Revert "Merge main"

This reverts commit 89f95b15482030ed9d3aee8d3caab68c65f43055.

proxy/cmd/proxy/cmd/root.go

@@ -214,10 +214,7 @@ func runServer(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid --trusted-proxies: %w", err)
 	}
 
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
-	defer stop()
-
-	srv := proxy.New(ctx, proxy.Config{
+	srv := proxy.New(proxy.Config{
 		ListenAddr:               addr,
 		Logger:                   logger,
 		Version:                  Version,
@@ -254,6 +251,9 @@ func runServer(cmd *cobra.Command, args []string) error {
 		CrowdSecAPIKey:           crowdsecAPIKey,
 	})
 
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+
 	return srv.ListenAndServe(ctx, addr)
 }
 

proxy/inbound.go

@@ -5,7 +5,6 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
-	"io"
 	stdlog "log"
 	"net"
 	"net/http"
@@ -43,7 +42,7 @@ const privateInboundPortHTTPS = 443
 const privateInboundPortHTTP = 80
 
 // inboundManager wires per-account inbound listeners into the proxy
-// pipeline when --private is enabled. When disabled the manager
+// pipeline when --private-inbound is enabled. When disabled the manager
 // is nil and every method on *Server that touches it short-circuits.
 type inboundManager struct {
 	logger    *log.Logger
@@ -56,18 +55,15 @@ type inboundManager struct {
 }
 
 // inboundEntry owns the listeners, router and HTTP servers for a single
-// account's embedded netstack. errorLogWriters retain the logrus pipe
-// writers backing each http.Server's ErrorLog so tearDown can close
-// them — otherwise the pipe + its scanner goroutine leak per account.
+// account's embedded netstack.
 type inboundEntry struct {
-	router          *nbtcp.Router
-	tlsListener     net.Listener
-	plainListener   net.Listener
-	httpsServer     *http.Server
-	httpServer      *http.Server
-	errorLogWriters []*io.PipeWriter
-	cancel          context.CancelFunc
-	wg              sync.WaitGroup
+	router        *nbtcp.Router
+	tlsListener   net.Listener
+	plainListener net.Listener
+	httpsServer   *http.Server
+	httpServer    *http.Server
+	cancel        context.CancelFunc
+	wg            sync.WaitGroup
 }
 
 // pendingInboundRoute holds a route that arrived before the account's
@@ -151,34 +147,30 @@ func (m *inboundManager) bringUp(ctx context.Context, accountID types.AccountID,
 		return types.WithOverlayOrigin(ctx)
 	}
 
-	httpsErrLog, httpsErrW := newInboundErrorLog(m.logger, "https", accountID)
-	httpErrLog, httpErrW := newInboundErrorLog(m.logger, "http", accountID)
-
 	httpsServer := &http.Server{
 		Handler:           scopedHandler,
 		TLSConfig:         m.tlsConfig,
 		ReadHeaderTimeout: httpInboundReadHeaderTimeout,
 		IdleTimeout:       httpInboundIdleTimeout,
-		ErrorLog:          httpsErrLog,
+		ErrorLog:          newInboundErrorLog(m.logger, "https", accountID),
 		ConnContext:       markOverlayOrigin,
 	}
 	httpServer := &http.Server{
 		Handler:           scopedHandler,
 		ReadHeaderTimeout: httpInboundReadHeaderTimeout,
 		IdleTimeout:       httpInboundIdleTimeout,
-		ErrorLog:          httpErrLog,
+		ErrorLog:          newInboundErrorLog(m.logger, "http", accountID),
 		ConnContext:       markOverlayOrigin,
 	}
 
 	runCtx, cancel := context.WithCancel(ctx)
 	entry := &inboundEntry{
-		router:          router,
-		tlsListener:     tlsListener,
-		plainListener:   plainListener,
-		httpsServer:     httpsServer,
-		httpServer:      httpServer,
-		errorLogWriters: []*io.PipeWriter{httpsErrW, httpErrW},
-		cancel:          cancel,
+		router:        router,
+		tlsListener:   tlsListener,
+		plainListener: plainListener,
+		httpsServer:   httpsServer,
+		httpServer:    httpServer,
+		cancel:        cancel,
 	}
 
 	entry.wg.Add(1)
@@ -245,14 +237,6 @@ func (m *inboundManager) tearDown(accountID types.AccountID, entry *inboundEntry
 		m.logger.Debugf("close per-account plain listener: %v", err)
 	}
 	entry.wg.Wait()
-	// Close the ErrorLog pipes only after the http.Servers have fully
-	// stopped so any straggling stdlib write doesn't race with the
-	// close. Each writer also tears down the logrus scanner goroutine.
-	for _, w := range entry.errorLogWriters {
-		if err := w.Close(); err != nil {
-			m.logger.Debugf("close per-account inbound error log writer: %v", err)
-		}
-	}
 }
 
 // AddRoute records an SNI/host route on the account's per-account router.
@@ -390,7 +374,7 @@ func (m *inboundManager) ListenerInfo(accountID types.AccountID) (InboundListene
 }
 
 // Snapshot returns the inbound listener state for every account that has
-// a live listener at call time. Empty when --private is off or
+// a live listener at call time. Empty when --private-inbound is off or
 // no accounts have come up yet.
 func (m *inboundManager) Snapshot() map[types.AccountID]InboundListenerInfo {
 	if m == nil {
@@ -513,7 +497,7 @@ func accountTunnelLookup(client *embed.Client) auth.TunnelLookupFunc {
 // peerstore lookup to every request's context before delegating to next.
 // Calling on the host-level listener is a no-op because that path never
 // installs this wrapper, so the existing behaviour stays byte-for-byte
-// identical when --private is off or the request didn't arrive
+// identical when --private-inbound is off or the request didn't arrive
 // on a per-account listener.
 func withTunnelLookup(next http.Handler, lookup auth.TunnelLookupFunc) http.Handler {
 	if lookup == nil {
@@ -554,14 +538,10 @@ func (a inboundDebugAdapter) InboundListeners() map[types.AccountID]debug.Inboun
 }
 
