[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

Adds a new "private" service mode for the reverse proxy: services reachable exclusively over the embedded WireGuard tunnel, gated by per-peer group membership instead of operator auth schemes.

Wire contract
- ProxyMapping.private (field 13): the proxy MUST call ValidateTunnelPeer and fail closed; operator schemes are bypassed.
- ProxyCapabilities.private (4) + supports_private_service (5): capability gate. Management never streams private mappings to proxies that don't claim the capability; the broadcast path applies the same filter via filterMappingsForProxy.
- ValidateTunnelPeer RPC: resolves an inbound tunnel IP to a peer, checks the peer's groups against service.AccessGroups, and mints a session JWT on success. checkPeerGroupAccess fails closed when a private service has empty AccessGroups.
- ValidateSession/ValidateTunnelPeer responses now carry peer_group_ids + peer_group_names so the proxy can authorise policy-aware middlewares without an extra management round-trip.
- ProxyInboundListener + SendStatusUpdate.inbound_listener: per-account inbound listener state surfaced to dashboards.
- PathTargetOptions.direct_upstream (11): bypass the embedded NetBird client and dial the target via the proxy host's network stack for upstreams reachable without WireGuard.

Data model
- Service.Private (bool) + Service.AccessGroups ([]string, JSON- serialised). Validate() rejects bearer auth on private services. Copy() deep-copies AccessGroups. pgx getServices loads the columns.
- DomainConfig.Private threaded into the proxy auth middleware. Request handler routes private services through forwardWithTunnelPeer and returns 403 on validation failure.
- Account-level SynthesizePrivateServiceZones (synthetic DNS) and injectPrivateServicePolicies (synthetic ACL) gate on len(svc.AccessGroups) > 0.

Proxy
- /netbird proxy --private (embedded mode) flag; Config.Private in proxy/lifecycle.go.
- Per-account inbound listener (proxy/inbound.go) binding HTTP/HTTPS on the embedded NetBird client's WireGuard tunnel netstack.
- proxy/internal/auth/tunnel_cache: ValidateTunnelPeer response cache with single-flight de-duplication and per-account eviction.
- Local peerstore short-circuit: when the inbound IP isn't in the account roster, deny fast without an RPC.
- proxy/server.go reports SupportsPrivateService=true and redacts the full ProxyMapping JSON from info logs (auth_token + header-auth hashed values now only at debug level).

Identity forwarding
- ValidateSessionJWT returns user_id, email, method, groups, group_names. sessionkey.Claims carries Email + Groups + GroupNames so the proxy can stamp identity onto upstream requests without an extra management round-trip on every cookie-bearing request.
- CapturedData carries userEmail / userGroups / userGroupNames; the proxy stamps X-NetBird-User and X-NetBird-Groups on r.Out from the authenticated identity (strips client-supplied values first to prevent spoofing).
- AccessLog.UserGroups: access-log enrichment captures the user's group memberships at write time so the dashboard can render group context without reverse-resolving stale memberships.

OpenAPI/dashboard surface
- ReverseProxyService gains private + access_groups; ReverseProxyCluster gains private + supports_private. ReverseProxyTarget target_type enum gains "cluster". ServiceTargetOptions gains direct_upstream. ProxyAccessLog gains user_groups.

proxy/internal/tcp/bench_test.go

@@ -36,7 +36,7 @@ func BenchmarkPeekClientHello_TLS(b *testing.B) {
 	for b.Loop() {
 		r := bytes.NewReader(hello)
 		conn := &readerConn{Reader: r}
-		sni, wrapped, err := PeekClientHello(conn)
+		sni, wrapped, _, err := PeekClientHello(conn)
 		if err != nil {
 			b.Fatal(err)
 		}
@@ -59,7 +59,7 @@ func BenchmarkPeekClientHello_NonTLS(b *testing.B) {
 	for b.Loop() {
 		r := bytes.NewReader(httpReq)
 		conn := &readerConn{Reader: r}
-		_, wrapped, err := PeekClientHello(conn)
+		_, wrapped, _, err := PeekClientHello(conn)
 		if err != nil {
 			b.Fatal(err)
 		}

