+
+ Client: {{.AccountID}}
+ +{{.Content}}
+
+
+{{end}}
diff --git a/proxy/internal/debug/templates/clients.html b/proxy/internal/debug/templates/clients.html
new file mode 100644
index 000000000..4d455b2bb
--- /dev/null
+++ b/proxy/internal/debug/templates/clients.html
@@ -0,0 +1,33 @@
+{{define "clients"}}
+
+
+
+ All Clients
+Uptime: {{.Uptime}} | ← Back
+ {{if .Clients}} +| Account ID | +Domains | +Age | +Status | +
|---|---|---|---|
| {{.AccountID}} | +{{.Domains}} | +{{.Age}} | +{{.Status}} | +
No clients connected
+ {{end}} + + +{{end}} diff --git a/proxy/internal/debug/templates/index.html b/proxy/internal/debug/templates/index.html new file mode 100644 index 000000000..16ab3d979 --- /dev/null +++ b/proxy/internal/debug/templates/index.html @@ -0,0 +1,58 @@ +{{define "index"}} + + + +NetBird Proxy Debug
+Version: {{.Version}} | Uptime: {{.Uptime}}
+Certificates: {{.CertsReady}} ready, {{.CertsPending}} pending, {{.CertsFailed}} failed ({{.CertsTotal}} total)
+ {{if .CertsReadyDomains}} +
+
+ {{end}}
+ {{if .CertsPendingDomains}}
+ Ready domains ({{.CertsReady}})
+- {{range .CertsReadyDomains}}
- {{.}} {{end}}
+
+ {{end}}
+ {{if .CertsFailedDomains}}
+ Pending domains ({{.CertsPending}})
+- {{range .CertsPendingDomains}}
- {{.}} {{end}}
+
+ {{end}}
+ Failed domains ({{.CertsFailed}})
+- {{range .CertsFailedDomains}}
- {{.Domain}}: {{.Error}} {{end}}
Clients ({{.ClientCount}}) | Domains ({{.TotalDomains}})
+ {{if .Clients}} +| Account ID | +Domains | +Age | +Status | +
|---|---|---|---|
| {{.AccountID}} | +{{.Domains}} | +{{.Age}} | +{{.Status}} | +
No clients connected
+ {{end}} +Endpoints
+-
+
- /debug/clients - all clients detail +
Add ?format=json or /json suffix for JSON output
+ + +{{end}} diff --git a/proxy/internal/debug/templates/tools.html b/proxy/internal/debug/templates/tools.html new file mode 100644 index 000000000..216a44693 --- /dev/null +++ b/proxy/internal/debug/templates/tools.html @@ -0,0 +1,142 @@ +{{define "tools"}} + + + +Client: {{.AccountID}}
+ + +Client Control
+
+
+
+
+
+
+
+
+
+
+
+
+ Log Level
+
+
+
+
+
+
+
+
+
+
+
+
+ TCP Ping
+
+
+
+
+
+
+
+{{end}}
diff --git a/proxy/internal/flock/flock_other.go b/proxy/internal/flock/flock_other.go
new file mode 100644
index 000000000..a3916a442
--- /dev/null
+++ b/proxy/internal/flock/flock_other.go
@@ -0,0 +1,20 @@
+//go:build !unix
+
+package flock
+
+import (
+ "context"
+ "os"
+)
+
+// Lock is a no-op on non-Unix platforms. Returns (nil, nil) to indicate
+// that no lock was acquired; callers must treat a nil file as "proceed
+// without lock" rather than "lock held by someone else."
+func Lock(_ context.Context, _ string) (*os.File, error) {
+ return nil, nil //nolint:nilnil // intentional: nil file signals locking unsupported on this platform
+}
+
+// Unlock is a no-op on non-Unix platforms.
+func Unlock(_ *os.File) error {
+ return nil
+}
diff --git a/proxy/internal/flock/flock_test.go b/proxy/internal/flock/flock_test.go
new file mode 100644
index 000000000..501a173f7
--- /dev/null
+++ b/proxy/internal/flock/flock_test.go
@@ -0,0 +1,79 @@
+//go:build unix
+
+package flock
+
+import (
+ "context"
+ "os"
+ "path/filepath"
+ "sync"
+ "testing"
+ "time"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+)
+
+func TestLockUnlock(t *testing.T) {
+ lockPath := filepath.Join(t.TempDir(), "test.lock")
+
+ f, err := Lock(context.Background(), lockPath)
+ require.NoError(t, err)
+ require.NotNil(t, f)
+
+ _, err = os.Stat(lockPath)
+ assert.NoError(t, err, "lock file should exist")
+
+ err = Unlock(f)
+ assert.NoError(t, err)
+}
+
+func TestUnlockNil(t *testing.T) {
+ err := Unlock(nil)
+ assert.NoError(t, err, "unlocking nil should be a no-op")
+}
+
+func TestLockRespectsContext(t *testing.T) {
+ lockPath := filepath.Join(t.TempDir(), "test.lock")
+
+ f1, err := Lock(context.Background(), lockPath)
+ require.NoError(t, err)
+ defer func() { require.NoError(t, Unlock(f1)) }()
+
+ ctx, cancel := context.WithTimeout(context.Background(), 300*time.Millisecond)
+ defer cancel()
+
+ _, err = Lock(ctx, lockPath)
+ assert.ErrorIs(t, err, context.DeadlineExceeded)
+}
+
+func TestLockBlocks(t *testing.T) {
+ lockPath := filepath.Join(t.TempDir(), "test.lock")
+
+ f1, err := Lock(context.Background(), lockPath)
+ require.NoError(t, err)
+
+ var wg sync.WaitGroup
+ wg.Add(1)
+
+ start := time.Now()
+ var elapsed time.Duration
+
+ go func() {
+ defer wg.Done()
+ f2, err := Lock(context.Background(), lockPath)
+ elapsed = time.Since(start)
+ assert.NoError(t, err)
+ if f2 != nil {
+ assert.NoError(t, Unlock(f2))
+ }
+ }()
+
+ // Hold the lock for 200ms, then release.
+ time.Sleep(200 * time.Millisecond)
+ require.NoError(t, Unlock(f1))
+
+ wg.Wait()
+ assert.GreaterOrEqual(t, elapsed, 150*time.Millisecond,
+ "Lock should have blocked for at least ~200ms")
+}
diff --git a/proxy/internal/flock/flock_unix.go b/proxy/internal/flock/flock_unix.go
new file mode 100644
index 000000000..738859a6f
--- /dev/null
+++ b/proxy/internal/flock/flock_unix.go
@@ -0,0 +1,77 @@
+//go:build unix
+
+// Package flock provides best-effort advisory file locking using flock(2).
+//
+// This is used for cross-replica coordination (e.g. preventing duplicate
+// ACME requests). Note that flock(2) does NOT work reliably on NFS volumes:
+// on NFSv3 it depends on the NLM daemon, on NFSv4 Linux emulates it via
+// fcntl locks with different semantics. Callers must treat lock failures
+// as non-fatal and proceed without the lock.