 // newInboundErrorLog routes a per-account http.Server's stdlib error
-// stream through logrus at warn level. The returned PipeWriter must be
-// closed by the caller (tearDown) once the http.Server has shut down —
-// otherwise the pipe and its scanner goroutine leak per account, see
-// logrus.Entry.WriterLevel.
-func newInboundErrorLog(logger *log.Logger, scheme string, accountID types.AccountID) (*stdlog.Logger, *io.PipeWriter) {
-	w := logger.WithFields(log.Fields{
+// stream through logrus at warn level.
+func newInboundErrorLog(logger *log.Logger, scheme string, accountID types.AccountID) *stdlog.Logger {
+	return stdlog.New(logger.WithFields(log.Fields{
 		"inbound-http": scheme,
 		"account_id":   accountID,
-	}).WriterLevel(log.WarnLevel)
-	return stdlog.New(w, "", 0), w
+	}).WriterLevel(log.WarnLevel), "", 0)
 }

proxy/inbound_test.go

@@ -4,7 +4,6 @@ import (
 	"bufio"
 	"context"
 	"crypto/tls"
-	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
@@ -111,7 +110,7 @@ func TestServer_PrivateInbound_Enabled_WiresLifecycle(t *testing.T) {
 	// Construct a NetBird transport. We can't actually start the embedded
 	// client here (that needs a real management server), but we can
 	// confirm that the lifecycle callbacks are registered.
-	s.netbird = roundtrip.NewNetBird(t.Context(), "test", "test", roundtrip.ClientConfig{
+	s.netbird = roundtrip.NewNetBird("test", "test", roundtrip.ClientConfig{
 		MgmtAddr: "http://invalid.test",
 	}, quietLogger(), nil, fakeMgmtClient{})
 
@@ -140,7 +139,7 @@ func TestInboundManager_AddRouteAfterReady_RegistersDirectly(t *testing.T) {
 
 // TestPrivateCapability_DerivedFromPrivateOnly tests that the capability
 // bit reported upstream tracks --private exclusively. The previous
-// --private flag has been folded into --private.
+// --private-inbound flag has been folded into --private.
 func TestPrivateCapability_DerivedFromPrivateOnly(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -319,7 +318,7 @@ func TestInboundManager_ListenerInfo(t *testing.T) {
 }
 
 // TestInboundManager_NilManagerSafe ensures the observability accessors
-// are safe to call when --private is off (nil manager).
+// are safe to call when --private-inbound is off (nil manager).
 func TestInboundManager_NilManagerSafe(t *testing.T) {
 	var mgr *inboundManager
 	_, ok := mgr.ListenerInfo("anything")
@@ -483,38 +482,6 @@ func selfSignedTLSConfig(t *testing.T) *tls.Config {
 	return &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12} //nolint:gosec
 }
 
-// TestNewInboundErrorLog_WriterIsCloseable guards the close path on the
-// logrus PipeWriter that backs each per-account http.Server's ErrorLog.
-// logrus.Entry.WriterLevel returns an *io.PipeWriter that owns a pipe +
-// scanner goroutine; the caller must Close() it on teardown or the
-// resources leak per account. The contract is verified two ways:
-//
-//   - the constructor returns a non-nil writer the caller can keep,
-//   - writing to the writer after Close() fails with io.ErrClosedPipe,
-//     which is the only externally observable sign that Close was wired.
-//
-// A leaking refactor (forgetting to thread the writer to tearDown, or
-// dropping the Close call) would still pass this test individually but
-// fail an integration goleak check; this unit test is the cheap first
-// line of defence.
-func TestNewInboundErrorLog_WriterIsCloseable(t *testing.T) {
-	logger := quietLogger()
-	stdLog, writer := newInboundErrorLog(logger, "https", types.AccountID("acct-1"))
-
-	require.NotNil(t, stdLog, "newInboundErrorLog must return a non-nil *log.Logger")
-	require.NotNil(t, writer, "newInboundErrorLog must return the underlying PipeWriter so tearDown can Close it")
-
-	// First Close succeeds.
-	require.NoError(t, writer.Close(), "PipeWriter.Close should succeed the first time")
-
-	// After Close, the writer must refuse new writes — that's the only
-	// behavioural signal that the pipe (and its scanner goroutine) has
-	// shut down.
-	_, err := writer.Write([]byte("post-close write\n"))
-	require.ErrorIs(t, err, io.ErrClosedPipe,
-		"writes after Close must surface io.ErrClosedPipe so callers know the writer is gone")
-}
-
 // testCertPEM / testKeyPEM are a minimal RSA self-signed cert for
 // 127.0.0.1 — only used by tests that need a working TLS handshake.
 var testCertPEM = []byte(`-----BEGIN CERTIFICATE-----