proxy/internal/tcp/router.go

@@ -100,28 +100,50 @@ type Router struct {
 	// httpCh is immutable after construction: set only in NewRouter, nil in NewPortRouter.
 	httpCh       chan net.Conn
 	httpListener *chanListener
-	mu           sync.RWMutex
-	routes       map[SNIHost][]Route
-	fallback     *Route
-	draining     bool
-	dialResolve  DialResolver
-	activeConns  sync.WaitGroup
-	activeRelays sync.WaitGroup
-	relaySem     chan struct{}
-	drainDone    chan struct{}
-	observer     RelayObserver
-	accessLog    l4Logger
-	geo          restrict.GeoResolver
+	// httpPlainCh feeds non-TLS HTTP connections to a parallel http.Server.
+	// Set only when NewRouter is called with WithPlainHTTP option (used by
+	// per-account inbound listeners that accept both :80 and :443 traffic).
+	// Nil for the host SNI router and for port routers.
+	httpPlainCh       chan net.Conn
+	httpPlainListener *chanListener
+	mu                sync.RWMutex
+	routes            map[SNIHost][]Route
+	fallback          *Route
+	draining          bool
+	dialResolve       DialResolver
+	activeConns       sync.WaitGroup
+	activeRelays      sync.WaitGroup
+	relaySem          chan struct{}
+	drainDone         chan struct{}
+	observer          RelayObserver
+	accessLog         l4Logger
+	geo               restrict.GeoResolver
 	// svcCtxs tracks a context per service ID. All relay goroutines for a
 	// service derive from its context; canceling it kills them immediately.
 	svcCtxs    map[types.ServiceID]context.Context
 	svcCancels map[types.ServiceID]context.CancelFunc
 }
 
+// RouterOption customises Router construction.
+type RouterOption func(*Router)
+
+// WithPlainHTTP enables a parallel plain-HTTP channel on the router. When
+// set, connections whose first byte is not a TLS handshake are forwarded
+// to the plain channel returned by HTTPListenerPlain instead of the TLS
+// channel. Used by per-account inbound listeners that share both :80 and
+// :443 traffic on the same router.
+func WithPlainHTTP(addr net.Addr) RouterOption {
+	return func(r *Router) {
+		ch := make(chan net.Conn, httpChannelBuffer)
+		r.httpPlainCh = ch
+		r.httpPlainListener = newChanListener(ch, addr)
+	}
+}
+
 // NewRouter creates a new SNI-based connection router.
-func NewRouter(logger *log.Logger, dialResolve DialResolver, addr net.Addr) *Router {
+func NewRouter(logger *log.Logger, dialResolve DialResolver, addr net.Addr, opts ...RouterOption) *Router {
 	httpCh := make(chan net.Conn, httpChannelBuffer)
-	return &Router{
+	r := &Router{
 		logger:       logger,
 		httpCh:       httpCh,
 		httpListener: newChanListener(httpCh, addr),
@@ -131,6 +153,10 @@ func NewRouter(logger *log.Logger, dialResolve DialResolver, addr net.Addr) *Rou
 		svcCtxs:      make(map[types.ServiceID]context.Context),
 		svcCancels:   make(map[types.ServiceID]context.CancelFunc),
 	}
+	for _, opt := range opts {
+		opt(r)
+	}
+	return r
 }
 
 // NewPortRouter creates a Router for a dedicated port without an HTTP
@@ -153,6 +179,16 @@ func (r *Router) HTTPListener() net.Listener {
 	return r.httpListener
 }
 
