[management,signal,proxy,relay,misc] Restore legacy config wiring

combined/cmd/config.go

@@ -441,8 +441,9 @@ func (c *CombinedConfig) autoConfigureClientSettings(exposedProto, exposedHost,
 // LoadConfig loads the combined server configuration.
 func LoadConfig(configPath string) (*CombinedConfig, error) {
 	cfg, err := configloader.Load(configPath, DefaultConfig(), configloader.Options{
-		TagName:      "yaml",
-		AllowMissing: configPath == "",
+		TagName:           "yaml",
+		AllowMissing:      configPath == "",
+		DecodeErrorPrefix: "failed to parse config file",
 	})
 	if err != nil {
 		return nil, err

management/cmd/admin.go

@@ -114,7 +114,7 @@ func withAdminConfig(cmd *cobra.Command, applyIDPDefaults bool, fn func(ctx cont
 }
 
 func loadAdminMgmtConfig(ctx context.Context, applyIDPDefaults bool) (*nbconfig.Config, string, error) {
-	config, err := loadManagementConfig(nbconfig.MgmtConfigPath)
+	config, err := decodeManagementConfig(nbconfig.MgmtConfigPath, &nbconfig.Config{})
 	if err != nil {
 		return nil, "", err
 	}

management/cmd/config.go

@@ -7,10 +7,7 @@ import (
 )
 
 func loadManagementConfig(configPath string) (*nbconfig.Config, error) {
-	cfg, err := configloader.Load(configPath, &nbconfig.Config{Datadir: defaultMgmtDataDir}, configloader.Options{
-		TagName:   "json",
-		Transform: envtemplate.Expand,
-	})
+	cfg, err := decodeManagementConfig(configPath, &nbconfig.Config{Datadir: defaultMgmtDataDir})
 	if err != nil {
 		return nil, err
 	}
@@ -19,3 +16,10 @@ func loadManagementConfig(configPath string) (*nbconfig.Config, error) {
 	}
 	return cfg, nil
 }
+
+func decodeManagementConfig(configPath string, defaults *nbconfig.Config) (*nbconfig.Config, error) {
+	return configloader.Load(configPath, defaults, configloader.Options{
+		TagName:   "json",
+		Transform: envtemplate.Expand,
+	})
+}

management/cmd/management.go

@@ -71,7 +71,7 @@ var (
 			}
 
 			var tlsEnabled bool
-			if config.HttpConfig.LetsEncryptDomain != "" || (config.HttpConfig.CertFile != "" && config.HttpConfig.CertKey != "") {
+			if mgmtLetsencryptDomain != "" || (config.HttpConfig.CertFile != "" && config.HttpConfig.CertKey != "") {
 				tlsEnabled = true
 			}
 
@@ -212,15 +212,15 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string, flags *pflag.Fla
 }
 
 // ApplyCommandLineOverrides applies command-line flag overrides to the config
-func ApplyCommandLineOverrides(cfg *nbconfig.Config, flags *pflag.FlagSet) {
-	hasCertOverride := flags.Changed("cert-key") && flags.Changed("cert-file")
-	if (flags.Changed("letsencrypt-domain") || hasCertOverride) && cfg.HttpConfig == nil {
+func ApplyCommandLineOverrides(cfg *nbconfig.Config, _ *pflag.FlagSet) {
+	hasCertOverride := certKey != "" && certFile != ""
+	if (mgmtLetsencryptDomain != "" || hasCertOverride) && cfg.HttpConfig == nil {
 		cfg.HttpConfig = &nbconfig.HttpServerConfig{}
 	}
-	if flags.Changed("letsencrypt-domain") {
+	if mgmtLetsencryptDomain != "" {
 		cfg.HttpConfig.LetsEncryptDomain = mgmtLetsencryptDomain
 	}
-	if flags.Changed("datadir") {
+	if mgmtDataDir != "" {
 		cfg.Datadir = mgmtDataDir
 	}
 	if hasCertOverride {
@@ -378,11 +378,17 @@ func EnsureEncryptionKey(ctx context.Context, configPath string, cfg *nbconfig.C
 	if err != nil {
 		return fmt.Errorf("failed to generate datastore encryption key: %v", err)
 	}
-	cfg.DataStoreEncryptionKey = key
 
-	if err := util.DirectWriteJson(ctx, configPath, cfg); err != nil {
+	fileConfig, err := decodeManagementConfig(configPath, &nbconfig.Config{})
+	if err != nil {
+		return fmt.Errorf("reload config before saving encryption key: %w", err)
+	}
+	fileConfig.DataStoreEncryptionKey = key
+	if err := util.DirectWriteJson(ctx, configPath, fileConfig); err != nil {
 		return fmt.Errorf("failed to save config with new encryption key: %v", err)
 	}
+
+	cfg.DataStoreEncryptionKey = key
 	log.WithContext(ctx).Infof("DataStoreEncryptionKey generated and saved to config")
 	return nil
 }

proxy/cmd/proxy/cmd/config.go

@@ -1,19 +1,24 @@
 package cmd
 
 import (
+	"fmt"
+	"os"
+	"strconv"
+
 	"github.com/spf13/cobra"
 	"golang.org/x/crypto/acme"
 