proxy/internal/auth/middleware.go

@@ -346,15 +346,13 @@ func (mw *Middleware) forwardWithSessionCookie(w http.ResponseWriter, r *http.Re
 // management unreachable, peer unknown, user not in group) returns false so
 // the caller falls back to the existing OIDC scheme dispatch.
 //
-// The fast-path is gated on TunnelLookupFromContext(r.Context()) being
-// present — that context value is attached only by the per-account
-// inbound (overlay) listener. The host listener never sets it, so a
-// public client whose source IP happens to fall inside an RFC1918 / ULA
-// / CGNAT range can't impersonate a mesh peer by colliding with a
-// tunnel-IP. Once we know the request arrived over WireGuard the
-// per-account peerstore lookup is consulted: a miss denies fast (no
-// management round-trip), a hit gates the cached ValidateTunnelPeer RPC
-// that mints the session JWT.
+// Phase 3 adds a local-first short-circuit: when the request arrived on a
+// per-account inbound listener the context carries a peerstore lookup
+// (TunnelLookupFromContext). If the lookup says the IP isn't in the account's
+// roster the proxy denies fast without calling management. If the lookup
+// confirms a known peer the RPC still runs for the user-identity tail
+// (UserID + group access), but its result is cached for tunnelCacheTTL so
+// repeat requests skip management entirely.
 func (mw *Middleware) forwardWithTunnelPeer(w http.ResponseWriter, r *http.Request, host string, config DomainConfig, next http.Handler) bool {
 	if mw.sessionValidator == nil {
 		return false
@@ -363,24 +361,18 @@ func (mw *Middleware) forwardWithTunnelPeer(w http.ResponseWriter, r *http.Reque
 	if !clientIP.IsValid() {
 		return false
 	}
-
-	// Anti-spoof: only honour the tunnel-peer fast-path on requests that
-	// were stamped by an overlay listener. Without that marker an
-	// attacker could send a request from a colliding RFC1918 / CGNAT
-	// source on the public listener and bypass operator auth.
-	lookup := TunnelLookupFromContext(r.Context())
-	if lookup == nil {
-		return false
-	}
 	if !isTunnelSourceIP(clientIP) {
 		return false
 	}
-	if _, ok := lookup(clientIP); !ok {
-		mw.logger.WithFields(log.Fields{
-			"host":   host,
-			"remote": clientIP,
-		}).Debug("local peerstore: tunnel IP not in account roster; denying without RPC")
-		return false
+
+	if lookup := TunnelLookupFromContext(r.Context()); lookup != nil {
+		if _, ok := lookup(clientIP); !ok {
+			mw.logger.WithFields(log.Fields{
+				"host":   host,
+				"remote": clientIP,
+			}).Debug("local peerstore: tunnel IP not in account roster; denying without RPC")
+			return false
+		}
 	}
 
 	resp, _, err := mw.tunnelCache.fetch(r.Context(), tunnelCacheKey{

proxy/internal/auth/middleware_test.go

@@ -1227,93 +1227,3 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 
 	assert.Equal(t, http.StatusUnauthorized, rec.Code, "PIN-only domain should serve the login page on plain HTTP")
 }
-
-// stubTunnelValidator records ValidateTunnelPeer calls so a test can
-// assert whether the fast-path reached management.
-type stubTunnelValidator struct {
-	called bool
-	resp   *proto.ValidateTunnelPeerResponse
-}
-
-func (s *stubTunnelValidator) ValidateSession(context.Context, *proto.ValidateSessionRequest, ...grpc.CallOption) (*proto.ValidateSessionResponse, error) {
-	return nil, errors.New("not used in this test")
-}
-
-func (s *stubTunnelValidator) ValidateTunnelPeer(context.Context, *proto.ValidateTunnelPeerRequest, ...grpc.CallOption) (*proto.ValidateTunnelPeerResponse, error) {
-	s.called = true
-	return s.resp, nil
-}
-
-// TestProtect_TunnelPeerFastPath_RequiresInboundMarker guards the
-// anti-spoof gate: a request with an RFC1918 source IP arriving on the
-// public listener (no TunnelLookupFromContext attached) must not be
-// allowed to take the tunnel-peer fast-path. Without this gate a public
-// client whose source IP happens to fall inside an RFC1918 range could
-// bypass the configured auth scheme by colliding with a known tunnel
-// IP.
-func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
-	validator := &stubTunnelValidator{
-		resp: &proto.ValidateTunnelPeerResponse{
-			Valid:        true,
-			SessionToken: "should-not-be-used",
-			UserId:       "user-1",
-		},
-	}
-	mw := NewMiddleware(log.StandardLogger(), validator, nil)
-	kp := generateTestKeyPair(t)
-
-	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
-
-	handler := mw.Protect(newPassthroughHandler())
-
-	// Request from an RFC1918 source IP on the public listener — no
-	// TunnelLookupFromContext attached. The fast-path must reject this
-	// and fall through to the PIN scheme (which renders 401 on plain
-	// HTTP for a non-authenticated request).
-	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
-	req.RemoteAddr = "100.64.0.5:5000"
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.False(t, validator.called,
-		"ValidateTunnelPeer must not be invoked when the request lacks the inbound TunnelLookup marker")
-	assert.Equal(t, http.StatusUnauthorized, rec.Code,
-		"without the inbound marker the request must fall through to the operator auth scheme")
-}
-
-// TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker verifies
-// the positive side: a request marked as overlay-origin (carrying the
-// TunnelLookup context value) and matching a tunnel-IP range does take
-// the fast-path and reach management.
-func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
-	validator := &stubTunnelValidator{
-		resp: &proto.ValidateTunnelPeerResponse{
-			Valid:        true,
-			SessionToken: "tunnel-session-token",
-			UserId:       "user-1",
-		},
-	}
-	mw := NewMiddleware(log.StandardLogger(), validator, nil)
-	kp := generateTestKeyPair(t)
-
-	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
-
-	handler := mw.Protect(newPassthroughHandler())
-
-	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
-		return PeerIdentity{}, true
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
-	req.RemoteAddr = "100.64.0.5:5000"
-	req = req.WithContext(WithTunnelLookup(req.Context(), lookup))
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-
-	assert.True(t, validator.called,
-		"ValidateTunnelPeer must run when the request carries the inbound TunnelLookup marker")
-	assert.Equal(t, http.StatusOK, rec.Code,
-		"a successful tunnel-peer validation must forward to the next handler")
-}

proxy/internal/auth/tunnel_lookup_test.go

@@ -101,10 +101,7 @@ func TestForwardWithTunnelPeer_GroupsPropagateToCapturedData(t *testing.T) {
 
 	w, r := newTunnelRequest("100.64.0.10:55555")
 	cd := proxy.NewCapturedData("")
-	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
-		return PeerIdentity{}, true
-	})
-	r = r.WithContext(proxy.WithCapturedData(WithTunnelLookup(r.Context(), lookup), cd))
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
 
 	called := false
 	next := http.HandlerFunc(func(http.ResponseWriter, *http.Request) { called = true })
@@ -151,13 +148,9 @@ func TestForwardWithTunnelPeer_LocalLookupKnownPeerStillRPCs(t *testing.T) {
 	assert.Equal(t, int32(1), validator.tunnelCalls.Load(), "RPC must run for the user-identity tail when local lookup confirms the peer")
 }
 