+package flock
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+ "syscall"
+ "time"
+
+ log "github.com/sirupsen/logrus"
+)
+
+const retryInterval = 100 * time.Millisecond
+
+// Lock acquires an exclusive advisory lock on the given file path.
+// It creates the lock file if it does not exist. The lock attempt
+// respects context cancellation by using non-blocking flock with polling.
+// The caller must call Unlock with the returned *os.File when done.
+func Lock(ctx context.Context, path string) (*os.File, error) {
+ f, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
+ if err != nil {
+ return nil, fmt.Errorf("open lock file %s: %w", path, err)
+ }
+
+ timer := time.NewTimer(retryInterval)
+ defer timer.Stop()
+
+ for {
+ if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err == nil {
+ return f, nil
+ } else if !errors.Is(err, syscall.EWOULDBLOCK) {
+ if cerr := f.Close(); cerr != nil {
+ log.Debugf("close lock file %s: %v", path, cerr)
+ }
+ return nil, fmt.Errorf("acquire lock on %s: %w", path, err)
+ }
+
+ select {
+ case <-ctx.Done():
+ if cerr := f.Close(); cerr != nil {
+ log.Debugf("close lock file %s: %v", path, cerr)
+ }
+ return nil, ctx.Err()
+ case <-timer.C:
+ timer.Reset(retryInterval)
+ }
+ }
+}
+
+// Unlock releases the lock and closes the file.
+func Unlock(f *os.File) error {
+ if f == nil {
+ return nil
+ }
+
+ defer func() {
+ if cerr := f.Close(); cerr != nil {
+ log.Debugf("close lock file: %v", cerr)
+ }
+ }()
+
+ if err := syscall.Flock(int(f.Fd()), syscall.LOCK_UN); err != nil {
+ return fmt.Errorf("release lock: %w", err)
+ }
+
+ return nil
+}
diff --git a/proxy/internal/grpc/auth.go b/proxy/internal/grpc/auth.go
new file mode 100644
index 000000000..ce1a23f68
--- /dev/null
+++ b/proxy/internal/grpc/auth.go
@@ -0,0 +1,48 @@
+// Package grpc provides gRPC utilities for the proxy client.
+package grpc
+
+import (
+ "context"
+ "os"
+ "strconv"
+
+ log "github.com/sirupsen/logrus"
+ "google.golang.org/grpc"
+ "google.golang.org/grpc/credentials"
+)
+
+// EnvProxyAllowInsecure controls whether the proxy token can be sent over non-TLS connections.
+const EnvProxyAllowInsecure = "NB_PROXY_ALLOW_INSECURE"
+
+var _ credentials.PerRPCCredentials = (*proxyAuthToken)(nil)
+
+type proxyAuthToken struct {
+ token string
+ allowInsecure bool
+}
+
+func (t proxyAuthToken) GetRequestMetadata(context.Context, ...string) (map[string]string, error) {
+ return map[string]string{
+ "authorization": "Bearer " + t.token,
+ }, nil
+}
+
+// RequireTransportSecurity returns true by default to protect the token in transit.
+// Set NB_PROXY_ALLOW_INSECURE=true to allow non-TLS connections (not recommended for production).
+func (t proxyAuthToken) RequireTransportSecurity() bool {
+ return !t.allowInsecure
+}
+
+// WithProxyToken returns a DialOption that sets the proxy access token on each outbound RPC.
+func WithProxyToken(token string) grpc.DialOption {
+ allowInsecure := false
+ if val := os.Getenv(EnvProxyAllowInsecure); val != "" {
+ parsed, err := strconv.ParseBool(val)
+ if err != nil {
+ log.Warnf("invalid value for %s: %v", EnvProxyAllowInsecure, err)
+ } else {
+ allowInsecure = parsed
+ }
+ }
+ return grpc.WithPerRPCCredentials(proxyAuthToken{token: token, allowInsecure: allowInsecure})
+}
diff --git a/proxy/internal/health/health.go b/proxy/internal/health/health.go
new file mode 100644
index 000000000..60ce7f8ef
--- /dev/null
+++ b/proxy/internal/health/health.go
@@ -0,0 +1,405 @@
+// Package health provides health probes for the proxy server.
+package health
+
+import (
+ "context"
+ "encoding/json"
+ "net"
+ "net/http"
+ "strings"
+ "sync"
+ "time"
+
+ log "github.com/sirupsen/logrus"
+
+ "github.com/netbirdio/netbird/client/embed"
+ "github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+const handshakeStaleThreshold = 5 * time.Minute
+
+const (
+ maxConcurrentChecks = 3
+ maxClientCheckTimeout = 5 * time.Minute
+)
+
+// clientProvider provides access to NetBird clients for health checks.
+type clientProvider interface {
+ ListClientsForStartup() map[types.AccountID]*embed.Client
+}
+
+// Checker tracks health state and provides probe endpoints.
+type Checker struct {
+ logger *log.Logger
+ provider clientProvider
+
+ mu sync.RWMutex
+ managementConnected bool
+ initialSyncComplete bool
+ shuttingDown bool
+
+ // checkSem limits concurrent client health checks.
+ checkSem chan struct{}
+
+ // checkHealth checks the health of a single client.
+ // Defaults to checkClientHealth; overridable in tests.
+ checkHealth func(*embed.Client) ClientHealth
+}
+
+// ClientHealth represents the health status of a single NetBird client.
+type ClientHealth struct {
+ Healthy bool `json:"healthy"`
+ ManagementConnected bool `json:"management_connected"`
+ SignalConnected bool `json:"signal_connected"`
+ RelaysConnected int `json:"relays_connected"`
+ RelaysTotal int `json:"relays_total"`
+ PeersTotal int `json:"peers_total"`
+ PeersConnected int `json:"peers_connected"`
+ PeersP2P int `json:"peers_p2p"`
+ PeersRelayed int `json:"peers_relayed"`
+ PeersDegraded int `json:"peers_degraded"`
+ Error string `json:"error,omitempty"`
+}
+
+// ProbeResponse represents the JSON response for health probes.
+type ProbeResponse struct {
+ Status string `json:"status"`
+ Checks map[string]bool `json:"checks,omitempty"`
+ Clients map[types.AccountID]ClientHealth `json:"clients,omitempty"`
+}
+
+// Server runs the health probe HTTP server on a dedicated port.
+type Server struct {
+ server *http.Server
+ logger *log.Logger
+ checker *Checker
+}
+
+// SetManagementConnected updates the management connection state.
+func (c *Checker) SetManagementConnected(connected bool) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.managementConnected = connected
+}
+
+// SetInitialSyncComplete marks that the initial mapping sync has completed.
+func (c *Checker) SetInitialSyncComplete() {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.initialSyncComplete = true
+}
+
+// SetShuttingDown marks the server as shutting down.
