sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-26 22:39:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

[proxy] Exercise target access through container E2E (#8117)

Browse Source 
Verify access decisions through real management and proxy containers, including upstream delivery and denial. Cover inherited auth, bypass/block, precedence, credential stripping, updates, restrictions, deletion, and private-service rejection.

Validation: container E2E and scoped lint passed locally. The workflow builds both components from the checkout.
This commit is contained in:
Maycon Santos
2026-10-12 13:23:18 +02:00
committed by GitHub
parent 88f1a307e3
commit 57722d3235
7 changed files with 789 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e/reverseproxy/README.md
+36
View File
@@ -0,0 +1,36 @@
# Reverse-proxy access E2E tests
These tests run a real combined management server, reverse proxy, and HTTP
upstream in isolated Docker containers. Services are configured through the
management API, then requests go through the proxy's HTTPS listener. No external
identity provider, public DNS record, or API credential is needed.
Run from the repository root with Docker and Go available:
```bash
go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
```
The harness builds the combined server and proxy from the current checkout.
To test existing images, pass full image references:
```bash
NB_E2E_COMBINED_IMAGE=local/netbird-combined:target-access \
NB_E2E_PROXY_IMAGE=local/netbird-proxy:target-access \
go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
```
Rebuild locally tagged images after backend changes. Both components must
support target access actions; using an older management image does not test
the feature.
The suite checks inherited service authentication, anonymous bypass, blocked
paths, longest-prefix precedence, credential stripping, live action updates,
service restrictions, deletion, and private-service bypass rejection. Upstream
request markers distinguish successful forwarding from proxy-generated
responses and verify that denied requests never reach the backend.
The `Reverse Proxy E2E` workflow runs this package for relevant pull requests
and manual dispatches. It also remains part of the nightly `./e2e/...` suite.
Dashboard browser coverage lives in the dashboard repository: it creates and
edits services through the UI, then probes their real proxy behavior.