-// TestForwardWithTunnelPeer_NoLookupRefusesFastPath guards the
-// anti-spoof gate: requests that didn't arrive on the per-account
-// inbound listener (no TunnelLookup attached) must never reach
-// management's ValidateTunnelPeer, even when the source IP looks like
-// a tunnel address. A colliding RFC1918 / CGNAT source on the public
-// listener would otherwise impersonate a mesh peer.
-func TestForwardWithTunnelPeer_NoLookupRefusesFastPath(t *testing.T) {
+// TestForwardWithTunnelPeer_NoLookupKeepsLegacyPath ensures the existing
+// behaviour stays intact on the host-level listener (no lookup attached).
+func TestForwardWithTunnelPeer_NoLookupKeepsLegacyPath(t *testing.T) {
 	validator := &stubSessionValidator{
 		respFn: func(_ *proto.ValidateTunnelPeerRequest) *proto.ValidateTunnelPeerResponse {
 			return &proto.ValidateTunnelPeerResponse{Valid: true, SessionToken: "tok", UserId: "user-1"}
@@ -172,9 +165,9 @@ func TestForwardWithTunnelPeer_NoLookupRefusesFastPath(t *testing.T) {
 	config, _ := mw.getDomainConfig("svc.example")
 	handled := mw.forwardWithTunnelPeer(w, r, "svc.example", config, next)
 
-	assert.False(t, handled, "fast-path must refuse without the inbound marker")
-	assert.False(t, called, "next handler must not run")
-	assert.Equal(t, int32(0), validator.tunnelCalls.Load(), "ValidateTunnelPeer must not be invoked without the inbound marker")
+	assert.True(t, handled, "host-level path forwards on positive RPC result")
+	assert.True(t, called, "next handler runs on host-level success")
+	assert.Equal(t, int32(1), validator.tunnelCalls.Load(), "host-level path always RPCs (Phase 3 unchanged)")
 }
 
 // TestForwardWithTunnelPeer_RPCErrorFallsThrough validates that an RPC
@@ -208,13 +201,8 @@ func TestForwardWithTunnelPeer_CacheReusesPositiveResponse(t *testing.T) {
 	}
 	mw := newTunnelMiddleware(t, validator)
 
-	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
-		return PeerIdentity{}, true
-	})
-
 	for i := 0; i < 4; i++ {
 		w, r := newTunnelRequest("100.64.0.10:55555")
-		r = r.WithContext(WithTunnelLookup(r.Context(), lookup))
 		next := http.HandlerFunc(func(http.ResponseWriter, *http.Request) {})
 		config, _ := mw.getDomainConfig("svc.example")
 		handled := mw.forwardWithTunnelPeer(w, r, "svc.example", config, next)
@@ -238,21 +226,11 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
 	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
 
-	// The fast-path requires the inbound-listener marker on the context.
-	// The peerstore lookup itself is account-agnostic at this level
-	// (one TunnelLookupFunc per account is attached by inbound.go); a
-	// trivial "always hit" lookup is enough to exercise the cache-key
-	// branch this test covers.
-	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
-		return PeerIdentity{}, true
-	})
-
 	for _, host := range []string{"svc-a.example", "svc-b.example"} {
 		w := httptest.NewRecorder()
 		r := httptest.NewRequest(http.MethodGet, "https://"+host+"/", nil)
 		r.Host = host
 		r.RemoteAddr = "100.64.0.10:55555"
-		r = r.WithContext(WithTunnelLookup(r.Context(), lookup))
 		config, _ := mw.getDomainConfig(host)
 		handled := mw.forwardWithTunnelPeer(w, r, host, config, http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
 		require.True(t, handled, "host %s should forward", host)
@@ -336,17 +314,9 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	// Per-account inbound listener attaches WithTunnelLookup; without it
-	// forwardWithTunnelPeer refuses to take the fast-path. Mirror the
-	// real flow so this test exercises the post-gating success branch.
-	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
-		return PeerIdentity{}, true
-	})
-
 	req := httptest.NewRequest(http.MethodGet, "https://private.svc/", nil)
 	req.Host = "private.svc"
 	req.RemoteAddr = "100.64.0.10:55555"
-	req = req.WithContext(WithTunnelLookup(req.Context(), lookup))
 	w := httptest.NewRecorder()
 	handler.ServeHTTP(w, req)
 

proxy/internal/debug/handler.go

@@ -131,7 +131,7 @@ func (h *Handler) SetCertStatus(cs certStatus) {
 
 // SetInboundProvider wires per-account inbound listener observability.
 // Pass nil (or skip the call) to keep the inbound section out of debug
-// responses on proxies that don't run --private.
+// responses on proxies that don't run --private-inbound.
 func (h *Handler) SetInboundProvider(p InboundProvider) {
 	h.inbound = p
 }

proxy/internal/proxy/reverseproxy.go

@@ -66,22 +66,6 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Loop guard for private services: a peer that hosts the target
-	// dialing its own service URL would round-trip its own traffic
-	// through the proxy and back over WG to itself. Refuse the request
-	// with 421 (Misdirected Request) so the caller sees an explicit
-	// error instead of silently doubling tunnel traffic.
-	if p.isSelfTargetLoop(r, result.target.URL) {
-		if cd := CapturedDataFromContext(r.Context()); cd != nil {
-			cd.SetOrigin(OriginNoRoute)
-		}
-		requestID := getRequestID(r)
-		web.ServeErrorPage(w, r, http.StatusMisdirectedRequest, "Loop Detected",
-			"This peer is the target of the requested service. Reach the backend directly instead of dialing the public service URL from the same machine.",
-			requestID, web.ErrorStatus{Proxy: true, Destination: false})
-		return
-	}
-
 	ctx := r.Context()
 	// Set the account ID in the context for the roundtripper to use.
 	ctx = roundtrip.WithAccountID(ctx, result.accountID)
@@ -123,32 +107,6 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rp.ServeHTTP(w, r.WithContext(ctx))
 }
 