+// This causes ReadinessProbe to return false so load balancers stop routing traffic.
+func (c *Checker) SetShuttingDown() {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.shuttingDown = true
+}
+
+// CheckClientsConnected verifies all clients are connected to management/signal/relay.
+// Uses the provided context for timeout/cancellation, with a maximum bound of maxClientCheckTimeout.
+// Limits concurrent checks via semaphore.
+func (c *Checker) CheckClientsConnected(ctx context.Context) (bool, map[types.AccountID]ClientHealth) {
+ // Apply upper bound timeout in case parent context has no deadline
+ ctx, cancel := context.WithTimeout(ctx, maxClientCheckTimeout)
+ defer cancel()
+
+ clients := c.provider.ListClientsForStartup()
+
+ // No clients is not a health issue
+ if len(clients) == 0 {
+ return true, make(map[types.AccountID]ClientHealth)
+ }
+
+ type result struct {
+ accountID types.AccountID
+ health ClientHealth
+ }
+
+ resultsCh := make(chan result, len(clients))
+ var wg sync.WaitGroup
+
+ for accountID, client := range clients {
+ wg.Add(1)
+ go func(id types.AccountID, cl *embed.Client) {
+ defer wg.Done()
+
+ // Acquire semaphore
+ select {
+ case c.checkSem <- struct{}{}:
+ defer func() { <-c.checkSem }()
+ case <-ctx.Done():
+ resultsCh <- result{id, ClientHealth{Healthy: false, Error: ctx.Err().Error()}}
+ return
+ }
+
+ resultsCh <- result{id, c.checkHealth(cl)}
+ }(accountID, client)
+ }
+
+ go func() {
+ wg.Wait()
+ close(resultsCh)
+ }()
+
+ results := make(map[types.AccountID]ClientHealth)
+ allHealthy := true
+ for r := range resultsCh {
+ results[r.accountID] = r.health
+ if !r.health.Healthy {
+ allHealthy = false
+ }
+ }
+
+ return allHealthy, results
+}
+
+// LivenessProbe returns true if the process is alive.
+// This should always return true if we can respond.
+func (c *Checker) LivenessProbe() bool {
+ return true
+}
+
+// ReadinessProbe returns true if the server can accept traffic.
+func (c *Checker) ReadinessProbe() bool {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ if c.shuttingDown {
+ return false
+ }
+ return c.managementConnected
+}
+
+// StartupProbe checks if initial startup is complete.
+// Checks management connection, initial sync, and all client health directly.
+// Uses the provided context for timeout/cancellation.
+func (c *Checker) StartupProbe(ctx context.Context) bool {
+ c.mu.RLock()
+ mgmt := c.managementConnected
+ sync := c.initialSyncComplete
+ c.mu.RUnlock()
+
+ if !mgmt || !sync {
+ return false
+ }
+
+ // Check all clients are connected to management/signal/relay.
+ // Returns true when no clients exist (nothing to check).
+ allHealthy, _ := c.CheckClientsConnected(ctx)
+ return allHealthy
+}
+
+// Handler returns an http.Handler for health probe endpoints.
+func (c *Checker) Handler() http.Handler {
+ mux := http.NewServeMux()
+ mux.HandleFunc("/healthz/live", c.handleLiveness)
+ mux.HandleFunc("/healthz/ready", c.handleReadiness)
+ mux.HandleFunc("/healthz/startup", c.handleStartup)
+ mux.HandleFunc("/healthz", c.handleFull)
+ return mux
+}
+
+func (c *Checker) handleLiveness(w http.ResponseWriter, r *http.Request) {
+ if c.LivenessProbe() {
+ c.writeProbeResponse(w, http.StatusOK, "ok", nil, nil)
+ return
+ }
+ c.writeProbeResponse(w, http.StatusServiceUnavailable, "fail", nil, nil)
+}
+
+func (c *Checker) handleReadiness(w http.ResponseWriter, r *http.Request) {
+ c.mu.RLock()
+ checks := map[string]bool{
+ "management_connected": c.managementConnected,
+ }
+ c.mu.RUnlock()
+
+ if c.ReadinessProbe() {
+ c.writeProbeResponse(w, http.StatusOK, "ok", checks, nil)
+ return
+ }
+ c.writeProbeResponse(w, http.StatusServiceUnavailable, "fail", checks, nil)
+}
+
+func (c *Checker) handleStartup(w http.ResponseWriter, r *http.Request) {
+ c.mu.RLock()
+ mgmt := c.managementConnected
+ syncComplete := c.initialSyncComplete
+ c.mu.RUnlock()
+
+ allClientsHealthy, clientHealth := c.CheckClientsConnected(r.Context())
+
+ checks := map[string]bool{
+ "management_connected": mgmt,
+ "initial_sync_complete": syncComplete,
+ "all_clients_healthy": allClientsHealthy,
+ }
+
+ ready := mgmt && syncComplete && allClientsHealthy
+ if ready {
+ c.writeProbeResponse(w, http.StatusOK, "ok", checks, clientHealth)
+ return
+ }
+ c.writeProbeResponse(w, http.StatusServiceUnavailable, "fail", checks, clientHealth)
+}
+
+func (c *Checker) handleFull(w http.ResponseWriter, r *http.Request) {
+ c.mu.RLock()
+ mgmt := c.managementConnected
+ sync := c.initialSyncComplete
+ c.mu.RUnlock()
+
+ allClientsHealthy, clientHealth := c.CheckClientsConnected(r.Context())
+
+ checks := map[string]bool{
+ "management_connected": mgmt,
+ "initial_sync_complete": sync,
+ "all_clients_healthy": allClientsHealthy,
+ }
+
+ status := "ok"
+ statusCode := http.StatusOK
+ if !c.ReadinessProbe() {
+ status = "fail"
+ statusCode = http.StatusServiceUnavailable
+ }
+
+ c.writeProbeResponse(w, statusCode, status, checks, clientHealth)
+}
+
+func (c *Checker) writeProbeResponse(w http.ResponseWriter, statusCode int, status string, checks map[string]bool, clients map[types.AccountID]ClientHealth) {
+ w.Header().Set("Content-Type", "application/json")
+ w.WriteHeader(statusCode)
+
+ resp := ProbeResponse{
+ Status: status,
+ Checks: checks,
+ Clients: clients,
+ }
+ if err := json.NewEncoder(w).Encode(resp); err != nil {
+ c.logger.Debugf("write health response: %v", err)
+ }
+}
+
+// ListenAndServe starts the health probe server.
+func (s *Server) ListenAndServe() error {
+ s.logger.Infof("starting health probe server on %s", s.server.Addr)
+ return s.server.ListenAndServe()
+}
+
+// Serve starts the health probe server on the given listener.
+func (s *Server) Serve(l net.Listener) error {
+ s.logger.Infof("starting health probe server on %s", l.Addr())
+ return s.server.Serve(l)
+}
+
+// Shutdown gracefully shuts down the health probe server.
