[signal,proxy,relay] Add service configuration examples

Operators need concrete schemas for the new config-file flags.

Add validated YAML examples for Relay/STUN, Signal, and Proxy.

relay/cmd/config_test.go

@@ -9,6 +9,20 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestExampleConfig(t *testing.T) {
+	require.NoError(t, rootCmd.ParseFlags(nil))
+	oldConfigPath := configPath
+	configPath = filepath.Join("..", "config.example.yaml")
+	t.Cleanup(func() {
+		configPath = oldConfigPath
+	})
+
+	cfg, err := loadConfig(rootCmd)
+	require.NoError(t, err)
+	assert.Equal(t, "rels://relay.example.com:443", cfg.ExposedAddress, "Example config should load")
+	assert.True(t, cfg.EnableSTUN, "Example config should enable STUN")
+}
+
 func TestLoadConfigPrecedence(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "relay.yaml")
 	require.NoError(t, os.WriteFile(path, []byte(`

relay/config.example.yaml

@@ -0,0 +1,22 @@
+# Command-line flags override environment variables, which override this file.
+listenAddress: ":443"
+exposedAddress: "rels://relay.example.com:443"
+metricsPort: 9090
+
+# Use either static certificates or Let's Encrypt.
+letsencryptEmail: ""
+letsencryptDataDir: ""
+letsencryptDomains: []
+letsencryptAWSRoute53: false
+tlsCertFile: "/etc/netbird/tls.crt"
+tlsKeyFile: "/etc/netbird/tls.key"
+
+authSecret: "replace-with-a-strong-secret"
+logLevel: "info"
+logFile: "console"
+healthcheckListenAddress: ":9000"
+trustedProxies: ""
+
+enableSTUN: true
+stunPorts: [3478]
+stunLogLevel: "info"