-// isSelfTargetLoop reports whether an overlay-origin request is about to
-// be forwarded back to the very peer that initiated it. The detection
-// is intentionally narrow: it only fires when the request arrived on
-// the per-account inbound (overlay) listener (so we're confident the
-// source address is the caller's tunnel IP), and only when the resolved
-// target host matches that tunnel IP. Catching this here returns 421 to
-// the caller instead of letting the proxy round-trip its own traffic
-// over WG twice.
-func (p *ReverseProxy) isSelfTargetLoop(r *http.Request, target *url.URL) bool {
-	if target == nil {
-		return false
-	}
-	if !types.IsOverlayOrigin(r.Context()) {
-		return false
-	}
-	srcIP := extractHostIP(r.RemoteAddr)
-	if !srcIP.IsValid() {
-		return false
-	}
-	targetIP, err := netip.ParseAddr(target.Hostname())
-	if err != nil {
-		return false
-	}
-	return srcIP.Unmap() == targetIP.Unmap()
-}
-
 // rewriteFunc returns a Rewrite function for httputil.ReverseProxy that rewrites
 // inbound requests to target the backend service while setting security-relevant
 // forwarding headers and stripping proxy authentication credentials.

proxy/internal/proxy/reverseproxy_test.go

@@ -20,7 +20,6 @@ import (
 
 	"github.com/netbirdio/netbird/proxy/auth"
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
-	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
 )
 
@@ -1286,103 +1285,6 @@ func TestStampNetBirdIdentity_OmitsGroupsHeaderWhenAllInvalid(t *testing.T) {
 		"X-NetBird-Groups must not be set when every group label is rejected")
 }
 
-// nopOKTransport returns 200 for every request without dialing — used
-// by the self-target-loop tests so the non-loop cases don't pay a real
-// TCP-dial timeout.
-type nopOKTransport struct{}
-
-func (nopOKTransport) RoundTrip(*http.Request) (*http.Response, error) {
-	return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody, Header: http.Header{}}, nil
-}
-
-// TestServeHTTP_SelfTargetLoopReturns421 covers the loop guard for
-// private services: when a peer dials a service whose only target is
-// the peer itself, the proxy must refuse with 421 (Misdirected
-// Request) rather than round-tripping the request back over WG to
-// the same peer.
-func TestServeHTTP_SelfTargetLoopReturns421(t *testing.T) {
-	rp := NewReverseProxy(nopOKTransport{}, "auto", nil, nil)
-	rp.AddMapping(Mapping{
-		ID:        "svc-1",
-		AccountID: "acct-1",
-		Host:      "private.svc",
-		Paths: map[string]*PathTarget{
-			"/": {
-				URL: &url.URL{Scheme: "http", Host: "100.64.0.5:8080"},
-			},
-		},
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "http://private.svc/", nil)
-	req.Host = "private.svc"
-	req.RemoteAddr = "100.64.0.5:55555"
-	req = req.WithContext(types.WithOverlayOrigin(req.Context()))
-	rec := httptest.NewRecorder()
-
-	rp.ServeHTTP(rec, req)
-
-	assert.Equal(t, http.StatusMisdirectedRequest, rec.Code,
-		"a peer dialing a service whose target is itself must get 421")
-}
-
-// TestServeHTTP_SelfTargetLoop_NonOverlayRequestPassesThrough verifies
-// the guard is scoped to overlay-origin requests. A public-listener
-// request that happens to share a source IP with the target host must
-// not be misinterpreted as a loop — the gating relies on the inbound
-// marker being attached only by the per-account overlay listener.
-func TestServeHTTP_SelfTargetLoop_NonOverlayRequestPassesThrough(t *testing.T) {
-	rp := NewReverseProxy(nopOKTransport{}, "auto", nil, nil)
-	rp.AddMapping(Mapping{
-		ID:        "svc-1",
-		AccountID: "acct-1",
-		Host:      "public.svc",
-		Paths: map[string]*PathTarget{
-			"/": {
-				URL: &url.URL{Scheme: "http", Host: "100.64.0.5:8080"},
-			},
-		},
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "http://public.svc/", nil)
-	req.Host = "public.svc"
-	req.RemoteAddr = "100.64.0.5:55555"
-	// No WithOverlayOrigin → the guard must not fire.
-	rec := httptest.NewRecorder()
-
-	rp.ServeHTTP(rec, req)
-
-	assert.NotEqual(t, http.StatusMisdirectedRequest, rec.Code,
-		"a non-overlay request with a colliding source IP must not be flagged as a loop")
-}
-
-// TestServeHTTP_SelfTargetLoop_OverlayDifferentIPPassesThrough confirms
-// that overlay-origin requests with a source IP that does *not* match
-// the target host are forwarded normally.
-func TestServeHTTP_SelfTargetLoop_OverlayDifferentIPPassesThrough(t *testing.T) {
-	rp := NewReverseProxy(nopOKTransport{}, "auto", nil, nil)
-	rp.AddMapping(Mapping{
-		ID:        "svc-1",
-		AccountID: "acct-1",
-		Host:      "private.svc",
-		Paths: map[string]*PathTarget{
-			"/": {
-				URL: &url.URL{Scheme: "http", Host: "100.64.0.5:8080"},
-			},
-		},
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "http://private.svc/", nil)
-	req.Host = "private.svc"
-	req.RemoteAddr = "100.64.0.99:55555" // different from the target
-	req = req.WithContext(types.WithOverlayOrigin(req.Context()))
-	rec := httptest.NewRecorder()
-
-	rp.ServeHTTP(rec, req)
-
-	assert.NotEqual(t, http.StatusMisdirectedRequest, rec.Code,
-		"overlay request with a non-matching source IP must not be flagged as a loop")
-}
-
 // TestStampNetBirdIdentity_CapturedDataPresentButEmpty covers requests
 // that carry CapturedData with no identity fields populated (e.g. the
 // auth middleware ran but the request didn't authenticate). Both

