diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index 1d5009cc..b27d5e01 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -14,18 +14,18 @@ jobs:
       matrix:
         spec:
           - { name: 'linux x86_64', runner: ubuntu-20.04, target: manylinux_2_27_x86_64 }
-          - { name: 'macOS x86_64', runner: macos-11, target: macosx_10_14_x86_64 }
+          - { name: 'macOS x86_64', runner: macos-12, target: macosx_10_14_x86_64 }
           - { name: 'Windows x86_64', runner: windows-2019, target: win_amd64 }
     name: building ${{ matrix.spec.name }}
     runs-on: ${{ matrix.spec.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
@@ -39,10 +39,10 @@ jobs:
         run: |
           python setup.py sdist
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: startsWith(matrix.spec.name, 'linux')
         with:
-          name: zrok_sdk
+          name: zrok_sdk_${{ matrix.spec.target }}
           path: ${{ github.workspace }}/sdk/python/sdk/zrok/dist/*
 
   publish:
@@ -52,15 +52,17 @@ jobs:
           id-token: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          path: download
+          path: ./download
+          merge-multiple: true
+          pattern: zrok_sdk_*
 
       - name: check
         run: |
-          ls -lR download
+          ls -lR ./download/
           mkdir dist
-          cp download/*/* dist
+          cp ./download/* ./dist/
 
       - name: Publish wheels (TestPYPI)
         uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index 18fe8e36..9f1569a1 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -19,15 +19,15 @@ jobs:
     name: Build Linux AMD64 CLI
     runs-on: ubuntu-20.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: setup-go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
 
       - name: setup-node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -72,7 +72,7 @@ jobs:
           echo go_bin="$(go env GOPATH)/bin" >> $GITHUB_OUTPUT
 
       - name: upload build artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: linux-amd64
           path: ${{ steps.solve_go_bin.outputs.go_bin }}/zrok
@@ -92,25 +92,25 @@ jobs:
           echo branch_tag=$(sed 's/[^a-z0-9_-]/__/gi' <<< "${GITHUB_REF#refs/heads/}") >> $GITHUB_OUTPUT
 
       - name: Checkout Workspace
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Download Branch Build Artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: linux-amd64
           path: ./dist/amd64/linux/
 
       - name: Set Up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: amd64,arm64
 
       - name: Set Up Docker BuildKit
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKER_HUB_API_USER || secrets.DOCKER_HUB_API_USER }}
           password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
diff --git a/.github/workflows/deploy-doc-site.yml b/.github/workflows/deploy-doc-site.yml
index 7b0d81cd..a97d37c9 100644
--- a/.github/workflows/deploy-doc-site.yml
+++ b/.github/workflows/deploy-doc-site.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
           
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         name: setup npm
         with:
           node-version: 18
diff --git a/.github/workflows/node-sdk.yml b/.github/workflows/node-sdk.yml
index 064063a7..ae1b9254 100644
--- a/.github/workflows/node-sdk.yml
+++ b/.github/workflows/node-sdk.yml
@@ -38,7 +38,7 @@ jobs:
 
     - name: Get current zrok repo tag
       id: tag
-      run: echo ::set-output name=TAG::$(git describe --tags --abbrev=0)
+      run: echo "TAG=$(git describe --tags --abbrev=0)" | tee -a $GITHUB_OUTPUT
 
     - name: Update zrok NodeJS-SDK's package.json version based on current zrok repo git tag
       if: github.ref_type == 'tag'
@@ -49,7 +49,7 @@ jobs:
     - name: Setup .npmrc
       if: github.ref_type == 'tag'
       # Setup .npmrc file to prepare for possible publish to npm
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@v4
       with:
         node-version: ${{ matrix.node-version }}
         registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/publish-docker-images.yml b/.github/workflows/publish-docker-images.yml
index 4471dcf0..937c2884 100644
--- a/.github/workflows/publish-docker-images.yml
+++ b/.github/workflows/publish-docker-images.yml
@@ -27,7 +27,7 @@ jobs:
           echo "zrok_semver=${zrok_semver#v}" | tee -a $GITHUB_OUTPUT
 
       - name: Checkout Workspace
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Create the Release Arch Dirs
         run: |
@@ -36,36 +36,38 @@ jobs:
           done
 