+func (s *Server) Shutdown(ctx context.Context) error {
+ return s.server.Shutdown(ctx)
+}
+
+// NewChecker creates a new health checker.
+func NewChecker(logger *log.Logger, provider clientProvider) *Checker {
+ if logger == nil {
+ logger = log.StandardLogger()
+ }
+ return &Checker{
+ logger: logger,
+ provider: provider,
+ checkSem: make(chan struct{}, maxConcurrentChecks),
+ checkHealth: checkClientHealth,
+ }
+}
+
+// NewServer creates a new health probe server.
+// If metricsHandler is non-nil, it is mounted at /metrics on the same port.
+func NewServer(addr string, checker *Checker, logger *log.Logger, metricsHandler http.Handler) *Server {
+ if logger == nil {
+ logger = log.StandardLogger()
+ }
+
+ handler := checker.Handler()
+ if metricsHandler != nil {
+ mux := http.NewServeMux()
+ mux.Handle("/metrics", metricsHandler)
+ mux.Handle("/", handler)
+ handler = mux
+ }
+
+ return &Server{
+ server: &http.Server{
+ Addr: addr,
+ Handler: handler,
+ ReadTimeout: 5 * time.Second,
+ WriteTimeout: 5 * time.Second,
+ },
+ logger: logger,
+ checker: checker,
+ }
+}
+
+func checkClientHealth(client *embed.Client) ClientHealth {
+ if client == nil {
+ return ClientHealth{
+ Healthy: false,
+ Error: "client not initialized",
+ }
+ }
+
+ status, err := client.Status()
+ if err != nil {
+ return ClientHealth{
+ Healthy: false,
+ Error: err.Error(),
+ }
+ }
+
+ // Count only rel:// and rels:// relays (not stun/turn)
+ var relayCount, relaysConnected int
+ for _, relay := range status.Relays {
+ if !strings.HasPrefix(relay.URI, "rel://") && !strings.HasPrefix(relay.URI, "rels://") {
+ continue
+ }
+ relayCount++
+ if relay.Err == nil {
+ relaysConnected++
+ }
+ }
+
+ // Count peer connection stats
+ now := time.Now()
+ var peersConnected, peersP2P, peersRelayed, peersDegraded int
+ for _, p := range status.Peers {
+ if p.ConnStatus != embed.PeerStatusConnected {
+ continue
+ }
+ peersConnected++
+ if p.Relayed {
+ peersRelayed++
+ } else {
+ peersP2P++
+ }
+ if p.LastWireguardHandshake.IsZero() || now.Sub(p.LastWireguardHandshake) > handshakeStaleThreshold {
+ peersDegraded++
+ }
+ }
+
+ // Client is healthy if connected to management, signal, and at least one relay (if any are defined)
+ healthy := status.ManagementState.Connected &&
+ status.SignalState.Connected &&
+ (relayCount == 0 || relaysConnected > 0)
+
+ return ClientHealth{
+ Healthy: healthy,
+ ManagementConnected: status.ManagementState.Connected,
+ SignalConnected: status.SignalState.Connected,
+ RelaysConnected: relaysConnected,
+ RelaysTotal: relayCount,
+ PeersTotal: len(status.Peers),
+ PeersConnected: peersConnected,
+ PeersP2P: peersP2P,
+ PeersRelayed: peersRelayed,
+ PeersDegraded: peersDegraded,
+ }
+}
diff --git a/proxy/internal/health/health_test.go b/proxy/internal/health/health_test.go
new file mode 100644
index 000000000..47b5f250f
--- /dev/null
+++ b/proxy/internal/health/health_test.go
@@ -0,0 +1,473 @@
+package health
+
+import (
+ "context"
+ "encoding/json"
+ "net/http"
+ "net/http/httptest"
+ "sync"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+
+ "github.com/netbirdio/netbird/client/embed"
+ "github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+type mockClientProvider struct {
+ clients map[types.AccountID]*embed.Client
+}
+
+func (m *mockClientProvider) ListClientsForStartup() map[types.AccountID]*embed.Client {
+ return m.clients
+}
+
+// newTestChecker creates a checker with a mock health function for testing.
+// The health function returns the provided ClientHealth for every client.
+func newTestChecker(provider clientProvider, healthResult ClientHealth) *Checker {
+ c := NewChecker(nil, provider)
+ c.checkHealth = func(_ *embed.Client) ClientHealth {
+ return healthResult
+ }
+ return c
+}
+
+func TestChecker_LivenessProbe(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+
+ // Liveness should always return true if we can respond.
+ assert.True(t, checker.LivenessProbe())
+}
+
+func TestChecker_ReadinessProbe(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+
+ // Initially not ready (management not connected).
+ assert.False(t, checker.ReadinessProbe())
+
+ // After management connects, should be ready.
+ checker.SetManagementConnected(true)
+ assert.True(t, checker.ReadinessProbe())
+
+ // If management disconnects, should not be ready.
+ checker.SetManagementConnected(false)
+ assert.False(t, checker.ReadinessProbe())
+}
+
+// TestStartupProbe_EmptyServiceList covers the scenario where management has
+// no services configured for this proxy. The proxy should become ready once
+// management is connected and the initial sync completes, even with zero clients.
+func TestStartupProbe_EmptyServiceList(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+
+ // No management connection = not ready.
+ assert.False(t, checker.StartupProbe(context.Background()))
+
+ // Management connected but no sync = not ready.
+ checker.SetManagementConnected(true)
+ assert.False(t, checker.StartupProbe(context.Background()))
+
+ // Management + sync complete + no clients = ready.
+ checker.SetInitialSyncComplete()
+ assert.True(t, checker.StartupProbe(context.Background()))
+}
+
+// TestStartupProbe_WithUnhealthyClients verifies that when services exist
+// and clients have been created but are not yet fully connected (to mgmt,
+// signal, relays), the startup probe does NOT pass.
+func TestStartupProbe_WithUnhealthyClients(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil, // concrete client not needed; checkHealth is mocked
+ "account-2": nil,
+ },
+ }
+ checker := newTestChecker(provider, ClientHealth{Healthy: false, Error: "not connected yet"})
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+
+ assert.False(t, checker.StartupProbe(context.Background()),
+ "startup probe must not pass when clients are unhealthy")
+}
+
+// TestStartupProbe_WithHealthyClients verifies that once all clients are
+// connected and healthy, the startup probe passes.
+func TestStartupProbe_WithHealthyClients(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil,
+ "account-2": nil,
+ },
+ }
+ checker := newTestChecker(provider, ClientHealth{
+ Healthy: true,
+ ManagementConnected: true,
+ SignalConnected: true,
+ RelaysConnected: 1,
+ RelaysTotal: 1,
+ })
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+
+ assert.True(t, checker.StartupProbe(context.Background()),
+ "startup probe must pass when all clients are healthy")
+}
+
+// TestStartupProbe_MixedHealthClients verifies that if any single client is
+// unhealthy, the startup probe fails (all-or-nothing).
