[management,signal,proxy,relay,misc] Limit shared config loader to combined server

proxy/lifecycle.go

@@ -20,112 +20,112 @@ import (
 // adding fields here must not change the zero-value behaviour of Server.
 type Config struct {
 	// ListenAddr is the TCP address the main listener binds. Required.
-	ListenAddr string `yaml:"listenAddress" env:"NB_PROXY_ADDRESS" flag:"addr"`
+	ListenAddr string
 	// ID identifies this proxy instance to management. Empty values are
 	// replaced with a timestamped default at Server.Start time (see
 	// initDefaults), not in New.
-	ID string `yaml:"id" env:"-"`
+	ID string
 	// Logger is the logrus logger used everywhere. Empty values fall
 	// back to log.StandardLogger() at Server.Start time (see
 	// initDefaults), not in New.
-	Logger *log.Logger `yaml:"-" env:"-" flag:"-"`
+	Logger *log.Logger
 	// Version is the build version string reported to management. Empty
 	// values are replaced with "dev" at Server.Start time (see
 	// initDefaults), not in New.
-	Version string `yaml:"-" env:"-" flag:"-"`
+	Version string
 	// ProxyURL is the public address operators use to reach this proxy.
-	ProxyURL string `yaml:"domain" env:"NB_PROXY_DOMAIN" flag:"domain"`
+	ProxyURL string
 	// ManagementAddress is the gRPC URL of the management server.
-	ManagementAddress string `yaml:"managementAddress" env:"NB_PROXY_MANAGEMENT_ADDRESS" flag:"mgmt"`
+	ManagementAddress string
 	// ProxyToken authenticates this proxy with the management server.
-	ProxyToken string `yaml:"proxyToken" env:"NB_PROXY_TOKEN"`
+	ProxyToken string
 
 	// CertificateDirectory is the directory holding TLS certificate
 	// material (static or ACME-provisioned).
-	CertificateDirectory string `yaml:"certificateDirectory" env:"NB_PROXY_CERTIFICATE_DIRECTORY" flag:"cert-dir"`
+	CertificateDirectory string
 	// CertificateFile is the certificate filename within
 	// CertificateDirectory.
-	CertificateFile string `yaml:"certificateFile" env:"NB_PROXY_CERTIFICATE_FILE" flag:"cert-file"`
+	CertificateFile string
 	// CertificateKeyFile is the private key filename within
 	// CertificateDirectory.
-	CertificateKeyFile string `yaml:"certificateKeyFile" env:"NB_PROXY_CERTIFICATE_KEY_FILE" flag:"cert-key-file"`
+	CertificateKeyFile string
 	// GenerateACMECertificates toggles ACME certificate provisioning.
-	GenerateACMECertificates bool `yaml:"generateACMECertificates" env:"NB_PROXY_ACME_CERTIFICATES" flag:"acme-certs"`
+	GenerateACMECertificates bool
 	// ACMEChallengeAddress is the listen address for HTTP-01 challenges.
-	ACMEChallengeAddress string `yaml:"acmeChallengeAddress" env:"NB_PROXY_ACME_ADDRESS" flag:"acme-addr"`
+	ACMEChallengeAddress string
 	// ACMEDirectory is the ACME directory URL (Let's Encrypt by default).
-	ACMEDirectory string `yaml:"acmeDirectory" env:"NB_PROXY_ACME_DIRECTORY" flag:"acme-dir"`
+	ACMEDirectory string
 	// ACMEEABKID is the External Account Binding Key ID for CAs that
 	// require EAB (e.g. ZeroSSL).
-	ACMEEABKID string `yaml:"acmeEABKID" env:"NB_PROXY_ACME_EAB_KID" flag:"acme-eab-kid"`
+	ACMEEABKID string
 	// ACMEEABHMACKey is the External Account Binding HMAC key for CAs
 	// that require EAB.
-	ACMEEABHMACKey string `yaml:"acmeEABHMACKey" env:"NB_PROXY_ACME_EAB_HMAC_KEY" flag:"acme-eab-hmac-key"`
+	ACMEEABHMACKey string
 	// ACMEChallengeType is the ACME challenge type ("tls-alpn-01" or
 	// "http-01"). Empty defaults to "tls-alpn-01".
-	ACMEChallengeType string `yaml:"acmeChallengeType" env:"NB_PROXY_ACME_CHALLENGE_TYPE" flag:"acme-challenge-type"`
+	ACMEChallengeType string
 	// CertLockMethod controls how ACME certificate locks are coordinated
 	// across replicas.
-	CertLockMethod acme.CertLockMethod `yaml:"certLockMethod" env:"NB_PROXY_CERT_LOCK_METHOD" flag:"cert-lock-method"`
+	CertLockMethod acme.CertLockMethod
 	// WildcardCertDir is an optional directory containing static wildcard
 	// certificates that override ACME for matching domains.
-	WildcardCertDir string `yaml:"wildcardCertDir" env:"NB_PROXY_WILDCARD_CERT_DIR" flag:"wildcard-cert-dir"`
+	WildcardCertDir string
 
