN interfaces, L4 proxies, and HTTP engine load while the VPN is running.

Because the running tunnel keeps this compiled runtime state in memory, changing the profile text or app settings does not automatically replace all active routes, DNS policies, proxy chains, VPN peers, and HTTP engine rules in the live tunnel. Restarting VPN is the explicit handoff point: MintFlow stops the old runtime, compiles the current profile again, and starts the tunnel with a consistent database snapshot.

This avoids partially applied configurations, stale routes, stale DNS policy, and mismatches between the UI profile and the runtime networking stack.

Some explicit runtime controls apply live, including starting/stopping an HTTP capture and changing Tailscale Accept Routes or exit-node selection. These controls do not mean that arbitrary profile edits apply live.


## What does iCloud profile sync copy?

Pro iCloud sync copies profile text and local rewrite scripts, not a running VPN session. Another device must select the profile, review compilation diagnostics, and connect. Incoming edits do not silently replace the complete running configuration; reconnect when needed. If two devices edit the same profile, review the reported conflict instead of assuming one copy won. A saved VPN private key, password, or Tailscale bootstrap auth key is part of profile text, so it can sync too. Tailscale machine identity is stored separately in device-only Keychain; see the [Tailscale FAQ](tailscale.md).