use a defined logger

this should avoid issues with the embedded
client also attempting to use the same global logger

proxy/internal/accesslog/logger.go

@@ -16,11 +16,16 @@ type gRPCClient interface {
 
 type Logger struct {
 	client gRPCClient
+	logger *log.Logger
 }
 
-func NewLogger(client gRPCClient) *Logger {
+func NewLogger(client gRPCClient, logger *log.Logger) *Logger {
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
 	return &Logger{
 		client: client,
+		logger: logger,
 	}
 }
 
@@ -68,7 +73,7 @@ func (l *Logger) log(ctx context.Context, entry logEntry) {
 			},
 		}); err != nil {
 			// If it fails to send on the gRPC connection, then at least log it to the error log.
-			log.WithFields(log.Fields{
+			l.logger.WithFields(log.Fields{
 				"service_id":     entry.ServiceId,
 				"host":           entry.Host,
 				"path":           entry.Path,

proxy/internal/auth/oidc.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
-	log "github.com/sirupsen/logrus"
 	"golang.org/x/oauth2"
 )
 
@@ -165,7 +164,6 @@ func (o *OIDC) handleCallback(w http.ResponseWriter, r *http.Request) {
 	// Exchange code for token
 	token, err := o.oauthConfig.Exchange(r.Context(), code)
 	if err != nil {
-		log.WithError(err).Error("Token exchange failed")
 		http.Error(w, "Authentication failed", http.StatusUnauthorized)
 		return
 	}

proxy/internal/roundtrip/netbird.go

@@ -2,6 +2,7 @@ package roundtrip
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -19,14 +20,19 @@ const deviceNamePrefix = "ingress-"
 // backed by underlying NetBird connections.
 type NetBird struct {
 	mgmtAddr string
+	logger   *log.Logger
 
 	clientsMux sync.RWMutex
 	clients    map[string]*embed.Client
 }
 
-func NewNetBird(mgmtAddr string) *NetBird {
+func NewNetBird(mgmtAddr string, logger *log.Logger) *NetBird {
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
 	return &NetBird{
 		mgmtAddr: mgmtAddr,
+		logger:   logger,
 		clients:  make(map[string]*embed.Client),
 	}
 }
@@ -37,13 +43,29 @@ func (n *NetBird) AddPeer(ctx context.Context, domain, key string) error {
 		ManagementURL: n.mgmtAddr,
 		SetupKey:      key,
 		LogOutput:     io.Discard,
+		BlockInbound:  true,
 	})
 	if err != nil {
 		return fmt.Errorf("create netbird client: %w", err)
 	}
-	if err := client.Start(ctx); err != nil {
-		return fmt.Errorf("start netbird client: %w", err)
-	}
+
+	// Attempt to start the client in the background, if this fails
+	// then it is not ideal, but it isn't the end of the world because
+	// we will try to start the client again before we use it.
+	go func() {
+		startCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+		defer cancel()
+		err = client.Start(startCtx)
+		switch {
+		case errors.Is(err, context.DeadlineExceeded):
+			n.logger.Debug("netbird client timed out")
+			// This is not ideal, but we will try again later.
+			return
+		case err != nil:
+			n.logger.WithField("domain", domain).WithError(err).Error("Unable to start netbird client, will try again later.")
+		}
+	}()
+
 	n.clientsMux.Lock()
 	defer n.clientsMux.Unlock()
 	n.clients[domain] = client
@@ -78,7 +100,20 @@ func (n *NetBird) RoundTrip(req *http.Request) (*http.Response, error) {
 		return nil, fmt.Errorf("no peer connection found for host: %s", req.Host)
 	}
 
-	log.WithFields(log.Fields{
+	// Attempt to start the client, if the client is already running then
+	// it will return an error that we ignore, if this hits a timeout then
+	// this request is unprocessable.
+	startCtx, cancel := context.WithTimeout(req.Context(), 3*time.Second)
+	defer cancel()
+	err := client.Start(startCtx)
+	switch {
+	case errors.Is(err, embed.ErrClientAlreadyStarted):
+		break
+	case err != nil:
+		return nil, fmt.Errorf("start netbird client: %w", err)
+	}
+
+	n.logger.WithFields(log.Fields{
 		"host":       req.Host,
 		"url":        req.URL.String(),
 		"requestURI": req.RequestURI,