mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-18 11:39:03 +02:00
33d1b212fb
* docs: describe how reverse proxy services share ports The reverse proxy page said every L4 service needs a dedicated port and that each port can only be used by one service. That is not what the proxy and management do: the conflict check is per cluster, protocol and port, so a port takes any number of TLS services (told apart by SNI), at most one TCP service (the catch-all for unmatched connections), and, counted separately, at most one UDP service. Also correct the main-port description: a TCP service may listen on the main port too, and then receives the connections that match no SNI route, instead of the HTTP reverse proxy. Verified against checkPortConflict (management/internals/modules/ reverseproxy/service/manager/manager.go) and handleUnmatched (proxy/internal/tcp/router.go) in v0.79.0, and on a self-hosted cluster: TLS services on 443 are routed by SNI, unmatched and plain TCP connections reach the TCP service on 443, a second TCP service on 443 is rejected with 409, and a UDP service on 443 is accepted alongside them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: TLS listen ports, custom-port fallback and one domain per service TLS services always need an explicit listen port, including on clusters without custom port selection, where the dashboard keeps the field editable; auto-assignment applies to TCP and UDP. On a custom port with no TCP service, unmatched and HTTP connections are dropped, and non-TLS connections on the main port take the same fallback as unmatched SNI. A domain belongs to one service, so the HTTP/TLS same-hostname warning now says creation fails. In Docker the main port is 8443, so listen port 443 is a custom port. Drop the ECH example from the no-SNI case. * docs: HTTP hostnames on a custom port fall back to its TCP service A request for an HTTP service's hostname on a custom port matches no route there, so it follows the same fallback as any unmatched connection: the port's TCP service if it has one, otherwise dropped. * docs: tighten the L4 port overview and the port-sharing warning The port-sharing warning read as if a second service of any protocol fails on a port; only TCP and UDP are limited to one per port, while TLS services share by SNI. Say that directly, shorten the L4 overview to a summary that links the two sections holding the rules, and name the listen port in the TCP and UDP mode descriptions. --------- Co-authored-by: Janek Härtter <janek@netbird.io> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>