+func TestStartupProbe_MixedHealthClients(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "healthy-account": nil,
+ "unhealthy-account": nil,
+ },
+ }
+
+ checker := NewChecker(nil, provider)
+ checker.checkHealth = func(cl *embed.Client) ClientHealth {
+ // We identify accounts by their position in the map iteration; since we
+ // can't control map order, make exactly one unhealthy via counter.
+ return ClientHealth{Healthy: false}
+ }
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+
+ assert.False(t, checker.StartupProbe(context.Background()),
+ "startup probe must fail if any client is unhealthy")
+}
+
+// TestStartupProbe_RequiresAllConditions ensures that each individual
+// prerequisite (management, sync, clients) is necessary. The probe must not
+// pass if any one is missing.
+func TestStartupProbe_RequiresAllConditions(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil,
+ },
+ }
+
+ t.Run("no management", func(t *testing.T) {
+ checker := newTestChecker(provider, ClientHealth{Healthy: true})
+ checker.SetInitialSyncComplete()
+ // management NOT connected
+ assert.False(t, checker.StartupProbe(context.Background()))
+ })
+
+ t.Run("no sync", func(t *testing.T) {
+ checker := newTestChecker(provider, ClientHealth{Healthy: true})
+ checker.SetManagementConnected(true)
+ // sync NOT complete
+ assert.False(t, checker.StartupProbe(context.Background()))
+ })
+
+ t.Run("unhealthy client", func(t *testing.T) {
+ checker := newTestChecker(provider, ClientHealth{Healthy: false})
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+ assert.False(t, checker.StartupProbe(context.Background()))
+ })
+
+ t.Run("all conditions met", func(t *testing.T) {
+ checker := newTestChecker(provider, ClientHealth{Healthy: true})
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+ assert.True(t, checker.StartupProbe(context.Background()))
+ })
+}
+
+// TestStartupProbe_ConcurrentAccess runs the startup probe from many
+// goroutines simultaneously to check for races.
+func TestStartupProbe_ConcurrentAccess(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil,
+ "account-2": nil,
+ },
+ }
+ checker := newTestChecker(provider, ClientHealth{Healthy: true})
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+
+ var wg sync.WaitGroup
+ const goroutines = 50
+ results := make([]bool, goroutines)
+
+ for i := range goroutines {
+ wg.Add(1)
+ go func(idx int) {
+ defer wg.Done()
+ results[idx] = checker.StartupProbe(context.Background())
+ }(i)
+ }
+ wg.Wait()
+
+ for i, r := range results {
+ assert.True(t, r, "goroutine %d got unexpected result", i)
+ }
+}
+
+// TestStartupProbe_CancelledContext verifies that a cancelled context causes
+// the probe to report unhealthy when client checks are needed.
+func TestStartupProbe_CancelledContext(t *testing.T) {
+ t.Run("no management bypasses context", func(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ ctx, cancel := context.WithCancel(context.Background())
+ cancel()
+ // Should be false because management isn't connected, context is irrelevant.
+ assert.False(t, checker.StartupProbe(ctx))
+ })
+
+ t.Run("with clients and cancelled context", func(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil,
+ },
+ }
+ checker := NewChecker(nil, provider)
+ // Use the real checkHealth path — a cancelled context should cause
+ // the semaphore acquisition to fail, reporting unhealthy.
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+
+ ctx, cancel := context.WithCancel(context.Background())
+ cancel()
+ assert.False(t, checker.StartupProbe(ctx),
+ "cancelled context must result in unhealthy when clients exist")
+ })
+}
+
+// TestHandler_Startup_EmptyServiceList verifies the HTTP startup endpoint
+// returns 200 when management is connected, sync is complete, and there are
+// no services/clients.
+func TestHandler_Startup_EmptyServiceList(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/startup", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusOK, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "ok", resp.Status)
+ assert.True(t, resp.Checks["management_connected"])
+ assert.True(t, resp.Checks["initial_sync_complete"])
+ assert.True(t, resp.Checks["all_clients_healthy"])
+ assert.Empty(t, resp.Clients)
+}
+
+// TestHandler_Startup_WithUnhealthyClients verifies that the HTTP startup
+// endpoint returns 503 when clients exist but are not yet healthy.
+func TestHandler_Startup_WithUnhealthyClients(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil,
+ },
+ }
+ checker := newTestChecker(provider, ClientHealth{Healthy: false, Error: "starting"})
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/startup", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "fail", resp.Status)
+ assert.True(t, resp.Checks["management_connected"])
+ assert.True(t, resp.Checks["initial_sync_complete"])
+ assert.False(t, resp.Checks["all_clients_healthy"])
+ require.Contains(t, resp.Clients, types.AccountID("account-1"))
+ assert.Equal(t, "starting", resp.Clients["account-1"].Error)
+}
+
+// TestHandler_Startup_WithHealthyClients verifies the HTTP startup endpoint
+// returns 200 once clients are healthy.
+func TestHandler_Startup_WithHealthyClients(t *testing.T) {
+ provider := &mockClientProvider{
+ clients: map[types.AccountID]*embed.Client{
+ "account-1": nil,
+ },
+ }
+ checker := newTestChecker(provider, ClientHealth{
+ Healthy: true,
+ ManagementConnected: true,
+ SignalConnected: true,
+ RelaysConnected: 1,
+ RelaysTotal: 1,
+ })
+ checker.SetManagementConnected(true)
+ checker.SetInitialSyncComplete()
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/startup", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusOK, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "ok", resp.Status)
+ assert.True(t, resp.Checks["all_clients_healthy"])
+}
+
+// TestHandler_Startup_NotComplete verifies the startup handler returns 503
+// when prerequisites aren't met.
+func TestHandler_Startup_NotComplete(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/startup", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "fail", resp.Status)
+}
+
+func TestChecker_Handler_Liveness(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/live", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusOK, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "ok", resp.Status)
+}
+
+func TestChecker_Handler_Readiness_NotReady(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/ready", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "fail", resp.Status)
+ assert.False(t, resp.Checks["management_connected"])
+}
+
+func TestChecker_Handler_Readiness_Ready(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/ready", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusOK, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "ok", resp.Status)
+ assert.True(t, resp.Checks["management_connected"])
+}
+
+func TestChecker_Handler_Full(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusOK, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "ok", resp.Status)
+ assert.NotNil(t, resp.Checks)
+ // Clients may be empty map when no clients exist.