proxy/internal/roundtrip/netbird.go

@@ -152,7 +152,6 @@ type managementClient interface {
 // backed by underlying NetBird connections.
 // Clients are keyed by AccountID, allowing multiple services to share the same connection.
 type NetBird struct {
-	ctx          context.Context
 	proxyID      string
 	proxyAddr    string
 	clientCfg    ClientConfig
@@ -214,11 +213,7 @@ func (n *NetBird) AddPeer(ctx context.Context, accountID types.AccountID, key Se
 		}).Debug("registered service with existing client")
 
 		if started && n.statusNotifier != nil {
-			// Use a background context, not the caller's: the management
-			// connection notification must land even if the request /
-			// stream that triggered this registration is cancelled.
-			// Mirrors the async runClientStartup path.
-			if err := n.statusNotifier.NotifyStatus(context.Background(), accountID, serviceID, true); err != nil {
+			if err := n.statusNotifier.NotifyStatus(ctx, accountID, serviceID, true); err != nil {
 				n.logger.WithFields(log.Fields{
 					"account_id":  accountID,
 					"service_key": key,
@@ -247,10 +242,8 @@ func (n *NetBird) AddPeer(ctx context.Context, accountID types.AccountID, key Se
 	}).Info("created new client for account")
 
 	// Attempt to start the client in the background; if this fails we will
-	// retry on the first request via RoundTrip. runClientStartup uses its
-	// own background context so the caller's request-scoped ctx can't
-	// cancel the inbound bring-up.
-	go n.runClientStartup(accountID, entry.client)
+	// retry on the first request via RoundTrip.
+	go n.runClientStartup(ctx, accountID, entry.client)
 
 	return nil
 }
@@ -314,7 +307,7 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		ManagementURL: n.clientCfg.MgmtAddr,
 		PrivateKey:    privateKey.String(),
 		LogLevel:      log.WarnLevel.String(),
-		BlockInbound:  n.clientCfg.BlockInbound,
+		BlockInbound:   n.clientCfg.BlockInbound,
 		// The embedded proxy peer must never be a stepping stone into
 		// the proxy host's LAN: it only exists to reach NetBird mesh
 		// targets or, when direct_upstream is set, the host network
@@ -362,14 +355,8 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 	}, nil
 }
 
-// runClientStartup starts the client and notifies registered services on
-// success. This function runs in a goroutine launched from AddPeer, so it
-// must never inherit the caller's request-scoped context — a canceled
-// request must not abort the inbound listener bring-up or the management
-// status notification. The embedded client.Start gets its own bounded
-// startCtx; once Start succeeds, notifyClientReady takes over with a
-// fresh context.Background() (see that function for the contract).
-func (n *NetBird) runClientStartup(accountID types.AccountID, client *embed.Client) {
+// runClientStartup starts the client and notifies registered services on success.
+func (n *NetBird) runClientStartup(ctx context.Context, accountID types.AccountID, client *embed.Client) {
 	startCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -382,17 +369,7 @@ func (n *NetBird) runClientStartup(accountID types.AccountID, client *embed.Clie
 		return
 	}
 
-	n.notifyClientReady(accountID, client)
-}
-
-// notifyClientReady marks the account's client as started, fires the
-// readyHandler hook, and notifies management of the new tunnel
-// connection for every registered service. It is split out of
-// runClientStartup so a regression test can drive the post-Start tail
-// without needing a live embedded client. The contract that the
-// hooks/notifier see context.Background() — never the AddPeer caller's
-// ctx — lives here.
-func (n *NetBird) notifyClientReady(accountID types.AccountID, client *embed.Client) {
+	// Mark client as started and collect services to notify outside the lock.
 	n.clientsMux.Lock()
 	entry, exists := n.clients[accountID]
 	if exists {
@@ -408,7 +385,7 @@ func (n *NetBird) notifyClientReady(accountID types.AccountID, client *embed.Cli
 	n.clientsMux.Unlock()
 
 	if readyHandler != nil {
-		state := readyHandler(n.ctx, accountID, client)
+		state := readyHandler(ctx, accountID, client)
 		n.clientsMux.Lock()
 		if e, ok := n.clients[accountID]; ok {
 			e.inbound = state
@@ -427,7 +404,7 @@ func (n *NetBird) notifyClientReady(accountID types.AccountID, client *embed.Cli
 		return
 	}
 	for _, sn := range toNotify {
-		if err := n.statusNotifier.NotifyStatus(n.ctx, accountID, sn.serviceID, true); err != nil {
+		if err := n.statusNotifier.NotifyStatus(ctx, accountID, sn.serviceID, true); err != nil {
 			n.logger.WithFields(log.Fields{
 				"account_id":  accountID,
 				"service_key": sn.key,
@@ -689,12 +666,11 @@ func (n *NetBird) ListClientsForStartup() map[types.AccountID]*embed.Client {
 // NewNetBird creates a new NetBird transport. Set clientCfg.WGPort to 0 for a random
 // OS-assigned port. A fixed port only works with single-account deployments;
 // multiple accounts will fail to bind the same port.
-func NewNetBird(ctx context.Context, proxyID, proxyAddr string, clientCfg ClientConfig, logger *log.Logger, notifier statusNotifier, mgmtClient managementClient) *NetBird {
+func NewNetBird(proxyID, proxyAddr string, clientCfg ClientConfig, logger *log.Logger, notifier statusNotifier, mgmtClient managementClient) *NetBird {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}
 	return &NetBird{
-		ctx:            ctx,
 		proxyID:        proxyID,
 		proxyAddr:      proxyAddr,
 		clientCfg:      clientCfg,

proxy/internal/roundtrip/netbird_test.go

@@ -11,7 +11,6 @@ import (
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
@@ -31,15 +30,12 @@ type statusCall struct {
 	accountID types.AccountID
 	serviceID types.ServiceID
 	connected bool
-	// ctx is captured so tests can assert the notifier received a
-	// fresh background context rather than an inherited request ctx.
-	ctx context.Context
 }
 