       - name: Download Linux AMD64 Release Artifact
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@1.1.2
         with:
           version: tags/v${{ steps.semver.outputs.zrok_semver }}
-          file: zrok_${{ steps.semver.outputs.zrok_semver }}_linux_amd64.tar.gz
-          target: dist/amd64/linux/zrok_${{ steps.semver.outputs.zrok_semver }}_linux_amd64.tar.gz
+          file: zrok.*_linux_amd64.tar.gz
+          regex: true
+          target: dist/amd64/linux/zrok_linux_amd64.tar.gz
 
       - name: Download Linux ARM64 Release Artifact
-        uses: dsaltares/fetch-gh-release-asset@master
+        uses: dsaltares/fetch-gh-release-asset@1.1.2
         with:
           version: tags/v${{ steps.semver.outputs.zrok_semver }}
-          file: zrok_${{ steps.semver.outputs.zrok_semver }}_linux_arm64.tar.gz
-          target: dist/arm64/linux/zrok_${{ steps.semver.outputs.zrok_semver }}_linux_arm64.tar.gz
+          file: zrok.*_linux_arm64.tar.gz
+          regex: true
+          target: dist/arm64/linux/zrok_linux_arm64.tar.gz
 
       - name: Unpack the Release Artifacts
         run: |
           for TGZ in dist/{amd,arm}64/linux; do
-            tar -xvzf ${TGZ}/zrok_*.tar.gz -C ${TGZ}
+            tar -xvzf ${TGZ}/*.tar.gz -C ${TGZ}
           done
 
       - name: Set Up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: amd64,arm64
 
       - name: Set Up Docker BuildKit
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKER_HUB_API_USER || secrets.DOCKER_HUB_API_USER }}
           password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
@@ -76,8 +78,9 @@ jobs:
           ZROK_CONTAINER_IMAGE_TAG: ${{ steps.semver.outputs.zrok_semver }}
         id: tagprep_cli
         run: |
-          echo DOCKER_TAGS="${ZROK_CONTAINER_IMAGE_REPO}:${ZROK_CONTAINER_IMAGE_TAG},${ZROK_CONTAINER_IMAGE_REPO}:latest" \
-          | tee -a $GITHUB_OUTPUT
+          DOCKER_TAGS="${ZROK_CONTAINER_IMAGE_REPO}:${ZROK_CONTAINER_IMAGE_TAG}"
+          DOCKER_TAGS+=",${ZROK_CONTAINER_IMAGE_REPO}:latest"
+          echo "DOCKER_TAGS=${DOCKER_TAGS}" | tee -a $GITHUB_OUTPUT
 
       # this is the CLI image with the Linux binary for each
       # arch that was downloaded in ./dist/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6900a13b..ba86e0b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,18 +21,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-multilib g++-multilib
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -44,21 +44,21 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v5
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-linux.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-linux-amd64
           path: ./dist/*.gz
 
       - name: Configure jFrog CLI
-        uses: jfrog/setup-jfrog-cli@v3
+        uses: jfrog/setup-jfrog-cli@v4
         with:
           version: ${{ env.JFROG_CLI_VERSION }}
         env:
@@ -91,18 +91,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-aarch64-linux-gnu
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -114,21 +114,21 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-linux-arm64.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-linux-arm64
           path: ./dist/*.gz
 
       - name: Configure jFrog CLI
-        uses: jfrog/setup-jfrog-cli@v3
+        uses: jfrog/setup-jfrog-cli@v4
         with:
           version: ${{ env.JFROG_CLI_VERSION }}
         env:
@@ -161,18 +161,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-arm-linux-gnueabi
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -184,21 +184,21 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-linux-armhf.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-linux-arm
           path: ./dist/*.gz
 
       - name: Configure jFrog CLI
-        uses: jfrog/setup-jfrog-cli@v3
+        uses: jfrog/setup-jfrog-cli@v4
         with:
           version: ${{ env.JFROG_CLI_VERSION }}
         env:
@@ -235,18 +235,18 @@ jobs:
           p12-file-base64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
           p12-password: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -258,19 +258,19 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-darwin.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           AC_USERNAME: ${{ secrets.AC_USERNAME }}
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-darwin
           path: ./dist/*.gz
 
   build-windows:
@@ -280,18 +280,18 @@ jobs:
       - run: sudo apt update
       - run: sudo apt-get install gcc-mingw-w64-x86-64
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - run: git fetch --force --tags
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
-          go-version: '>=1.21.3'
+          go-version-file: ./go.mod
           cache: true
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18.x
 