 	// DebugEndpointEnabled toggles the debug HTTP endpoint.
-	DebugEndpointEnabled bool `yaml:"debugEndpointEnabled" env:"NB_PROXY_DEBUG_ENDPOINT" flag:"debug-endpoint"`
+	DebugEndpointEnabled bool
 	// DebugEndpointAddress is the bind address for the debug endpoint.
-	DebugEndpointAddress string `yaml:"debugEndpointAddress" env:"NB_PROXY_DEBUG_ENDPOINT_ADDRESS" flag:"debug-endpoint-addr"`
+	DebugEndpointAddress string
 	// HealthAddr is the bind address for the health probe and metrics
 	// surface. Empty disables the health probe entirely (library callers
 	// can attach their own).
-	HealthAddr string `yaml:"healthAddress" env:"NB_PROXY_HEALTH_ADDRESS" flag:"health-addr"`
+	HealthAddr string
 
 	// ForwardedProto overrides the X-Forwarded-Proto value sent to
 	// backends. Valid values: "auto", "http", "https".
-	ForwardedProto string `yaml:"forwardedProto" env:"NB_PROXY_FORWARDED_PROTO" flag:"forwarded-proto"`
+	ForwardedProto string
 	// TrustedProxies is the set of trusted upstream proxies that may set
 	// forwarding headers.
-	TrustedProxies *trustedproxy.List `yaml:"trustedProxies" env:"NB_PROXY_TRUSTED_PROXIES" flag:"trusted-proxies"`
+	TrustedProxies *trustedproxy.List
 	// WireguardPort is the UDP port for the embedded NetBird tunnel.
 	// Zero asks the OS for a random port.
-	WireguardPort uint16 `yaml:"wireguardPort" env:"NB_PROXY_WG_PORT" flag:"wg-port"`
+	WireguardPort uint16
 	// ProxyProtocol enables PROXY protocol (v1/v2) on TCP listeners.
-	ProxyProtocol bool `yaml:"proxyProtocol" env:"NB_PROXY_PROXY_PROTOCOL" flag:"proxy-protocol"`
+	ProxyProtocol bool
 	// PreSharedKey is the WireGuard pre-shared key used between the
 	// proxy's embedded clients and peers.
-	PreSharedKey string `yaml:"preSharedKey" env:"NB_PROXY_PRESHARED_KEY" flag:"preshared-key"`
+	PreSharedKey string
 	// Performance configures the tunnel pool/batch sizes for every
 	// embedded client this proxy creates. Zero values fall back to
 	// upstream defaults.
-	Performance embed.Performance `yaml:"performance" env:"-" flag:"-"`
+	Performance embed.Performance
 
 	// SupportsCustomPorts indicates whether the proxy can bind arbitrary
 	// ports for TCP/UDP/TLS services.
-	SupportsCustomPorts bool `yaml:"supportsCustomPorts" env:"NB_PROXY_SUPPORTS_CUSTOM_PORTS" flag:"supports-custom-ports"`
+	SupportsCustomPorts bool
 	// RequireSubdomain forces accounts to use a subdomain in front of
 	// the proxy's cluster domain.
-	RequireSubdomain bool `yaml:"requireSubdomain" env:"NB_PROXY_REQUIRE_SUBDOMAIN" flag:"require-subdomain"`
+	RequireSubdomain bool
 	// Private flags this proxy as embedded in a netbird client and
 	// serving exclusively over the WireGuard tunnel. Also enables
 	// per-account inbound listeners on each embedded client's netstack.
-	Private bool `yaml:"private" env:"NB_PROXY_PRIVATE" flag:"private"`
+	Private bool
 
 	// MaxDialTimeout caps the per-service backend dial timeout.
-	MaxDialTimeout time.Duration `yaml:"maxDialTimeout" env:"NB_PROXY_MAX_DIAL_TIMEOUT" flag:"max-dial-timeout"`
+	MaxDialTimeout time.Duration
 	// MaxSessionIdleTimeout caps the per-service session idle timeout.
-	MaxSessionIdleTimeout time.Duration `yaml:"maxSessionIdleTimeout" env:"NB_PROXY_MAX_SESSION_IDLE_TIMEOUT" flag:"max-session-idle-timeout"`
+	MaxSessionIdleTimeout time.Duration
 	// MappingBatchWatchdog bounds how long a single mapping batch may spend
 	// being applied before the receive loop reconnects to resync. Zero falls
 	// back to the internal default.
-	MappingBatchWatchdog time.Duration `yaml:"mappingBatchWatchdog" env:"NB_PROXY_MAPPING_BATCH_WATCHDOG"`
+	MappingBatchWatchdog time.Duration
 
 	// GeoDataDir is the directory containing GeoLite2 MMDB files.
-	GeoDataDir string `yaml:"geoDataDir" env:"NB_PROXY_GEO_DATA_DIR" flag:"geo-data-dir"`
+	GeoDataDir string
 	// CrowdSecAPIURL is the CrowdSec LAPI URL. Empty disables CrowdSec.
-	CrowdSecAPIURL string `yaml:"crowdSecAPIURL" env:"NB_PROXY_CROWDSEC_API_URL" flag:"crowdsec-api-url"`
+	CrowdSecAPIURL string
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables
 	// CrowdSec.
-	CrowdSecAPIKey string `yaml:"crowdSecAPIKey" env:"NB_PROXY_CROWDSEC_API_KEY" flag:"crowdsec-api-key"`
+	CrowdSecAPIKey string
 }
 
 // New builds a Server from cfg without performing any I/O. No goroutines