+// HTTPListenerPlain returns a net.Listener yielding non-TLS connections
+// for use with a parallel plain http.Server. Returns nil when the router
+// was not constructed with WithPlainHTTP.
+func (r *Router) HTTPListenerPlain() net.Listener {
+	if r.httpPlainListener == nil {
+		return nil
+	}
+	return r.httpPlainListener
+}
+
 // AddRoute registers an SNI route. Multiple routes for the same host are
 // stored and resolved by priority at lookup time (HTTP > TCP).
 // Empty host is ignored to prevent conflicts with ECH/ESNI fallback.
@@ -254,6 +290,9 @@ func (r *Router) Serve(ctx context.Context, ln net.Listener) error {
 			if r.httpListener != nil {
 				r.httpListener.Close()
 			}
+			if r.httpPlainListener != nil {
+				r.httpPlainListener.Close()
+			}
 		case <-done:
 		}
 	}()
@@ -270,6 +309,7 @@ func (r *Router) Serve(ctx context.Context, ln net.Listener) error {
 			r.logger.Debugf("SNI router accept: %v", err)
 			continue
 		}
+		r.logger.Debugf("SNI router accepted conn from %s on %s", conn.RemoteAddr(), conn.LocalAddr())
 		r.activeConns.Add(1)
 		go func() {
 			defer r.activeConns.Done()
@@ -278,13 +318,24 @@ func (r *Router) Serve(ctx context.Context, ln net.Listener) error {
 	}
 }
 
+// HandleConn lets external accept loops feed a connection through the
+// router's peek-and-dispatch logic. Use this when the same router serves
+// a secondary listener (for example, a per-account inbound :80 socket
+// alongside its :443 socket).
+func (r *Router) HandleConn(ctx context.Context, conn net.Conn) {
+	r.activeConns.Add(1)
+	defer r.activeConns.Done()
+	r.handleConn(ctx, conn)
+}
+
 // handleConn peeks at the TLS ClientHello and routes the connection.
 func (r *Router) handleConn(ctx context.Context, conn net.Conn) {
 	// Fast path: when no SNI routes and no HTTP channel exist (pure TCP
 	// fallback port), skip the TLS peek entirely to avoid read errors on
 	// non-TLS connections and reduce latency.
 	if r.isFallbackOnly() {
-		r.handleUnmatched(ctx, conn)
+		r.logger.Debugf("SNI router fallback-only mode for conn from %s; skipping ClientHello peek", conn.RemoteAddr())
+		r.handleUnmatched(ctx, conn, false)
 		return
 	}
 
@@ -294,11 +345,11 @@ func (r *Router) handleConn(ctx context.Context, conn net.Conn) {
 		return
 	}
 
-	sni, wrapped, err := PeekClientHello(conn)
+	sni, wrapped, isTLS, err := PeekClientHello(conn)
 	if err != nil {
-		r.logger.Debugf("SNI peek: %v", err)
+		r.logger.Debugf("SNI peek failed for conn from %s: %v", conn.RemoteAddr(), err)
 		if wrapped != nil {
-			r.handleUnmatched(ctx, wrapped)
+			r.handleUnmatched(ctx, wrapped, isTLS)
 		} else {
 			_ = conn.Close()
 		}
@@ -313,13 +364,20 @@ func (r *Router) handleConn(ctx context.Context, conn net.Conn) {
 
 	host := SNIHost(strings.ToLower(sni))
 	route, ok := r.lookupRoute(host)
+	r.logger.WithFields(log.Fields{
+		"remote": wrapped.RemoteAddr().String(),
+		"sni":    string(host),
+		"match":  ok,
+		"tls":    isTLS,
+	}).Debug("SNI route lookup")
 	if !ok {
-		r.handleUnmatched(ctx, wrapped)
+		r.handleUnmatched(ctx, wrapped, isTLS)
 		return
 	}
 
 	if route.Type == RouteHTTP {
-		r.sendToHTTP(wrapped)
+		r.logger.Debugf("SNI %q routed to HTTP handler (service_id=%s)", host, route.ServiceID)
+		r.sendToHTTP(wrapped, isTLS)
 		return
 	}
 
@@ -344,15 +402,17 @@ func (r *Router) isFallbackOnly() bool {
 }
 
 // handleUnmatched routes a connection that didn't match any SNI route.
-// This includes ECH/ESNI connections where the cleartext SNI is empty.
+// This includes ECH/ESNI connections where the cleartext SNI is empty,
+// and plain (non-TLS) HTTP connections when isTLS is false.
 // It tries the fallback relay first, then the HTTP channel, and closes
 // the connection if neither is available.
-func (r *Router) handleUnmatched(ctx context.Context, conn net.Conn) {
+func (r *Router) handleUnmatched(ctx context.Context, conn net.Conn, isTLS bool) {
 	r.mu.RLock()
 	fb := r.fallback
 	r.mu.RUnlock()
 
