From 27d39916f724760eb6fd5e6f76096e4fc961656c Mon Sep 17 00:00:00 2001 From: jnfrati Date: Wed, 2 Sep 2026 17:58:29 +0200 Subject: [PATCH] [management,signal,proxy,relay,misc] Restore legacy config wiring --- combined/cmd/config.go | 5 ++-- management/cmd/admin.go | 2 +- management/cmd/config.go | 12 +++++--- management/cmd/management.go | 22 +++++++++------ proxy/cmd/proxy/cmd/config.go | 53 +++++++++++++++++++++++++++++------ proxy/cmd/proxy/cmd/root.go | 20 ++++++++----- proxy/lifecycle.go | 2 +- relay/cmd/root.go | 9 +++--- signal/cmd/config.go | 17 +++++------ signal/cmd/run.go | 16 ++++++++++- 10 files changed, 114 insertions(+), 44 deletions(-) diff --git a/combined/cmd/config.go b/combined/cmd/config.go index 9ddb3ef52..697383972 100644 --- a/combined/cmd/config.go +++ b/combined/cmd/config.go @@ -441,8 +441,9 @@ func (c *CombinedConfig) autoConfigureClientSettings(exposedProto, exposedHost, // LoadConfig loads the combined server configuration. func LoadConfig(configPath string) (*CombinedConfig, error) { cfg, err := configloader.Load(configPath, DefaultConfig(), configloader.Options{ - TagName: "yaml", - AllowMissing: configPath == "", + TagName: "yaml", + AllowMissing: configPath == "", + DecodeErrorPrefix: "failed to parse config file", }) if err != nil { return nil, err diff --git a/management/cmd/admin.go b/management/cmd/admin.go index 695a51751..8de7e70aa 100644 --- a/management/cmd/admin.go +++ b/management/cmd/admin.go @@ -114,7 +114,7 @@ func withAdminConfig(cmd *cobra.Command, applyIDPDefaults bool, fn func(ctx cont } func loadAdminMgmtConfig(ctx context.Context, applyIDPDefaults bool) (*nbconfig.Config, string, error) { - config, err := loadManagementConfig(nbconfig.MgmtConfigPath) + config, err := decodeManagementConfig(nbconfig.MgmtConfigPath, &nbconfig.Config{}) if err != nil { return nil, "", err } diff --git a/management/cmd/config.go b/management/cmd/config.go index bc8465322..4a7c76725 100644 --- a/management/cmd/config.go +++ b/management/cmd/config.go @@ -7,10 +7,7 @@ import ( ) func loadManagementConfig(configPath string) (*nbconfig.Config, error) { - cfg, err := configloader.Load(configPath, &nbconfig.Config{Datadir: defaultMgmtDataDir}, configloader.Options{ - TagName: "json", - Transform: envtemplate.Expand, - }) + cfg, err := decodeManagementConfig(configPath, &nbconfig.Config{Datadir: defaultMgmtDataDir}) if err != nil { return nil, err } @@ -19,3 +16,10 @@ func loadManagementConfig(configPath string) (*nbconfig.Config, error) { } return cfg, nil } + +func decodeManagementConfig(configPath string, defaults *nbconfig.Config) (*nbconfig.Config, error) { + return configloader.Load(configPath, defaults, configloader.Options{ + TagName: "json", + Transform: envtemplate.Expand, + }) +} diff --git a/management/cmd/management.go b/management/cmd/management.go index 9178150a1..ba0decc7c 100644 --- a/management/cmd/management.go +++ b/management/cmd/management.go @@ -71,7 +71,7 @@ var ( } var tlsEnabled bool - if config.HttpConfig.LetsEncryptDomain != "" || (config.HttpConfig.CertFile != "" && config.HttpConfig.CertKey != "") { + if mgmtLetsencryptDomain != "" || (config.HttpConfig.CertFile != "" && config.HttpConfig.CertKey != "") { tlsEnabled = true } @@ -212,15 +212,15 @@ func