-func (m *mockStatusNotifier) NotifyStatus(ctx context.Context, accountID types.AccountID, serviceID types.ServiceID, connected bool) error {
+func (m *mockStatusNotifier) NotifyStatus(_ context.Context, accountID types.AccountID, serviceID types.ServiceID, connected bool) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	m.statuses = append(m.statuses, statusCall{accountID, serviceID, connected, ctx})
+	m.statuses = append(m.statuses, statusCall{accountID, serviceID, connected})
 	return nil
 }
 
@@ -52,7 +48,7 @@ func (m *mockStatusNotifier) calls() []statusCall {
 // mockNetBird creates a NetBird instance for testing without actually connecting.
 // It uses an invalid management URL to prevent real connections.
 func mockNetBird() *NetBird {
-	return NewNetBird(context.Background(), "test-proxy", "invalid.test", ClientConfig{
+	return NewNetBird("test-proxy", "invalid.test", ClientConfig{
 		MgmtAddr:     "http://invalid.test:9999",
 		WGPort:       0,
 		PreSharedKey: "",
@@ -283,7 +279,7 @@ func TestNetBird_RoundTrip_RequiresExistingClient(t *testing.T) {
 
 func TestNetBird_AddPeer_ExistingStartedClient_NotifiesStatus(t *testing.T) {
 	notifier := &mockStatusNotifier{}
-	nb := NewNetBird(context.Background(), "test-proxy", "invalid.test", ClientConfig{
+	nb := NewNetBird("test-proxy", "invalid.test", ClientConfig{
 		MgmtAddr:     "http://invalid.test:9999",
 		WGPort:       0,
 		PreSharedKey: "",
@@ -299,12 +295,8 @@ func TestNetBird_AddPeer_ExistingStartedClient_NotifiesStatus(t *testing.T) {
 	nb.clients[accountID].started = true
 	nb.clientsMux.Unlock()
 
-	// Add second service with an already-cancelled caller context —
-	// should notify immediately (client is started) AND the notification
-	// must not inherit the cancelled ctx.
-	cancelledCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-	err = nb.AddPeer(cancelledCtx, accountID, "domain2.test", "key-1", types.ServiceID("svc-2"))
+	// Add second service — should notify immediately since client is already started.
+	err = nb.AddPeer(context.Background(), accountID, "domain2.test", "key-1", types.ServiceID("svc-2"))
 	require.NoError(t, err)
 
 	calls := notifier.calls()
@@ -312,9 +304,6 @@ func TestNetBird_AddPeer_ExistingStartedClient_NotifiesStatus(t *testing.T) {
 	assert.Equal(t, accountID, calls[0].accountID)
 	assert.Equal(t, types.ServiceID("svc-2"), calls[0].serviceID)
 	assert.True(t, calls[0].connected)
-	require.NotNil(t, calls[0].ctx, "NotifyStatus must receive a context")
-	require.NoError(t, calls[0].ctx.Err(),
-		"already-started NotifyStatus must use a background ctx, not the cancelled caller ctx")
 }
 
 // TestNetBird_IdentityForIP_UnknownAccountReturnsFalse confirms that the
@@ -349,7 +338,7 @@ func TestClientEntry_IdentityForIP_InvalidIPReturnsFalse(t *testing.T) {
 
 func TestNetBird_RemovePeer_NotifiesDisconnection(t *testing.T) {
 	notifier := &mockStatusNotifier{}
-	nb := NewNetBird(context.Background(), "test-proxy", "invalid.test", ClientConfig{
+	nb := NewNetBird("test-proxy", "invalid.test", ClientConfig{
 		MgmtAddr:     "http://invalid.test:9999",
 		WGPort:       0,
 		PreSharedKey: "",
@@ -371,53 +360,3 @@ func TestNetBird_RemovePeer_NotifiesDisconnection(t *testing.T) {
 	assert.Equal(t, types.ServiceID("svc-1"), calls[0].serviceID)
 	assert.False(t, calls[0].connected)
 }
-
-// TestNotifyClientReady_UsesBackgroundCtx pins the contract that the
-// post-Start hooks (readyHandler + statusNotifier.NotifyStatus) run on
-// a fresh context.Background() rather than inheriting the AddPeer
-// caller's request- or stream-scoped ctx. Without this, a cancelled
-// caller ctx could abort the inbound listener bring-up or cause the
-// management status notification to fail spuriously and leave the
-// account in a half-connected state.
-func TestNotifyClientReady_UsesBackgroundCtx(t *testing.T) {
-	notifier := &mockStatusNotifier{}
-	nb := NewNetBird(context.Background(), "test-proxy", "invalid.test", ClientConfig{
-		MgmtAddr: "http://invalid.test:9999",
-	}, nil, notifier, &mockMgmtClient{})
-
-	accountID := types.AccountID("acct-async")
-	// Pre-populate a client entry so notifyClientReady has something
-	// to mark started + something to enumerate for NotifyStatus.
-	nb.clientsMux.Lock()
-	nb.clients[accountID] = &clientEntry{
-		services: map[ServiceKey]serviceInfo{
-			DomainServiceKey("svc.example"): {serviceID: types.ServiceID("svc-1")},
-		},
-	}
-	nb.clientsMux.Unlock()
-
-	var capturedReadyCtx context.Context
-	nb.SetClientLifecycle(
-		func(ctx context.Context, _ types.AccountID, _ *embed.Client) any {
-			capturedReadyCtx = ctx
-			return nil
-		},
-		nil,
-	)
-
-	// Drive the post-Start path directly; a real client.Start would
-	// need a working management URL.
-	nb.notifyClientReady(accountID, nil)
-
-	require.NotNil(t, capturedReadyCtx, "readyHandler must have been invoked")
-	require.NoError(t, capturedReadyCtx.Err(),
-		"readyHandler must receive a background context, not an inherited cancelled one")
-	deadline, ok := capturedReadyCtx.Deadline()
-	assert.False(t, ok, "readyHandler ctx must have no deadline (background); got %v", deadline)
-
-	calls := notifier.calls()
-	require.Len(t, calls, 1, "NotifyStatus must be invoked once per registered service")
-	require.NotNil(t, calls[0].ctx, "NotifyStatus must receive a context")
-	require.NoError(t, calls[0].ctx.Err(),
-		"NotifyStatus must receive a background context, not an inherited cancelled one")
-}

proxy/internal/tcp/router_test.go

@@ -1781,14 +1781,11 @@ func TestRouter_PlainHTTP_RoutesToPlainChannel(t *testing.T) {
 		}
 	}()
 