 	"github.com/netbirdio/netbird/proxy"
+	"github.com/netbirdio/netbird/trustedproxy"
 	configloader "github.com/netbirdio/netbird/util/config"
 )
 
 type commandConfig struct {
-	proxy.Config `yaml:",squash"`
+	proxy.Config `yaml:",inline"`
 
 	LogLevel            string  `yaml:"logLevel" env:"NB_PROXY_LOG_LEVEL" flag:"log-level"`
-	PreallocatedBuffers *uint32 `yaml:"preallocatedBuffers" env:"NB_PROXY_PREALLOCATED_BUFFERS"`
-	MaxBatchSize        *uint32 `yaml:"maxBatchSize" env:"NB_PROXY_MAX_BATCH_SIZE"`
+	PreallocatedBuffers *uint32 `yaml:"preallocatedBuffers" env:"-"`
+	MaxBatchSize        *uint32 `yaml:"maxBatchSize" env:"-"`
 }
 
 func defaultConfig() *commandConfig {
@@ -28,7 +33,9 @@ func defaultConfig() *commandConfig {
 			ACMEDirectory:        acme.LetsEncryptURL,
 			ACMEChallengeType:    "tls-alpn-01",
 			CertLockMethod:       "auto",
+			DebugEndpointAddress: "localhost:8444",
 			HealthAddr:           "localhost:8080",
+			TrustedProxies:       trustedproxy.FromPrefixes(nil),
 			ForwardedProto:       "auto",
 			SupportsCustomPorts:  true,
 			GeoDataDir:           "/var/lib/netbird/geolocation",
@@ -38,10 +45,40 @@ func defaultConfig() *commandConfig {
 }
 
 func loadConfig(cmd *cobra.Command, configPath string) (*commandConfig, error) {
-	return configloader.Load(configPath, defaultConfig(), configloader.Options{
-		TagName:      "yaml",
-		AllowMissing: configPath == "",
-		FlagSet:      cmd.Flags(),
-		Strict:       true,
+	cfg, err := configloader.Load(configPath, defaultConfig(), configloader.Options{
+		TagName:            "yaml",
+		AllowMissing:       configPath == "",
+		FlagSet:            cmd.Flags(),
+		Strict:             true,
+		InvalidEnvironment: configloader.InvalidEnvironmentIgnore,
 	})
+	if err != nil {
+		return nil, err
+	}
+	if err := applyPerformanceEnvironment(cfg); err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+func applyPerformanceEnvironment(cfg *commandConfig) error {
+	for _, setting := range []struct {
+		name   string
+		target **uint32
+	}{
+		{name: envPreallocatedBuffers, target: &cfg.PreallocatedBuffers},
+		{name: envMaxBatchSize, target: &cfg.MaxBatchSize},
+	} {
+		raw := os.Getenv(setting.name)
+		if raw == "" {
+			continue
+		}
+		parsed, err := strconv.ParseUint(raw, 10, 32)
+		if err != nil {
+			return fmt.Errorf("invalid %s %q: %w", setting.name, raw, err)
+		}
+		value := uint32(parsed)
+		*setting.target = &value
+	}
+	return nil
 }

proxy/cmd/proxy/cmd/root.go

@@ -19,9 +19,12 @@ import (
 	"github.com/netbirdio/netbird/util"
 )
 
-// envPreallocatedBuffers caps the per-tunnel buffer pool. Zero (unset)
-// keeps the upstream uncapped default.
-const envPreallocatedBuffers = "NB_PROXY_PREALLOCATED_BUFFERS"
+const (
+	// envPreallocatedBuffers caps the per-tunnel buffer pool. Zero (unset)
+	// keeps the upstream uncapped default.
+	envPreallocatedBuffers = "NB_PROXY_PREALLOCATED_BUFFERS"
+	envMaxBatchSize        = "NB_PROXY_MAX_BATCH_SIZE"
+)
 
 const DefaultManagementURL = "https://api.netbird.io:443"
 
@@ -138,16 +141,19 @@ func SetVersionInfo(version, commit, buildDate, goVersion string) {
 }
 
 func runServer(cmd *cobra.Command, args []string) error {
+	proxyToken := os.Getenv(envProxyToken)
+	if proxyToken == "" {
+		return fmt.Errorf("proxy token is required: set %s environment variable", envProxyToken)
+	}
+
 	cfg, err := loadConfig(cmd, configPath)
 	if err != nil {
 		return fmt.Errorf("load config: %w", err)
 	}
-	if cfg.ProxyToken == "" {
-		return fmt.Errorf("proxy token is required: set proxyToken or %s", envProxyToken)
-	}
+	cfg.ProxyToken = proxyToken
 
 	level := cfg.LogLevel
-	if debugLogs && (!cmd.Flags().Changed("log-level") || cmd.Flags().Changed("debug")) {
+	if debugLogs {
 		level = "debug"
 	}
 	logger := log.New()

proxy/lifecycle.go

@@ -24,7 +24,7 @@ type Config struct {
 	// ID identifies this proxy instance to management. Empty values are
 	// replaced with a timestamped default at Server.Start time (see
 	// initDefaults), not in New.
-	ID string `yaml:"id" env:"NB_PROXY_ID"`
+	ID string `yaml:"id" env:"-"`
 	// Logger is the logrus logger used everywhere. Empty values fall
 	// back to log.StandardLogger() at Server.Start time (see
 	// initDefaults), not in New.