LoadMgmtConfig(ctx context.Context, mgmtConfigPath string, flags *pflag.Fla } // ApplyCommandLineOverrides applies command-line flag overrides to the config -func ApplyCommandLineOverrides(cfg *nbconfig.Config, flags *pflag.FlagSet) { - hasCertOverride := flags.Changed("cert-key") && flags.Changed("cert-file") - if (flags.Changed("letsencrypt-domain") || hasCertOverride) && cfg.HttpConfig == nil { +func ApplyCommandLineOverrides(cfg *nbconfig.Config, _ *pflag.FlagSet) { + hasCertOverride := certKey != "" && certFile != "" + if (mgmtLetsencryptDomain != "" || hasCertOverride) && cfg.HttpConfig == nil { cfg.HttpConfig = &nbconfig.HttpServerConfig{} } - if flags.Changed("letsencrypt-domain") { + if mgmtLetsencryptDomain != "" { cfg.HttpConfig.LetsEncryptDomain = mgmtLetsencryptDomain } - if flags.Changed("datadir") { + if mgmtDataDir != "" { cfg.Datadir = mgmtDataDir } if hasCertOverride { @@ -378,11 +378,17 @@ func EnsureEncryptionKey(ctx context.Context, configPath string, cfg *nbconfig.C if err != nil { return fmt.Errorf("failed to generate datastore encryption key: %v", err) } - cfg.DataStoreEncryptionKey = key - if err := util.DirectWriteJson(ctx, configPath, cfg); err != nil { + fileConfig, err := decodeManagementConfig(configPath, &nbconfig.Config{}) + if err != nil { + return fmt.Errorf("reload config before saving encryption key: %w", err) + } + fileConfig.DataStoreEncryptionKey = key + if err := util.DirectWriteJson(ctx, configPath, fileConfig); err != nil { return fmt.Errorf("failed to save config with new encryption key: %v", err) } + + cfg.DataStoreEncryptionKey = key log.WithContext(ctx).Infof("DataStoreEncryptionKey generated and saved to config") return nil } diff --git a/proxy/cmd/proxy/cmd/config.go b/proxy/cmd/proxy/cmd/config.go index b6b682486..fe90537da 100644 --- a/proxy/cmd/proxy/cmd/config.go +++ b/proxy/cmd/proxy/cmd/config.go @@ -1,19 +1,24 @@ package cmd import ( + "fmt" + "os" + "strconv" + "github.com/spf13/cobra" "golang.org/x/crypto/acme" "github.com/netbirdio/netbird/proxy" + "github.com/netbirdio/netbird/trustedproxy" configloader "github.com/netbirdio/netbird/util/config" ) type commandConfig struct { - proxy.Config `yaml:",squash"` + proxy.Config `yaml:",inline"` LogLevel string `yaml:"logLevel" env:"NB_PROXY_LOG_LEVEL" flag:"log-level"` - PreallocatedBuffers *uint32 `yaml:"preallocatedBuffers" env:"NB_PROXY_PREALLOCATED_BUFFERS"` - MaxBatchSize *uint32 `yaml:"maxBatchSize" env:"NB_PROXY_MAX_BATCH_SIZE"` + PreallocatedBuffers *uint32 `yaml:"preallocatedBuffers" env:"-"` + MaxBatchSize *uint32 `yaml:"maxBatchSize" env:"-"` } func defaultConfig() *commandConfig { @@ -28,7 +33,9 @@ func defaultConfig() *commandConfig { ACMEDirectory: acme.LetsEncryptURL, ACMEChallengeType: "tls-alpn-01", CertLockMethod: "auto", + DebugEndpointAddress: "localhost:8444", HealthAddr: "localhost:8080", + TrustedProxies: trustedproxy.FromPrefixes(nil), ForwardedProto: "auto", SupportsCustomPorts: true, GeoDataDir: "/var/lib/netbird/geolocation", @@ -38,10 +45,40 @@ func defaultConfig() *commandConfig { } func loadConfig(cmd *cobra.Command, configPath string) (*commandConfig, error) { - return configloader.Load(configPath, defaultConfig(), configloader.Options{ - TagName: "yaml", - AllowMissing: configPath == "", - FlagSet: cmd.Flags(), - Strict: true, + cfg, err := configloader.Load(configPath, defaultConfig(), configloader.Options{ + TagName: "yaml", + AllowMissing: configPath == "", + FlagSet: cmd.Flags(), + Strict: true, + InvalidEnvironment: configloader.InvalidEnvironmentIgnore, }) + if err != nil { + return nil, err + } + if err := applyPerformanceEnvironment(cfg); err != nil { + return nil, err + } + return cfg, nil +} + +func applyPerformanceEnvironment(cfg *commandConfig) error { + for _, setting := range []struct { + name string + target **uint32 + }{ + {name: envPreallocatedBuffers, target: &cfg.PreallocatedBuffers}, + {name: envMaxBatchSize, target: &cfg.MaxBatchSize}, + } { + raw := os.Getenv(setting.name) + if raw == "" { + continue + } + parsed, err := strconv.ParseUint(raw, 10, 32) + if err != nil { + return fmt.Errorf("invalid %s %q: %w", setting.name, raw, err) + } + value := uint32(parsed) + *setting.target = &value + } + return nil } diff --git a/proxy/cmd/proxy/cmd/root.go b/proxy/cmd/proxy/cmd/root.go index 9aad3d310..65fc586fc 100644 --- a/proxy/cmd/proxy/cmd/root.go +++ b/proxy/cmd/proxy/cmd/root.go @@ -19,9 +19,12 @@ import ( "github.com/netbirdio/netbird/util" ) -// envPreallocatedBuffers caps the per-tunnel buffer pool. Zero (unset) -// keeps the upstream uncapped default. -const envPreallocatedBuffers = "NB_PROXY_PREALLOCATED_BUFFERS" +const ( + // envPreallocatedBuffers caps the per-tunnel buffer pool. Zero (unset) + // keeps the upstream uncapped default. + envPreallocatedBuffers = "NB_PROXY_PREALLOCATED_BUFFERS" + envMaxBatchSize = "NB_PROXY_MAX_BATCH_SIZE" +) const DefaultManagementURL = "https://api.netbird.io:443" @@ -138,16 +141,19 @@ func SetVersionInfo(version, commit, buildDate, goVersion string) { } func runServer(cmd *cobra.Command, args []string) error { + proxyToken := os.Getenv(envProxyToken) + if proxyToken == "" { + return fmt.Errorf("proxy token is required: set %s environment variable", envProxyToken) + } + cfg, err := loadConfig(cmd, configPath) if err != nil { return fmt.Errorf("load config: %w", err) } - if cfg.ProxyToken == "" { - return fmt.Errorf("proxy token is required: set proxyToken or %s", envProxyToken) - } + cfg.ProxyToken = proxyToken level := cfg.LogLevel - if debugLogs && (!cmd.Flags().Changed("log-level") || cmd.Flags().Changed("debug")) { + if debugLogs { level = "debug" } logger := log.New() diff --git a/proxy/lifecycle.go b/proxy/lifecycle.go index 76657a988..8b6660d81 100644 --- a/proxy/lifecycle.go +++ b/proxy/lifecycle.go @@ -24,7 +24,7 @@ type Config struct { // ID identifies this proxy instance to management. Empty values are // replaced with a timestamped default at Server.Start time (see // initDefaults), not in New. - ID string `yaml:"id" env:"NB_PROXY_ID"` + ID string `yaml:"id" env:"-"` // Logger is the logrus logger used everywhere. Empty values fall // back to log.StandardLogger() at Server.Start time (see // initDefaults), not in New. diff --git a/relay/cmd/root.go b/relay/cmd/root.go index a6b6b36d7..d14a4e5cf 100644 --- a/relay/cmd/root.go +++ b/relay/cmd/root.go @@ -250,10 +250,11 @@ func execute(cmd *cobra.Command, args []string) error { func loadConfig(cmd *cobra.Command) (*Config, error) { return