[management,signal,proxy,relay,misc] Unify service configuration loading

Service entry points currently resolve defaults, files, environment variables, and flags differently, which makes precedence inconsistent and prevents some services from using config files.

Introduce one Viper-backed loader and migrate Combined, Management, Relay, Signal, and Proxy while preserving compatibility aliases and Management template expansion.

proxy/lifecycle.go

@@ -20,112 +20,112 @@ import (
 // adding fields here must not change the zero-value behaviour of Server.
 type Config struct {
 	// ListenAddr is the TCP address the main listener binds. Required.
-	ListenAddr string
+	ListenAddr string `yaml:"listenAddress" env:"NB_PROXY_ADDRESS" flag:"addr"`
 	// ID identifies this proxy instance to management. Empty values are
 	// replaced with a timestamped default at Server.Start time (see
 	// initDefaults), not in New.
-	ID string
+	ID string `yaml:"id" env:"NB_PROXY_ID"`
 	// Logger is the logrus logger used everywhere. Empty values fall
 	// back to log.StandardLogger() at Server.Start time (see
 	// initDefaults), not in New.
-	Logger *log.Logger
+	Logger *log.Logger `yaml:"-" env:"-" flag:"-"`
 	// Version is the build version string reported to management. Empty
 	// values are replaced with "dev" at Server.Start time (see
 	// initDefaults), not in New.
-	Version string
+	Version string `yaml:"-" env:"-" flag:"-"`
 	// ProxyURL is the public address operators use to reach this proxy.
-	ProxyURL string
+	ProxyURL string `yaml:"domain" env:"NB_PROXY_DOMAIN" flag:"domain"`
 	// ManagementAddress is the gRPC URL of the management server.
-	ManagementAddress string
+	ManagementAddress string `yaml:"managementAddress" env:"NB_PROXY_MANAGEMENT_ADDRESS" flag:"mgmt"`
 	// ProxyToken authenticates this proxy with the management server.
-	ProxyToken string
+	ProxyToken string `yaml:"proxyToken" env:"NB_PROXY_TOKEN"`
 
 	// CertificateDirectory is the directory holding TLS certificate
 	// material (static or ACME-provisioned).
-	CertificateDirectory string
+	CertificateDirectory string `yaml:"certificateDirectory" env:"NB_PROXY_CERTIFICATE_DIRECTORY" flag:"cert-dir"`
 	// CertificateFile is the certificate filename within
 	// CertificateDirectory.
-	CertificateFile string
+	CertificateFile string `yaml:"certificateFile" env:"NB_PROXY_CERTIFICATE_FILE" flag:"cert-file"`
 	// CertificateKeyFile is the private key filename within
 	// CertificateDirectory.
-	CertificateKeyFile string
+	CertificateKeyFile string `yaml:"certificateKeyFile" env:"NB_PROXY_CERTIFICATE_KEY_FILE" flag:"cert-key-file"`
 	// GenerateACMECertificates toggles ACME certificate provisioning.
-	GenerateACMECertificates bool
+	GenerateACMECertificates bool `yaml:"generateACMECertificates" env:"NB_PROXY_ACME_CERTIFICATES" flag:"acme-certs"`
 	// ACMEChallengeAddress is the listen address for HTTP-01 challenges.
-	ACMEChallengeAddress string
+	ACMEChallengeAddress string `yaml:"acmeChallengeAddress" env:"NB_PROXY_ACME_ADDRESS" flag:"acme-addr"`
 	// ACMEDirectory is the ACME directory URL (Let's Encrypt by default).
-	ACMEDirectory string
+	ACMEDirectory string `yaml:"acmeDirectory" env:"NB_PROXY_ACME_DIRECTORY" flag:"acme-dir"`
 	// ACMEEABKID is the External Account Binding Key ID for CAs that
 	// require EAB (e.g. ZeroSSL).
-	ACMEEABKID string
+	ACMEEABKID string `yaml:"acmeEABKID" env:"NB_PROXY_ACME_EAB_KID" flag:"acme-eab-kid"`
 	// ACMEEABHMACKey is the External Account Binding HMAC key for CAs
 	// that require EAB.
-	ACMEEABHMACKey string
+	ACMEEABHMACKey string `yaml:"acmeEABHMACKey" env:"NB_PROXY_ACME_EAB_HMAC_KEY" flag:"acme-eab-hmac-key"`
 	// ACMEChallengeType is the ACME challenge type ("tls-alpn-01" or
 	// "http-01"). Empty defaults to "tls-alpn-01".
-	ACMEChallengeType string
+	ACMEChallengeType string `yaml:"acmeChallengeType" env:"NB_PROXY_ACME_CHALLENGE_TYPE" flag:"acme-challenge-type"`
 	// CertLockMethod controls how ACME certificate locks are coordinated
 	// across replicas.
-	CertLockMethod acme.CertLockMethod
+	CertLockMethod acme.CertLockMethod `yaml:"certLockMethod" env:"NB_PROXY_CERT_LOCK_METHOD" flag:"cert-lock-method"`
 	// WildcardCertDir is an optional directory containing static wildcard
 	// certificates that override ACME for matching domains.
-	WildcardCertDir string
+	WildcardCertDir string `yaml:"wildcardCertDir" env:"NB_PROXY_WILDCARD_CERT_DIR" flag:"wildcard-cert-dir"`
 