@@ -303,48 +303,56 @@ jobs:
         env:
           CI: "true"
 
-      - uses: goreleaser/goreleaser-action@v2
+      - uses: goreleaser/goreleaser-action@v6
         with:
           distribution: goreleaser
-          version: latest
+          version: '~> v2'
           args: release --skip=publish --config .goreleaser-windows.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-builds
+          name: release-builds-windows
           path: ./dist/*.gz
 
   publish-release:
     # allow skipped but not failed
     if: ${{
           !cancelled()
-          && (needs.build-linux-amd64.result == 'success' || needs.build-linux-amd64.result == 'skipped')
-          && (needs.build-linux-arm.result   == 'success' || needs.build-linux-amd.result   == 'skipped')
-          && (needs.build-linux-arm64.result == 'success' || needs.build-linux-amd64.result == 'skipped')
+          && (needs.build-linux-amd64.result == 'success')
+          && (needs.build-linux-arm.result   == 'success')
+          && (needs.build-linux-arm64.result == 'success')
           && (needs.build-darwin.result      == 'success' || needs.build-darwin.result      == 'skipped')
           && (needs.build-windows.result     == 'success' || needs.build-windows.result     == 'skipped')
       }}
-    needs: [build-linux-amd64, build-linux-arm, build-linux-arm64, build-darwin, build-windows]
+    needs:
+      - build-linux-amd64
+      - build-linux-arm
+      - build-linux-arm64
+      - build-darwin
+      - build-windows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - run: |
           mkdir -p ./automated-release-build
 
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: ./automated-release-build
+          merge-multiple: true
+          pattern: release-builds-*
 
       - run: |
-          mv ./automated-release-build/release-builds/* ./automated-release-build/
-          rm -rf ./automated-release-build/release-builds
+          ls -lAR ./automated-release-build/
           shasum ./automated-release-build/* > ./automated-release-build/checksums.txt
 
-      - uses: goreleaser/goreleaser-action@v3
+      - uses: goreleaser/goreleaser-action@v6
         with:
+          distribution: goreleaser
+          version: '~> v2'
           args: release --config .goreleaser-release.yml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.goreleaser-linux-arm64.yml b/.goreleaser-linux-arm64.yml
index 23637caa..27bd3474 100644
--- a/.goreleaser-linux-arm64.yml
+++ b/.goreleaser-linux-arm64.yml
@@ -112,6 +112,9 @@ nfpms:
       - dst: /lib/systemd/system/
         src: ./nfpm/zrok-share.service
 
+      - dst: /etc/systemd/system/zrok-share.service.d/override.conf
+        src: ./nfpm/zrok-share.service.override.conf
+
       - dst: /opt/openziti/etc/zrok
         type: dir
         file_info:
diff --git a/.goreleaser-linux-armhf.yml b/.goreleaser-linux-armhf.yml
index afb4e052..829c85b8 100644
--- a/.goreleaser-linux-armhf.yml
+++ b/.goreleaser-linux-armhf.yml
@@ -112,6 +112,9 @@ nfpms:
       - dst: /lib/systemd/system/
         src: ./nfpm/zrok-share.service
 
+      - dst: /etc/systemd/system/zrok-share.service.d/override.conf
+        src: ./nfpm/zrok-share.service.override.conf
+
       - dst: /opt/openziti/etc/zrok
         type: dir
         file_info:
diff --git a/.goreleaser-linux.yml b/.goreleaser-linux.yml
index aa728c45..0e5ec9e8 100644
--- a/.goreleaser-linux.yml
+++ b/.goreleaser-linux.yml
@@ -108,6 +108,9 @@ nfpms:
       - dst: /lib/systemd/system/
         src: ./nfpm/zrok-share.service
 
+      - dst: /etc/systemd/system/zrok-share.service.d/override.conf
+        src: ./nfpm/zrok-share.service.override.conf
+
       - dst: /opt/openziti/etc/zrok
         type: dir
         file_info:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe653c16..27e95a2b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,16 @@
 