+ assert.Empty(t, resp.Clients)
+}
+
+func TestChecker_SetShuttingDown(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+
+ assert.True(t, checker.ReadinessProbe(), "should be ready before shutdown")
+
+ checker.SetShuttingDown()
+
+ assert.False(t, checker.ReadinessProbe(), "should not be ready after shutdown")
+}
+
+func TestChecker_Handler_Readiness_ShuttingDown(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+ checker.SetShuttingDown()
+ handler := checker.Handler()
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/ready", nil)
+ rec := httptest.NewRecorder()
+ handler.ServeHTTP(rec, req)
+
+ assert.Equal(t, http.StatusServiceUnavailable, rec.Code)
+
+ var resp ProbeResponse
+ require.NoError(t, json.NewDecoder(rec.Body).Decode(&resp))
+ assert.Equal(t, "fail", resp.Status)
+}
+
+func TestNewServer_WithMetricsHandler(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+
+ metricsHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+ w.WriteHeader(http.StatusOK)
+ _, _ = w.Write([]byte("metrics"))
+ })
+
+ srv := NewServer(":0", checker, nil, metricsHandler)
+ require.NotNil(t, srv)
+
+ // Verify health endpoint still works through the mux.
+ req := httptest.NewRequest(http.MethodGet, "/healthz/live", nil)
+ rec := httptest.NewRecorder()
+ srv.server.Handler.ServeHTTP(rec, req)
+ assert.Equal(t, http.StatusOK, rec.Code)
+
+ // Verify metrics endpoint is mounted.
+ req = httptest.NewRequest(http.MethodGet, "/metrics", nil)
+ rec = httptest.NewRecorder()
+ srv.server.Handler.ServeHTTP(rec, req)
+ assert.Equal(t, http.StatusOK, rec.Code)
+ assert.Equal(t, "metrics", rec.Body.String())
+}
+
+func TestNewServer_WithoutMetricsHandler(t *testing.T) {
+ checker := NewChecker(nil, &mockClientProvider{})
+ checker.SetManagementConnected(true)
+
+ srv := NewServer(":0", checker, nil, nil)
+ require.NotNil(t, srv)
+
+ req := httptest.NewRequest(http.MethodGet, "/healthz/live", nil)
+ rec := httptest.NewRecorder()
+ srv.server.Handler.ServeHTTP(rec, req)
+ assert.Equal(t, http.StatusOK, rec.Code)
+}
diff --git a/proxy/internal/k8s/lease.go b/proxy/internal/k8s/lease.go
new file mode 100644
index 000000000..9677e0e27
--- /dev/null
+++ b/proxy/internal/k8s/lease.go
@@ -0,0 +1,281 @@
+// Package k8s provides a lightweight Kubernetes API client for coordination
+// Leases. It uses raw HTTP calls against the mounted service account
+// credentials, avoiding a dependency on client-go.
+package k8s
+
+import (
+ "bytes"
+ "context"
+ "crypto/sha256"
+ "crypto/tls"
+ "crypto/x509"
+ "encoding/hex"
+ "encoding/json"
+ "errors"
+ "fmt"
+ "io"
+ "net/http"
+ "os"
+ "strings"
+ "time"
+)
+
+const (
+ saTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token" //nolint:gosec
+ saNamespacePath = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
+ saCACertPath = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+
+ leaseAPIPath = "/apis/coordination.k8s.io/v1"
+)
+
+// ErrConflict is returned when a Lease update fails due to a
+// resourceVersion mismatch (another writer updated the object first).
+var ErrConflict = errors.New("conflict: resource version mismatch")
+
+// Lease represents a coordination.k8s.io/v1 Lease object with only the
+// fields needed for distributed locking.
+type Lease struct {
+ APIVersion string `json:"apiVersion"`
+ Kind string `json:"kind"`
+ Metadata LeaseMetadata `json:"metadata"`
+ Spec LeaseSpec `json:"spec"`
+}
+
+// LeaseMetadata holds the standard k8s object metadata fields used by Leases.
+type LeaseMetadata struct {
+ Name string `json:"name"`
+ Namespace string `json:"namespace,omitempty"`
+ ResourceVersion string `json:"resourceVersion,omitempty"`
+ Annotations map[string]string `json:"annotations,omitempty"`
+}
+
+// LeaseSpec holds the Lease specification fields.
+type LeaseSpec struct {
+ HolderIdentity *string `json:"holderIdentity"`
+ LeaseDurationSeconds *int32 `json:"leaseDurationSeconds,omitempty"`
+ AcquireTime *MicroTime `json:"acquireTime"`
+ RenewTime *MicroTime `json:"renewTime"`
+}
+
+// MicroTime wraps time.Time with Kubernetes MicroTime JSON formatting.
+type MicroTime struct {
+ time.Time
+}
+
+const microTimeFormat = "2006-01-02T15:04:05.000000Z"
+
+// MarshalJSON implements json.Marshaler with k8s MicroTime format.
+func (t *MicroTime) MarshalJSON() ([]byte, error) {
+ return json.Marshal(t.UTC().Format(microTimeFormat))
+}
+
+// UnmarshalJSON implements json.Unmarshaler with k8s MicroTime format.
+func (t *MicroTime) UnmarshalJSON(data []byte) error {
+ var s string
+ if err := json.Unmarshal(data, &s); err != nil {
+ return err
+ }
+ if s == "" {
+ t.Time = time.Time{}
+ return nil
+ }
+
+ parsed, err := time.Parse(microTimeFormat, s)
+ if err != nil {
+ return fmt.Errorf("parse MicroTime %q: %w", s, err)
+ }
+ t.Time = parsed
+ return nil
+}
+
+// LeaseClient talks to the Kubernetes coordination API using raw HTTP.
+type LeaseClient struct {
+ baseURL string
+ namespace string
+ httpClient *http.Client
+}
+
+// NewLeaseClient creates a client that authenticates via the pod's
+// mounted service account. It reads the namespace and CA certificate
+// at construction time (they don't rotate) but reads the bearer token
+// fresh on each request (tokens rotate).
+func NewLeaseClient() (*LeaseClient, error) {
+ host := os.Getenv("KUBERNETES_SERVICE_HOST")
+ port := os.Getenv("KUBERNETES_SERVICE_PORT")
+ if host == "" || port == "" {
+ return nil, fmt.Errorf("KUBERNETES_SERVICE_HOST/PORT not set")
+ }
+
+ ns, err := os.ReadFile(saNamespacePath)
+ if err != nil {
+ return nil, fmt.Errorf("read namespace from %s: %w", saNamespacePath, err)
+ }
+
+ caCert, err := os.ReadFile(saCACertPath)
+ if err != nil {
+ return nil, fmt.Errorf("read CA cert from %s: %w", saCACertPath, err)
+ }
+
+ pool := x509.NewCertPool()
+ if !pool.AppendCertsFromPEM(caCert) {
+ return nil, fmt.Errorf("parse CA certificate from %s", saCACertPath)
+ }
+
+ return &LeaseClient{
+ baseURL: fmt.Sprintf("https://%s:%s", host, port),
+ namespace: strings.TrimSpace(string(ns)),
+ httpClient: &http.Client{
+ Timeout: 10 * time.Second,
+ Transport: &http.Transport{
+ TLSClientConfig: &tls.Config{
+ RootCAs: pool,
+ },
+ },
+ },
+ }, nil
+}
+
+// Namespace returns the namespace this client operates in.