configloader.Load(configPath, defaultConfig(), configloader.Options{ - TagName: "yaml", - AllowMissing: configPath == "", - FlagSet: cmd.Flags(), - Strict: true, + TagName: "yaml", + AllowMissing: configPath == "", + FlagSet: cmd.Flags(), + Strict: true, + InvalidEnvironment: configloader.InvalidEnvironmentUsePartial, }) } diff --git a/signal/cmd/config.go b/signal/cmd/config.go index ed6ac2050..066a9a99e 100644 --- a/signal/cmd/config.go +++ b/signal/cmd/config.go @@ -12,14 +12,14 @@ import ( // Config contains Signal service startup configuration. type Config struct { Port int `yaml:"port" env:"NB_PORT" flag:"port"` - MetricsPort int `yaml:"metricsPort" env:"NB_METRICS_PORT" flag:"metrics-port"` + MetricsPort int `yaml:"metricsPort" env:"-" flag:"metrics-port"` LetsencryptDomain string `yaml:"letsencryptDomain" env:"NB_LETSENCRYPT_DOMAIN" flag:"letsencrypt-domain"` LetsencryptEmail string `yaml:"letsencryptEmail" env:"NB_LETSENCRYPT_EMAIL" flag:"letsencrypt-email"` - LetsencryptDataDir string `yaml:"letsencryptDataDir" env:"NB_LETSENCRYPT_DATA_DIR,NB_SSL_DIR" flag:"letsencrypt-data-dir,ssl-dir"` + LetsencryptDataDir string `yaml:"letsencryptDataDir" env:"NB_SSL_DIR,NB_LETSENCRYPT_DATA_DIR" flag:"letsencrypt-data-dir,ssl-dir"` CertFile string `yaml:"certFile" env:"NB_CERT_FILE" flag:"cert-file"` CertKey string `yaml:"certKey" env:"NB_CERT_KEY" flag:"cert-key"` - LogLevel string `yaml:"logLevel" env:"NB_LOG_LEVEL" flag:"log-level"` - LogFile string `yaml:"logFile" env:"NB_LOG_FILE" flag:"log-file"` + LogLevel string `yaml:"logLevel" env:"-" flag:"log-level"` + LogFile string `yaml:"logFile" env:"-" flag:"log-file"` PprofAddress string `yaml:"pprofAddress" env:"NB_PPROF_ADDR"` } @@ -37,9 +37,10 @@ func defaultConfig() *Config { func loadConfig(cmd *cobra.Command, configPath string) (*Config, error) { return configloader.Load(configPath, defaultConfig(), configloader.Options{ - TagName: "yaml", - AllowMissing: configPath == "", - FlagSet: cmd.Flags(), - Strict: true, + TagName: "yaml", + AllowMissing: configPath == "", + FlagSet: cmd.Flags(), + Strict: true, + InvalidEnvironment: configloader.InvalidEnvironmentUsePartial, }) } diff --git a/signal/cmd/run.go b/signal/cmd/run.go index 9c6910312..435376656 100644 --- a/signal/cmd/run.go +++ b/signal/cmd/run.go @@ -8,6 +8,8 @@ import ( "fmt" "net" "net/http" + "os" + "strconv" // nolint:gosec _ "net/http/pprof" "time" @@ -65,13 +67,14 @@ var ( Short: "start NetBird Signal Server daemon", SilenceUsage: true, PreRunE: func(cmd *cobra.Command, args []string) error { + userPort := signalPortConfigured(cmd) cfg, err := loadConfig(cmd, signalConfigPath) if err != nil { return fmt.Errorf("load config: %w", err) } applyConfig(cfg) - if signalPort == 0 { + if !userPort && signalPort == 0 { if signalLetsencryptDomain != "" || (signalCertFile != "" && signalCertKey != "") { signalPort = 443 } else { @@ -322,6 +325,17 @@ func loadTLSConfig(certFile string, certKey string) (*tls.Config, error) { return config, nil } +func signalPortConfigured(cmd *cobra.Command) bool { + if cmd.Flag("port").Changed { + return true + } + raw, present := os.LookupEnv("NB_PORT") + if !present { + return false + } + _, err := strconv.ParseInt(raw, 0, 64) + return err == nil +} func init() { defaults := defaultConfig()