 ## v0.4.34
 
+FEATURE: Linux service support for all private share modes (contribution from Stefan Adelbert @stefanadelbert)
+
 FIX: Fix for mixing limited and unlimited (-1) resource counts in the limits system (https://github.com/openziti/zrok/issues/680)
 
 CHANGE: add Docker compose example for multiple share containers using the same enabled environment in [compose.override.yml](./docker/compose/zrok-public-reserved/compose.override.yml)
 
+CHANGE: bump many GitHub Actions that were using deprecated distributions of Node.js
+
+CHANGE: bump macOS runner for Node SDK from macos-11 to macos-12
+
 ## v0.4.33
 
 FIX: Fix for log message in `Agent.CanAccessShare` (`"account '#%d' over frontends per share limit '%d'"`), which was not returning the correct limit value.
diff --git a/nfpm/zrok-share.bash b/nfpm/zrok-share.bash
index a0480d3d..6f1a1de0 100644
--- a/nfpm/zrok-share.bash
+++ b/nfpm/zrok-share.bash
@@ -54,9 +54,12 @@ fi
   exit 1
 }
 
-# default mode is reserved (public), override mode is temp-public, i.e., "share public" without a reserved subdomain
+# default mode is 'reserved-public', override modes are reserved-private, temp-public, temp-private.
+: "${ZROK_FRONTEND_MODE:=reserved-public}"
 if [[ "${ZROK_FRONTEND_MODE:-}" == temp-public ]]; then
   ZROK_CMD="share public --headless ${ZROK_VERBOSE:-}"
+elif [[ "${ZROK_FRONTEND_MODE:-}" == temp-private ]]; then
+  ZROK_CMD="share private --headless ${ZROK_VERBOSE:-}"
 elif [[ -s ~/.zrok/reserved.json ]]; then
   ZROK_RESERVED_TOKEN="$(jq -r '.token' ~/.zrok/reserved.json 2>/dev/null)"
   if [[ -z "${ZROK_RESERVED_TOKEN}" || "${ZROK_RESERVED_TOKEN}" == null ]]; then
@@ -73,8 +76,13 @@ elif [[ -s ~/.zrok/reserved.json ]]; then
       exit 0
     fi
   fi
-else
+elif [[ "${ZROK_FRONTEND_MODE:-}" == reserved-public ]]; then
   ZROK_CMD="reserve public --json-output ${ZROK_VERBOSE:-}"
+elif [[ "${ZROK_FRONTEND_MODE:-}" == reserved-private ]]; then
+  ZROK_CMD="reserve private --json-output ${ZROK_VERBOSE:-}"
+else
+  echo "ERROR: invalid value for ZROK_FRONTEND_MODE '${ZROK_FRONTEND_MODE}'" >&2
+  exit 1
 fi
 