 	if fb != nil {
+		r.logger.Debugf("unmatched conn from %s relayed to TCP fallback (service_id=%s, target=%s)", conn.RemoteAddr(), fb.ServiceID, fb.Target)
 		if err := r.relayTCP(ctx, conn, SNIHost("fallback"), *fb); err != nil {
 			if !errors.Is(err, errAccessRestricted) {
 				r.logger.WithFields(log.Fields{
@@ -364,7 +424,8 @@ func (r *Router) handleUnmatched(ctx context.Context, conn net.Conn) {
 		}
 		return
 	}
-	r.sendToHTTP(conn)
+	r.logger.Debugf("unmatched conn from %s sent to HTTP channel (no TCP fallback configured)", conn.RemoteAddr())
+	r.sendToHTTP(conn, isTLS)
 }
 
 // lookupRoute returns the highest-priority route for the given SNI host.
@@ -386,10 +447,20 @@ func (r *Router) lookupRoute(host SNIHost) (Route, bool) {
 }
 
 // sendToHTTP feeds the connection to the HTTP handler via the channel.
-// If no HTTP channel is configured (port router), the router is
-// draining, or the channel is full, the connection is closed.
-func (r *Router) sendToHTTP(conn net.Conn) {
-	if r.httpCh == nil {
+// When isTLS is false and a plain channel is configured the connection
+// is forwarded to the plain channel; otherwise it lands on the TLS
+// channel. If no usable channel exists, the router is draining, or the
+// channel is full, the connection is closed.
+func (r *Router) sendToHTTP(conn net.Conn, isTLS bool) {
+	ch := r.httpCh
+	chanName := "HTTP"
+	if !isTLS && r.httpPlainCh != nil {
+		ch = r.httpPlainCh
+		chanName = "HTTP-plain"
+	}
+
+	if ch == nil {
+		r.logger.Debugf("%s channel nil; dropping conn from %s", chanName, conn.RemoteAddr())
 		_ = conn.Close()
 		return
 	}
@@ -399,14 +470,15 @@ func (r *Router) sendToHTTP(conn net.Conn) {
 	r.mu.RUnlock()
 
 	if draining {
+		r.logger.Debugf("router draining; dropping conn from %s", conn.RemoteAddr())
 		_ = conn.Close()
 		return
 	}
 
 	select {
-	case r.httpCh <- conn:
+	case ch <- conn:
 	default:
-		r.logger.Warnf("HTTP channel full, dropping connection from %s", conn.RemoteAddr())
+		r.logger.Warnf("%s channel full, dropping connection from %s", chanName, conn.RemoteAddr())
 		_ = conn.Close()
 	}
 }