-	tlsListener, ok := router.HTTPListener().(*chanListener)
-	require.True(t, ok, "router.HTTPListener() must be the test's chanListener; the test relies on observing its channel directly")
-
 	select {
 	case conn := <-acceptDone:
 		require.NotNil(t, conn)
 		_ = conn.Close()
-	case <-tlsListener.ch:
+	case <-router.HTTPListener().(*chanListener).ch:
 		t.Fatal("plain HTTP request leaked into TLS channel")
 	case <-time.After(3 * time.Second):
 		t.Fatal("plain HTTP connection never reached plain channel")

proxy/lifecycle.go

@@ -1,7 +1,6 @@
 package proxy
 
 import (
-	"context"
 	"net/netip"
 	"time"
 
@@ -21,17 +20,14 @@ import (
 type Config struct {
 	// ListenAddr is the TCP address the main listener binds. Required.
 	ListenAddr string
-	// ID identifies this proxy instance to management. Empty values are
-	// replaced with a timestamped default at Server.Start time (see
-	// initDefaults), not in New.
+	// ID identifies this proxy instance to management. Empty value lets
+	// New generate a timestamped default.
 	ID string
-	// Logger is the logrus logger used everywhere. Empty values fall
-	// back to log.StandardLogger() at Server.Start time (see
-	// initDefaults), not in New.
+	// Logger is the logrus logger used everywhere. Empty value falls back
+	// to log.StandardLogger().
 	Logger *log.Logger
 	// Version is the build version string reported to management. Empty
-	// values are replaced with "dev" at Server.Start time (see
-	// initDefaults), not in New.
+	// becomes "dev".
 	Version string
 	// ProxyURL is the public address operators use to reach this proxy.
 	ProxyURL string
@@ -129,9 +125,8 @@ type Config struct {
 // bound — call Start to bring the proxy up. Returning a fully-formed
 // Server keeps the standalone code path (which still constructs Server
 // directly) byte-for-byte equivalent.
-func New(ctx context.Context, cfg Config) *Server {
+func New(cfg Config) *Server {
 	return &Server{
-		ctx:                      ctx,
 		ListenAddr:               cfg.ListenAddr,
 		ID:                       cfg.ID,
 		Logger:                   cfg.Logger,

proxy/process_mappings_bench_test.go

@@ -73,7 +73,7 @@ func benchServerWithLatency(b *testing.B, createPeerDelay, statusDelay time.Dura
 		statusUpdateDelay: statusDelay,
 	}
 
-	nb := roundtrip.NewNetBird(b.Context(), "bench-proxy", "bench.test",
+	nb := roundtrip.NewNetBird("bench-proxy", "bench.test",
 		roundtrip.ClientConfig{MgmtAddr: "http://bench.test:9999"},
 		logger, nil, mgmtClient)
 

proxy/server.go

@@ -75,7 +75,6 @@ type portRouter struct {
 }
 
 type Server struct {
-	ctx           context.Context
 	mgmtClient    proto.ProxyServiceClient
 	proxy         *proxy.ReverseProxy
 	netbird       *roundtrip.NetBird
@@ -282,7 +281,7 @@ func (s *Server) NotifyCertificateIssued(ctx context.Context, accountID types.Ac
 }
 
 // inboundListenerProto resolves the per-account inbound listener state for
-// the SendStatusUpdate payload. Returns nil when --private is off
+// the SendStatusUpdate payload. Returns nil when --private-inbound is off
 // or the account has no live listener so management treats the field as
 // absent.
 func (s *Server) inboundListenerProto(accountID types.AccountID) *proto.ProxyInboundListener {
@@ -529,10 +528,10 @@ func (s *Server) initManagementClient() error {
 }
 
 // initNetBirdClient builds the multi-tenant embedded NetBird client used
-// for outbound RoundTripping and (when --private is on) per-account
+// for outbound RoundTripping and (when --private-inbound is on) per-account
 // inbound listeners.
 func (s *Server) initNetBirdClient() {
-	s.netbird = roundtrip.NewNetBird(s.ctx, s.ID, s.ProxyURL, roundtrip.ClientConfig{
+	s.netbird = roundtrip.NewNetBird(s.ID, s.ProxyURL, roundtrip.ClientConfig{
 		MgmtAddr:     s.ManagementAddress,
 		WGPort:       s.WireguardPort,
 		PreSharedKey: s.PreSharedKey,

proxy/server_test.go

@@ -64,7 +64,7 @@ func quietLifecycleLogger() *log.Logger {
 }
 
 func TestStopBeforeStartIsNoOp(t *testing.T) {
-	srv := New(t.Context(), Config{Logger: quietLifecycleLogger()})
+	srv := New(Config{Logger: quietLifecycleLogger()})
 
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
@@ -77,7 +77,7 @@ func TestStopBeforeStartIsNoOp(t *testing.T) {
 }
 
 func TestStartFailsWithoutManagement(t *testing.T) {
-	srv := New(t.Context(), Config{
+	srv := New(Config{
 		Logger:            quietLifecycleLogger(),
 		ListenAddr:        "127.0.0.1:0",
 		ManagementAddress: "://broken-url",
@@ -137,7 +137,7 @@ func TestRecordRunErrPreservesFirstFailure(t *testing.T) {
 }
 
 func TestStopSkipsShutdownWhenNeverStarted(t *testing.T) {
-	srv := New(t.Context(), Config{Logger: quietLifecycleLogger()})
+	srv := New(Config{Logger: quietLifecycleLogger()})
 
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()