 [[ -n "${ZROK_BACKEND_MODE:-}" ]] || {
@@ -88,12 +96,12 @@ case "${ZROK_BACKEND_MODE}" in
       echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not an HTTP URL" >&2
       exit 1
     else
-      echo "INFO: validated backend mode ${ZROK_BACKEND_MODE} and target ${ZROK_TARGET}"
+      echo "INFO: validated backend mode '${ZROK_BACKEND_MODE}' and target '${ZROK_TARGET}'"
     fi
     ;;
   caddy)
     if ! [[ "${ZROK_TARGET}" =~ ^/ ]]; then
-      echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not an absolute filesystem path." >&2
+      echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not an absolute filesystem path" >&2
       exit 1
     elif ! [[ -f "${ZROK_TARGET}" && -r "${ZROK_TARGET}" ]]; then
       echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not a readable regular file" >&2
@@ -104,7 +112,7 @@ case "${ZROK_BACKEND_MODE}" in
     ;;
   web|drive)
     if ! [[ "${ZROK_TARGET}" =~ ^/ ]]; then
-      echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not an absolute filesystem path." >&2
+      echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not an absolute filesystem path" >&2
       exit 1
     elif ! [[ -d "${ZROK_TARGET}" && -r "${ZROK_TARGET}" ]]; then
       echo "ERROR: ZROK_TARGET='${ZROK_TARGET}' is not a readable directory" >&2
@@ -113,13 +121,41 @@ case "${ZROK_BACKEND_MODE}" in
       echo "INFO: validated backend mode ${ZROK_BACKEND_MODE} and target ${ZROK_TARGET}"
     fi
     ;;
+  tcpTunnel|udpTunnel|socks|vpn)
+    if ! [[ "${ZROK_FRONTEND_MODE}" =~ -private$ ]]; then
+      echo "ERROR: ZROK_BACKEND_MODE='${ZROK_BACKEND_MODE}' is a private share backend mode and cannot be used with ZROK_FRONTEND_MODE='${ZROK_FRONTEND_MODE}'" >&2
+      exit 1
+    else
+      case "${ZROK_BACKEND_MODE}" in
+        tcpTunnel|udpTunnel)
+          echo "INFO: ${ZROK_BACKEND_MODE} backend mode has target '${ZROK_TARGET}'"
+          ;;
+        vpn)
+          if [[ -n "${ZROK_TARGET}" ]]; then
+            ZROK_SVC_FILE=/etc/systemd/system/zrok-share.service.d/override.conf
+            if ! grep -qE '^AmbientCapabilities=CAP_NET_ADMIN' "${ZROK_SVC_FILE}"; then
+              echo "ERROR: you must uncomment 'AmbientCapabilities=CAP_NET_ADMIN' in '${ZROK_SVC_FILE}'"\
+                    "and run 'systemctl daemon-reload' to enable VPN mode" >&2
+              exit 1
+            fi
+          fi
+          ;;
+        socks)
+          if [[ -n "${ZROK_TARGET}" ]]; then
+            echo "WARNING: ZROK_TARGET='${ZROK_TARGET}' is ignored with ZROK_BACKEND_MODE='${ZROK_BACKEND_MODE}'" >&2
+            unset ZROK_TARGET
+          fi
+          ;;
+      esac
+    fi
+    ;;
   *)
     echo "WARNING: ZROK_BACKEND_MODE='${ZROK_BACKEND_MODE}' is not a recognized mode for a zrok public share."\
           " ZROK_TARGET value will not validated before running." >&2
     ;;
 esac
 
-[[ -n "${ZROK_UNIQUE_NAME:-}" ]] && {
+[[ "${ZROK_FRONTEND_MODE:-}" =~ ^reserved- && -n "${ZROK_UNIQUE_NAME:-}" ]] && {
   ZROK_CMD+=" --unique-name ${ZROK_UNIQUE_NAME}"
 }
 
@@ -142,8 +178,9 @@ fi
 
 echo "INFO: running: zrok ${ZROK_CMD}"
 
-if [[ "${ZROK_FRONTEND_MODE:-}" == temp-public ]]; then
-  # share until exit
+if [[ "${ZROK_FRONTEND_MODE:-}" =~ ^temp- ]]; then
+  # frontend mode starts with 'temp-', so is temporary.
+  # share without reserving until exit.
   exec zrok ${ZROK_CMD}
 else
   # reserve and continue
diff --git a/nfpm/zrok-share.env b/nfpm/zrok-share.env
index 323f5b8c..546fd26f 100644
--- a/nfpm/zrok-share.env
+++ b/nfpm/zrok-share.env
@@ -17,48 +17,65 @@ ZROK_ENABLE_TOKEN=""
 #
 ZROK_ENVIRONMENT_NAME=""
 
-# You MUST set this if not using the default zrok.io API endpoint
+# You MUST set this if not using the default API endpoint
 #ZROK_API_ENDPOINT="https://api.zrok.io"
 
 #
-## ZROK BACKEND TARGET
+## ZROK BACKEND MODE AND TARGET
 #
 # You MUST define the backend target and mode. The frontend URL will be provisioned when the service starts. You MAY
 # change ZROK_TARGET and frontend URL will remain the same after a restart as long as the backend mode and frontend
 # authentication options are the same. Options that require provisioning a new frontend URL when changed are marked with
 # WARNING. You may delete /var/lib/zrok-share/.zrok/reserved.json and restart the service to provision a new frontend URL.
+
 #
+## BACKEND MODES THAT WORK WITH PUBLIC AND PRIVATE HTTP SHARES
+#
+
 # backend-mode "proxy" (default): share a backend web server URL that's reachable by this host; must begin with 'http://' or
 # 'https://'; must accept the HOST header of the proxy frontend. Check out backend mode "caddy" if you need more control.
-ZROK_TARGET=""                  # e.g., http://127.0.0.1:3000
 ZROK_BACKEND_MODE="proxy"
+ZROK_TARGET=""                  # e.g., http://127.0.0.1:3000
 # if defined, an https share's backend server certificate will not be verified with backend-mode 'proxy'
 # NOTE: changing this value does not require provisioning a new frontend URL
 #ZROK_INSECURE="--insecure"
 