 	// DebugEndpointEnabled toggles the debug HTTP endpoint.
-	DebugEndpointEnabled bool
+	DebugEndpointEnabled bool `yaml:"debugEndpointEnabled" env:"NB_PROXY_DEBUG_ENDPOINT" flag:"debug-endpoint"`
 	// DebugEndpointAddress is the bind address for the debug endpoint.
-	DebugEndpointAddress string
+	DebugEndpointAddress string `yaml:"debugEndpointAddress" env:"NB_PROXY_DEBUG_ENDPOINT_ADDRESS" flag:"debug-endpoint-addr"`
 	// HealthAddr is the bind address for the health probe and metrics
 	// surface. Empty disables the health probe entirely (library callers
 	// can attach their own).
-	HealthAddr string
+	HealthAddr string `yaml:"healthAddress" env:"NB_PROXY_HEALTH_ADDRESS" flag:"health-addr"`
 
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to
 	// backends. Valid values: "auto", "http", "https".
-	ForwardedProto string
+	ForwardedProto string `yaml:"forwardedProto" env:"NB_PROXY_FORWARDED_PROTO" flag:"forwarded-proto"`
 	// TrustedProxies is the set of trusted upstream proxies that may set
 	// forwarding headers.
-	TrustedProxies *trustedproxy.List
+	TrustedProxies *trustedproxy.List `yaml:"trustedProxies" env:"NB_PROXY_TRUSTED_PROXIES" flag:"trusted-proxies"`
 	// WireguardPort is the UDP port for the embedded NetBird tunnel.
 	// Zero asks the OS for a random port.
-	WireguardPort uint16
+	WireguardPort uint16 `yaml:"wireguardPort" env:"NB_PROXY_WG_PORT" flag:"wg-port"`
 	// ProxyProtocol enables PROXY protocol (v1/v2) on TCP listeners.
-	ProxyProtocol bool
+	ProxyProtocol bool `yaml:"proxyProtocol" env:"NB_PROXY_PROXY_PROTOCOL" flag:"proxy-protocol"`
 	// PreSharedKey is the WireGuard pre-shared key used between the
 	// proxy's embedded clients and peers.
-	PreSharedKey string
+	PreSharedKey string `yaml:"preSharedKey" env:"NB_PROXY_PRESHARED_KEY" flag:"preshared-key"`
 	// Performance configures the tunnel pool/batch sizes for every
 	// embedded client this proxy creates. Zero values fall back to
 	// upstream defaults.
-	Performance embed.Performance
+	Performance embed.Performance `yaml:"performance" env:"-" flag:"-"`
 
 	// SupportsCustomPorts indicates whether the proxy can bind arbitrary
 	// ports for TCP/UDP/TLS services.
-	SupportsCustomPorts bool
+	SupportsCustomPorts bool `yaml:"supportsCustomPorts" env:"NB_PROXY_SUPPORTS_CUSTOM_PORTS" flag:"supports-custom-ports"`
 	// RequireSubdomain forces accounts to use a subdomain in front of
 	// the proxy's cluster domain.
-	RequireSubdomain bool
+	RequireSubdomain bool `yaml:"requireSubdomain" env:"NB_PROXY_REQUIRE_SUBDOMAIN" flag:"require-subdomain"`
 	// Private flags this proxy as embedded in a netbird client and
 	// serving exclusively over the WireGuard tunnel. Also enables
 	// per-account inbound listeners on each embedded client's netstack.
-	Private bool
+	Private bool `yaml:"private" env:"NB_PROXY_PRIVATE" flag:"private"`
 
 	// MaxDialTimeout caps the per-service backend dial timeout.
-	MaxDialTimeout time.Duration
+	MaxDialTimeout time.Duration `yaml:"maxDialTimeout" env:"NB_PROXY_MAX_DIAL_TIMEOUT" flag:"max-dial-timeout"`
 	// MaxSessionIdleTimeout caps the per-service session idle timeout.
-	MaxSessionIdleTimeout time.Duration
+	MaxSessionIdleTimeout time.Duration `yaml:"maxSessionIdleTimeout" env:"NB_PROXY_MAX_SESSION_IDLE_TIMEOUT" flag:"max-session-idle-timeout"`
 	// MappingBatchWatchdog bounds how long a single mapping batch may spend
 	// being applied before the receive loop reconnects to resync. Zero falls
 	// back to the internal default.
-	MappingBatchWatchdog time.Duration
+	MappingBatchWatchdog time.Duration `yaml:"mappingBatchWatchdog" env:"NB_PROXY_MAPPING_BATCH_WATCHDOG"`
 
 	// GeoDataDir is the directory containing GeoLite2 MMDB files.
-	GeoDataDir string
+	GeoDataDir string `yaml:"geoDataDir" env:"NB_PROXY_GEO_DATA_DIR" flag:"geo-data-dir"`
 	// CrowdSecAPIURL is the CrowdSec LAPI URL. Empty disables CrowdSec.
-	CrowdSecAPIURL string
+	CrowdSecAPIURL string `yaml:"crowdSecAPIURL" env:"NB_PROXY_CROWDSEC_API_URL" flag:"crowdsec-api-url"`
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables
 	// CrowdSec.
-	CrowdSecAPIKey string
+	CrowdSecAPIKey string `yaml:"crowdSecAPIKey" env:"NB_PROXY_CROWDSEC_API_KEY" flag:"crowdsec-api-key"`
 }
 
 // New builds a Server from cfg without performing any I/O. No goroutines