relay/cmd/root.go

@@ -250,10 +250,11 @@ func execute(cmd *cobra.Command, args []string) error {
 
 func loadConfig(cmd *cobra.Command) (*Config, error) {
 	return configloader.Load(configPath, defaultConfig(), configloader.Options{
-		TagName:      "yaml",
-		AllowMissing: configPath == "",
-		FlagSet:      cmd.Flags(),
-		Strict:       true,
+		TagName:            "yaml",
+		AllowMissing:       configPath == "",
+		FlagSet:            cmd.Flags(),
+		Strict:             true,
+		InvalidEnvironment: configloader.InvalidEnvironmentUsePartial,
 	})
 }
 

signal/cmd/config.go

@@ -12,14 +12,14 @@ import (
 // Config contains Signal service startup configuration.
 type Config struct {
 	Port               int    `yaml:"port" env:"NB_PORT" flag:"port"`
-	MetricsPort        int    `yaml:"metricsPort" env:"NB_METRICS_PORT" flag:"metrics-port"`
+	MetricsPort        int    `yaml:"metricsPort" env:"-" flag:"metrics-port"`
 	LetsencryptDomain  string `yaml:"letsencryptDomain" env:"NB_LETSENCRYPT_DOMAIN" flag:"letsencrypt-domain"`
 	LetsencryptEmail   string `yaml:"letsencryptEmail" env:"NB_LETSENCRYPT_EMAIL" flag:"letsencrypt-email"`
-	LetsencryptDataDir string `yaml:"letsencryptDataDir" env:"NB_LETSENCRYPT_DATA_DIR,NB_SSL_DIR" flag:"letsencrypt-data-dir,ssl-dir"`
+	LetsencryptDataDir string `yaml:"letsencryptDataDir" env:"NB_SSL_DIR,NB_LETSENCRYPT_DATA_DIR" flag:"letsencrypt-data-dir,ssl-dir"`
 	CertFile           string `yaml:"certFile" env:"NB_CERT_FILE" flag:"cert-file"`
 	CertKey            string `yaml:"certKey" env:"NB_CERT_KEY" flag:"cert-key"`
-	LogLevel           string `yaml:"logLevel" env:"NB_LOG_LEVEL" flag:"log-level"`
-	LogFile            string `yaml:"logFile" env:"NB_LOG_FILE" flag:"log-file"`
+	LogLevel           string `yaml:"logLevel" env:"-" flag:"log-level"`
+	LogFile            string `yaml:"logFile" env:"-" flag:"log-file"`
 	PprofAddress       string `yaml:"pprofAddress" env:"NB_PPROF_ADDR"`
 }
 
@@ -37,9 +37,10 @@ func defaultConfig() *Config {
 
 func loadConfig(cmd *cobra.Command, configPath string) (*Config, error) {
 	return configloader.Load(configPath, defaultConfig(), configloader.Options{
-		TagName:      "yaml",
-		AllowMissing: configPath == "",
-		FlagSet:      cmd.Flags(),
-		Strict:       true,
+		TagName:            "yaml",
+		AllowMissing:       configPath == "",
+		FlagSet:            cmd.Flags(),
+		Strict:             true,
+		InvalidEnvironment: configloader.InvalidEnvironmentUsePartial,
 	})
 }

signal/cmd/run.go

@@ -8,6 +8,8 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"os"
+	"strconv"
 	// nolint:gosec
 	_ "net/http/pprof"
 	"time"
@@ -65,13 +67,14 @@ var (
 		Short:        "start NetBird Signal Server daemon",
 		SilenceUsage: true,
 		PreRunE: func(cmd *cobra.Command, args []string) error {
+			userPort := signalPortConfigured(cmd)
 			cfg, err := loadConfig(cmd, signalConfigPath)
 			if err != nil {
 				return fmt.Errorf("load config: %w", err)
 			}
 			applyConfig(cfg)
 
-			if signalPort == 0 {
+			if !userPort && signalPort == 0 {
 				if signalLetsencryptDomain != "" || (signalCertFile != "" && signalCertKey != "") {
 					signalPort = 443
 				} else {
@@ -322,6 +325,17 @@ func loadTLSConfig(certFile string, certKey string) (*tls.Config, error) {
 
 	return config, nil
 }
+func signalPortConfigured(cmd *cobra.Command) bool {
+	if cmd.Flag("port").Changed {
+		return true
+	}
+	raw, present := os.LookupEnv("NB_PORT")
+	if !present {
+		return false
+	}
+	_, err := strconv.ParseInt(raw, 0, 64)
+	return err == nil
+}
 
 func init() {
 	defaults := defaultConfig()