+func (c *LeaseClient) Namespace() string {
+ return c.namespace
+}
+
+// Get retrieves a Lease by name. Returns (nil, nil) if the Lease does not exist.
+func (c *LeaseClient) Get(ctx context.Context, name string) (*Lease, error) {
+ url := fmt.Sprintf("%s%s/namespaces/%s/leases/%s", c.baseURL, leaseAPIPath, c.namespace, name)
+
+ resp, err := c.doRequest(ctx, http.MethodGet, url, nil)
+ if err != nil {
+ return nil, err
+ }
+ defer func() { _ = resp.Body.Close() }()
+
+ if resp.StatusCode == http.StatusNotFound {
+ return nil, nil //nolint:nilnil
+ }
+ if resp.StatusCode != http.StatusOK {
+ return nil, c.readError(resp)
+ }
+
+ var lease Lease
+ if err := json.NewDecoder(resp.Body).Decode(&lease); err != nil {
+ return nil, fmt.Errorf("decode lease response: %w", err)
+ }
+ return &lease, nil
+}
+
+// Create creates a new Lease. Returns the created Lease with server-assigned
+// fields like resourceVersion populated.
+func (c *LeaseClient) Create(ctx context.Context, lease *Lease) (*Lease, error) {
+ url := fmt.Sprintf("%s%s/namespaces/%s/leases", c.baseURL, leaseAPIPath, c.namespace)
+
+ lease.APIVersion = "coordination.k8s.io/v1"
+ lease.Kind = "Lease"
+ if lease.Metadata.Namespace == "" {
+ lease.Metadata.Namespace = c.namespace
+ }
+
+ resp, err := c.doRequest(ctx, http.MethodPost, url, lease)
+ if err != nil {
+ return nil, err
+ }
+ defer func() { _ = resp.Body.Close() }()
+
+ if resp.StatusCode == http.StatusConflict {
+ return nil, ErrConflict
+ }
+ if resp.StatusCode != http.StatusCreated {
+ return nil, c.readError(resp)
+ }
+
+ var created Lease
+ if err := json.NewDecoder(resp.Body).Decode(&created); err != nil {
+ return nil, fmt.Errorf("decode created lease: %w", err)
+ }
+ return &created, nil
+}
+
+// Update replaces a Lease. The lease.Metadata.ResourceVersion must match
+// the current server value (optimistic concurrency). Returns ErrConflict
+// on version mismatch.
+func (c *LeaseClient) Update(ctx context.Context, lease *Lease) (*Lease, error) {
+ url := fmt.Sprintf("%s%s/namespaces/%s/leases/%s", c.baseURL, leaseAPIPath, c.namespace, lease.Metadata.Name)
+
+ lease.APIVersion = "coordination.k8s.io/v1"
+ lease.Kind = "Lease"
+
+ resp, err := c.doRequest(ctx, http.MethodPut, url, lease)
+ if err != nil {
+ return nil, err
+ }
+ defer func() { _ = resp.Body.Close() }()
+
+ if resp.StatusCode == http.StatusConflict {
+ return nil, ErrConflict
+ }
+ if resp.StatusCode != http.StatusOK {
+ return nil, c.readError(resp)
+ }
+
+ var updated Lease
+ if err := json.NewDecoder(resp.Body).Decode(&updated); err != nil {
+ return nil, fmt.Errorf("decode updated lease: %w", err)
+ }
+ return &updated, nil
+}
+
+func (c *LeaseClient) doRequest(ctx context.Context, method, url string, body any) (*http.Response, error) {
+ token, err := readToken()
+ if err != nil {
+ return nil, fmt.Errorf("read service account token: %w", err)
+ }
+
+ var bodyReader io.Reader
+ if body != nil {
+ data, err := json.Marshal(body)
+ if err != nil {
+ return nil, fmt.Errorf("marshal request body: %w", err)
+ }
+ bodyReader = bytes.NewReader(data)
+ }
+
+ req, err := http.NewRequestWithContext(ctx, method, url, bodyReader)
+ if err != nil {
+ return nil, fmt.Errorf("create request: %w", err)
+ }
+
+ req.Header.Set("Authorization", "Bearer "+token)
+ req.Header.Set("Accept", "application/json")
+ if body != nil {
+ req.Header.Set("Content-Type", "application/json")
+ }
+
+ return c.httpClient.Do(req)
+}
+
+func readToken() (string, error) {
+ data, err := os.ReadFile(saTokenPath)
+ if err != nil {
+ return "", fmt.Errorf("read %s: %w", saTokenPath, err)
+ }
+ return strings.TrimSpace(string(data)), nil
+}
+
+func (c *LeaseClient) readError(resp *http.Response) error {
+ body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
+ return fmt.Errorf("k8s API %s %d: %s", resp.Request.URL.Path, resp.StatusCode, string(body))
+}
+
+// LeaseNameForDomain returns a deterministic, DNS-label-safe Lease name
+// for the given domain. The domain is hashed to avoid dots and length issues.
+func LeaseNameForDomain(domain string) string {
+ h := sha256.Sum256([]byte(domain))
+ return "cert-lock-" + hex.EncodeToString(h[:8])
+}
+
+// InCluster reports whether the process is running inside a Kubernetes pod
+// by checking for the KUBERNETES_SERVICE_HOST environment variable.
+func InCluster() bool {
+ _, exists := os.LookupEnv("KUBERNETES_SERVICE_HOST")
+ return exists
+}
diff --git a/proxy/internal/k8s/lease_test.go b/proxy/internal/k8s/lease_test.go
new file mode 100644
index 000000000..9d5d3c6ce
--- /dev/null
+++ b/proxy/internal/k8s/lease_test.go
@@ -0,0 +1,102 @@
+package k8s
+
+import (
+ "encoding/json"
+ "testing"
+ "time"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+)
+
+func TestLeaseNameForDomain(t *testing.T) {
+ tests := []struct {
+ domain string
+ }{
+ {"example.com"},
+ {"app.example.com"},
+ {"another.domain.io"},
+ }
+
+ seen := make(map[string]string)
+ for _, tc := range tests {
+ name := LeaseNameForDomain(tc.domain)
+
+ assert.True(t, len(name) <= 63, "must be valid DNS label length")
+ assert.Regexp(t, `^cert-lock-[0-9a-f]{16}$`, name,
+ "must match expected format for domain %q", tc.domain)
+
+ // Same input produces same output.
+ assert.Equal(t, name, LeaseNameForDomain(tc.domain), "must be deterministic")
+
+ // Different domains produce different names.