proxy/internal/tcp/router_test.go

@@ -1739,3 +1739,97 @@ func TestCheckRestrictions_IPv4MappedIPv6(t *testing.T) {
 	connOutside := &fakeConn{remote: fakeAddr("[::ffff:192.168.1.1]:5678")}
 	assert.NotEqual(t, restrict.Allow, router.checkRestrictions(connOutside, route), "::ffff:192.168.1.1 not in v4 CIDR")
 }
+
+// TestRouter_PlainHTTP_RoutesToPlainChannel verifies that a plain (non-TLS)
+// connection lands on the plain HTTP channel when the router was built
+// with WithPlainHTTP, leaving the TLS channel untouched.
+func TestRouter_PlainHTTP_RoutesToPlainChannel(t *testing.T) {
+	logger := log.StandardLogger()
+	addr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 443}
+
+	router := NewRouter(logger, nil, addr, WithPlainHTTP(addr))
+	router.AddRoute("example.com", Route{Type: RouteHTTP})
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err, "test listener bind must succeed")
+	defer ln.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	go func() {
+		_ = router.Serve(ctx, ln)
+	}()
+
+	// Plain HTTP request (no TLS handshake byte).
+	go func() {
+		conn, err := net.DialTimeout("tcp", ln.Addr().String(), 2*time.Second)
+		if err != nil {
+			return
+		}
+		_, _ = conn.Write([]byte("GET / HTTP/1.1\r\nHost: example.com\r\n\r\n"))
+	}()
+
+	plainListener := router.HTTPListenerPlain()
+	require.NotNil(t, plainListener, "plain listener must be exposed when WithPlainHTTP is set")
+
+	acceptDone := make(chan net.Conn, 1)
+	go func() {
+		conn, err := plainListener.Accept()
+		if err == nil {
+			acceptDone <- conn
+		}
+	}()
+
+	select {
+	case conn := <-acceptDone:
+		require.NotNil(t, conn)
+		_ = conn.Close()
+	case <-router.HTTPListener().(*chanListener).ch:
+		t.Fatal("plain HTTP request leaked into TLS channel")
+	case <-time.After(3 * time.Second):
+		t.Fatal("plain HTTP connection never reached plain channel")
+	}
+}
+
+// TestRouter_TLS_StaysOnTLSChannel_WhenPlainEnabled verifies that the
+// presence of a plain channel does not divert TLS traffic — TLS still
+// goes to the TLS channel as before.
+func TestRouter_TLS_StaysOnTLSChannel_WhenPlainEnabled(t *testing.T) {
+	logger := log.StandardLogger()
+	addr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 443}
+
+	router := NewRouter(logger, nil, addr, WithPlainHTTP(addr))
+	router.AddRoute("example.com", Route{Type: RouteHTTP})
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err, "test listener bind must succeed")
+	defer ln.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	go func() { _ = router.Serve(ctx, ln) }()
+
+	// Send a TLS ClientHello.
+	go func() {
+		conn, err := net.DialTimeout("tcp", ln.Addr().String(), 2*time.Second)
+		if err != nil {
+			return
+		}
+		tlsConn := tls.Client(conn, &tls.Config{
+			ServerName:         "example.com",
+			InsecureSkipVerify: true, //nolint:gosec
+		})
+		_ = tlsConn.Handshake()
+		_ = tlsConn.Close()
+	}()
+
+	select {
+	case conn := <-router.httpCh:
+		require.NotNil(t, conn, "TLS conn should land on the TLS channel")
+		_ = conn.Close()
+	case <-time.After(5 * time.Second):
+		t.Fatal("TLS conn never reached the TLS channel")
+	}
+}

proxy/internal/tcp/snipeek.go

@@ -30,26 +30,30 @@ const (
 // bytes transparently. If the data is not a valid TLS ClientHello or
 // contains no SNI extension, sni is empty and err is nil.
 //
+// isTLS reports whether the first byte indicated a TLS handshake record.
+// Callers can use this to distinguish plain (non-TLS) traffic from a TLS
+// stream that simply lacked an SNI extension or used ECH.
+//
 // ECH/ESNI: When the client uses Encrypted Client Hello (TLS 1.3), the
 // real server name is encrypted inside the encrypted_client_hello
 // extension. This parser only reads the cleartext server_name extension
 // (type 0x0000), so ECH connections return sni="" and are routed through
 // the fallback path (or HTTP channel), which is the correct behavior
 // for a transparent proxy that does not terminate TLS.
-func PeekClientHello(conn net.Conn) (sni string, wrapped net.Conn, err error) {
+func PeekClientHello(conn net.Conn) (sni string, wrapped net.Conn, isTLS bool, err error) {
 	// Read the 5-byte TLS record header into a small stack-friendly buffer.
 	var header [tlsRecordHeaderLen]byte
 	if _, err := io.ReadFull(conn, header[:]); err != nil {
-		return "", nil, fmt.Errorf("read TLS record header: %w", err)
+		return "", nil, false, fmt.Errorf("read TLS record header: %w", err)
 	}
 
 	if header[0] != contentTypeHandshake {
-		return "", newPeekedConn(conn, header[:]), nil
+		return "", newPeekedConn(conn, header[:]), false, nil
 	}
 
 	recordLen := int(binary.BigEndian.Uint16(header[3:5]))
 	if recordLen == 0 || recordLen > maxClientHelloLen {
-		return "", newPeekedConn(conn, header[:]), nil
+		return "", newPeekedConn(conn, header[:]), true, nil
 	}
 