 # backend-mode "web": run a web server and share a static HTML directory that's present on this host. Must be an
 # absolute path to a directory that is readable by 'other'
-#ZROK_TARGET="/var/www/html"
 #ZROK_BACKEND_MODE="web"
+#ZROK_TARGET="/var/www/html"
 
 # backend-mode "drive": run a WebDAV file server sharing a directory that's present on this host. Must be an absolute
 # path to a directory that is readable by 'other'
-#ZROK_TARGET="/usr/share/doc"
 #ZROK_BACKEND_MODE="drive"
+#ZROK_TARGET="/usr/share/doc"
 
 # backend-mode "caddy": run an embedded Caddy server configured by the supplied Caddyfile. Must be an absolute path that
 # is readable by 'other'.
-#ZROK_TARGET="/opt/openziti/etc/zrok/multiple_upstream.Caddyfile"
 #ZROK_BACKEND_MODE="caddy"
+#ZROK_TARGET="/opt/openziti/etc/zrok/multiple_upstream.Caddyfile"
 
-# DEBUG log level
-# NOTE: changing this value does not require provisioning a new frontend URL
-#ZROK_VERBOSE="--verbose"
+#
+## BACKEND MODES THAT ONLY WORK WITH PRIVATE SHARES
+#
 
-# you MAY set additional command-line options for the share; see "zrok reserve public --help" for hints
-# WARNING: changes take effect the next time the frontend URL is reserved
-# NOTE: basic auth and oauth are mutually exclusive
-ZROK_SHARE_OPTS=""
+# you MUST set ZROK_FRONTEND_MODE to 'reserved-private' or 'temp-private' to use private share backend modes
+
+#ZROK_BACKEND_MODE="tcpTunnel"
+#ZROK_TARGET="127.0.0.1:25565"
+
+#ZROK_BACKEND_MODE="udpTunnel"
+#ZROK_TARGET="127.0.0.1:53"
+
+# you MUST grant NET_ADMIN capability to the service to enable vpn mode, e.g., run these two commands:
+# sed -Ei 's/.*AmbientCapabilities=CAP_NET_ADMIN/AmbientCapabilities=CAP_NET_ADMIN/' /etc/systemd/system/zrok-share.service.d/override.conf
+# systemctl daemon-reload
+#ZROK_BACKEND_MODE="vpn"
+#ZROK_TARGET="172.16.0.1/12"
+
+# there is no target for socks mode because the share is only a dynamic exit for the proxy client
+#ZROK_BACKEND_MODE="socks"
+#ZROK_TARGET=""
 
 #
 ## ZROK FRONTEND 
@@ -86,3 +103,17 @@ ZROK_SHARE_OPTS=""
 # set if self-hosting zrok and not using only the default frontend name 'public'; must be a space-separated list
 # WARNING: changes take effect the next time the frontend URL is reserved
 #ZROK_FRONTENDS="public"
+
+# you MAY set to change the frontend mode: reserved-public (default), reserved-private, temp-public, temp-private 
+#ZROK_FRONTEND_MODE="reserved-public"
+
+#
+## OPTIONS
+#
+
+# DEBUG log level
+# NOTE: changing this value does not require provisioning a new frontend URL
+#ZROK_VERBOSE="--verbose"
+
+# you MAY set additional command-line options for the share; see "zrok reserve public --help" for hints
+ZROK_SHARE_OPTS=""
diff --git a/nfpm/zrok-share.service.override.conf b/nfpm/zrok-share.service.override.conf
new file mode 100644
index 00000000..57f4a796
--- /dev/null
+++ b/nfpm/zrok-share.service.override.conf
@@ -0,0 +1,10 @@
+[Service]
+
+#
+## extra permissions
+#
+
+# allow adding tun device and IP routes and iptables rules; required when ZROK_BACKEND_MODE=vpn
+# AmbientCapabilities=CAP_NET_ADMIN
+
+# you must run 'systemctl daemon-reload' after modifying this file