 	// Single allocation for header + payload. The peekedConn takes
@@ -59,11 +63,11 @@ func PeekClientHello(conn net.Conn) (sni string, wrapped net.Conn, err error) {
 
 	n, err := io.ReadFull(conn, buf[tlsRecordHeaderLen:])
 	if err != nil {
-		return "", newPeekedConn(conn, buf[:tlsRecordHeaderLen+n]), fmt.Errorf("read TLS handshake payload: %w", err)
+		return "", newPeekedConn(conn, buf[:tlsRecordHeaderLen+n]), true, fmt.Errorf("read TLS handshake payload: %w", err)
 	}
 
 	sni = extractSNI(buf[tlsRecordHeaderLen:])
-	return sni, newPeekedConn(conn, buf), nil
+	return sni, newPeekedConn(conn, buf), true, nil
 }
 
 // extractSNI parses a TLS handshake payload to find the SNI extension.

proxy/internal/tcp/snipeek_test.go

@@ -29,10 +29,11 @@ func TestPeekClientHello_ValidSNI(t *testing.T) {
 		_ = tlsConn.Handshake()
 	}()
 
-	sni, wrapped, err := PeekClientHello(serverConn)
+	sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 	require.NoError(t, err)
 	assert.Equal(t, expectedSNI, sni, "should extract SNI from ClientHello")
 	assert.NotNil(t, wrapped, "wrapped connection should not be nil")
+	assert.True(t, isTLS, "TLS ClientHello should be flagged as TLS")
 
 	// Verify the wrapped connection replays the peeked bytes.
 	// Read the first 5 bytes (TLS record header) to confirm replay.
@@ -83,10 +84,11 @@ func TestPeekClientHello_MultipleSNIs(t *testing.T) {
 				_ = tlsConn.Handshake()
 			}()
 
-			sni, wrapped, err := PeekClientHello(serverConn)
+			sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 			require.NoError(t, err)
 			assert.Equal(t, tt.expectedSNI, sni)
 			assert.NotNil(t, wrapped)
+			assert.True(t, isTLS, "TLS handshake should be flagged as TLS")
 		})
 	}
 }
@@ -102,10 +104,11 @@ func TestPeekClientHello_NonTLSData(t *testing.T) {
 		_, _ = clientConn.Write(httpData)
 	}()
 
-	sni, wrapped, err := PeekClientHello(serverConn)
+	sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 	require.NoError(t, err)
 	assert.Empty(t, sni, "should return empty SNI for non-TLS data")
 	assert.NotNil(t, wrapped)
+	assert.False(t, isTLS, "plain HTTP data should not be flagged as TLS")
 
 	// Verify the wrapped connection still provides the original data.
 	buf := make([]byte, len(httpData))
@@ -124,7 +127,7 @@ func TestPeekClientHello_TruncatedHeader(t *testing.T) {
 		clientConn.Close()
 	}()
 
-	_, _, err := PeekClientHello(serverConn)
+	_, _, _, err := PeekClientHello(serverConn)
 	assert.Error(t, err, "should error on truncated header")
 }
 
@@ -140,7 +143,7 @@ func TestPeekClientHello_TruncatedPayload(t *testing.T) {
 		clientConn.Close()
 	}()
 
-	_, _, err := PeekClientHello(serverConn)
+	_, _, _, err := PeekClientHello(serverConn)
 	assert.Error(t, err, "should error on truncated payload")
 }
 
@@ -154,10 +157,11 @@ func TestPeekClientHello_ZeroLengthRecord(t *testing.T) {
 		_, _ = clientConn.Write([]byte{0x16, 0x03, 0x01, 0x00, 0x00})
 	}()
 
-	sni, wrapped, err := PeekClientHello(serverConn)
+	sni, wrapped, isTLS, err := PeekClientHello(serverConn)
 	require.NoError(t, err)
 	assert.Empty(t, sni)
 	assert.NotNil(t, wrapped)
+	assert.True(t, isTLS, "zero-length record should still be a TLS handshake byte")
 }
 
 func TestExtractSNI_InvalidPayload(t *testing.T) {