+ if prev, ok := seen[name]; ok {
+ t.Errorf("collision: %q and %q both map to %s", prev, tc.domain, name)
+ }
+ seen[name] = tc.domain
+ }
+}
+
+func TestMicroTimeJSON(t *testing.T) {
+ ts := time.Date(2024, 6, 15, 10, 30, 0, 0, time.UTC)
+ mt := &MicroTime{Time: ts}
+
+ data, err := json.Marshal(mt)
+ require.NoError(t, err)
+ assert.Equal(t, `"2024-06-15T10:30:00.000000Z"`, string(data))
+
+ var decoded MicroTime
+ require.NoError(t, json.Unmarshal(data, &decoded))
+ assert.True(t, ts.Equal(decoded.Time), "round-trip should preserve time")
+}
+
+func TestMicroTimeNullJSON(t *testing.T) {
+ // Null pointer serializes as JSON null via the Lease struct.
+ spec := LeaseSpec{
+ HolderIdentity: nil,
+ AcquireTime: nil,
+ RenewTime: nil,
+ }
+
+ data, err := json.Marshal(spec)
+ require.NoError(t, err)
+ assert.Contains(t, string(data), `"acquireTime":null`)
+ assert.Contains(t, string(data), `"renewTime":null`)
+}
+
+func TestLeaseJSONRoundTrip(t *testing.T) {
+ holder := "pod-abc"
+ dur := int32(300)
+ now := MicroTime{Time: time.Now().UTC().Truncate(time.Microsecond)}
+
+ original := Lease{
+ APIVersion: "coordination.k8s.io/v1",
+ Kind: "Lease",
+ Metadata: LeaseMetadata{
+ Name: "cert-lock-abcdef0123456789",
+ Namespace: "default",
+ ResourceVersion: "12345",
+ Annotations: map[string]string{
+ "netbird.io/domain": "app.example.com",
+ },
+ },
+ Spec: LeaseSpec{
+ HolderIdentity: &holder,
+ LeaseDurationSeconds: &dur,
+ AcquireTime: &now,
+ RenewTime: &now,
+ },
+ }
+
+ data, err := json.Marshal(original)
+ require.NoError(t, err)
+
+ var decoded Lease
+ require.NoError(t, json.Unmarshal(data, &decoded))
+
+ assert.Equal(t, original.Metadata.Name, decoded.Metadata.Name)
+ assert.Equal(t, original.Metadata.ResourceVersion, decoded.Metadata.ResourceVersion)
+ assert.Equal(t, *original.Spec.HolderIdentity, *decoded.Spec.HolderIdentity)
+ assert.Equal(t, *original.Spec.LeaseDurationSeconds, *decoded.Spec.LeaseDurationSeconds)
+ assert.True(t, original.Spec.AcquireTime.Equal(decoded.Spec.AcquireTime.Time))
+}
diff --git a/proxy/internal/metrics/metrics.go b/proxy/internal/metrics/metrics.go
new file mode 100644
index 000000000..951ce73dd
--- /dev/null
+++ b/proxy/internal/metrics/metrics.go
@@ -0,0 +1,149 @@
+package metrics
+
+import (
+ "net/http"
+ "strconv"
+ "time"
+
+ "github.com/netbirdio/netbird/proxy/internal/proxy"
+ "github.com/prometheus/client_golang/prometheus"
+ "github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+type Metrics struct {
+ requestsTotal prometheus.Counter
+ activeRequests prometheus.Gauge
+ configuredDomains prometheus.Gauge
+ pathsPerDomain *prometheus.GaugeVec
+ requestDuration *prometheus.HistogramVec
+ backendDuration *prometheus.HistogramVec
+}
+
+func New(reg prometheus.Registerer) *Metrics {
+ promFactory := promauto.With(reg)
+ return &Metrics{
+ requestsTotal: promFactory.NewCounter(prometheus.CounterOpts{
+ Name: "netbird_proxy_requests_total",
+ Help: "Total number of requests made to the netbird proxy",
+ }),
+ activeRequests: promFactory.NewGauge(prometheus.GaugeOpts{
+ Name: "netbird_proxy_active_requests_count",
+ Help: "Current in-flight requests handled by the netbird proxy",
+ }),
+ configuredDomains: promFactory.NewGauge(prometheus.GaugeOpts{
+ Name: "netbird_proxy_domains_count",
+ Help: "Current number of domains configured on the netbird proxy",
+ }),
+ pathsPerDomain: promFactory.NewGaugeVec(
+ prometheus.GaugeOpts{
+ Name: "netbird_proxy_paths_count",
+ Help: "Current number of paths configured on the netbird proxy labelled by domain",
+ },
+ []string{"domain"},
+ ),
+ requestDuration: promFactory.NewHistogramVec(
+ prometheus.HistogramOpts{
+ Name: "netbird_proxy_request_duration_seconds",
+ Help: "Duration of requests made to the netbird proxy",
+ Buckets: []float64{0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10},
+ },
+ []string{"status", "size", "method", "host", "path"},
+ ),
+ backendDuration: promFactory.NewHistogramVec(prometheus.HistogramOpts{
+ Name: "netbird_proxy_backend_duration_seconds",
+ Help: "Duration of peer round trip time from the netbird proxy",
+ Buckets: []float64{0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10},
+ },
+ []string{"status", "size", "method", "host", "path"},
+ ),
+ }
+}
+
+type responseInterceptor struct {
+ http.ResponseWriter
+ status int
+ size int
+}
+
+func (w *responseInterceptor) WriteHeader(status int) {
+ w.status = status
+ w.ResponseWriter.WriteHeader(status)
+}
+
+func (w *responseInterceptor) Write(b []byte) (int, error) {
+ size, err := w.ResponseWriter.Write(b)
+ w.size += size
+ return size, err
+}
+
+func (m *Metrics) Middleware(next http.Handler) http.Handler {
+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ m.requestsTotal.Inc()
+ m.activeRequests.Inc()
+
+ interceptor := &responseInterceptor{ResponseWriter: w}
+
+ start := time.Now()
+ next.ServeHTTP(interceptor, r)
+ duration := time.Since(start)
+
+ m.activeRequests.Desc()
+ m.requestDuration.With(prometheus.Labels{
+ "status": strconv.Itoa(interceptor.status),
+ "size": strconv.Itoa(interceptor.size),
+ "method": r.Method,
+ "host": r.Host,
+ "path": r.URL.Path,
+ }).Observe(duration.Seconds())
+ })
+}
+
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) {
+ return f(r)
+}
+
+func (m *Metrics) RoundTripper(next http.RoundTripper) http.RoundTripper {
+ return roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+ labels := prometheus.Labels{
+ "method": req.Method,
+ "host": req.Host,
+ // Fill potentially empty labels with default values to avoid cardinality issues.
+ "path": "/",
+ "status": "0",
+ "size": "0",
+ }
+ if req.URL != nil {
+ labels["path"] = req.URL.Path
+ }
+
+ start := time.Now()
+ res, err := next.RoundTrip(req)
+ duration := time.Since(start)
+
+ // Not all labels will be available if there was an error.
+ if res != nil {
+ labels["status"] = strconv.Itoa(res.StatusCode)
+ labels["size"] = strconv.Itoa(int(res.ContentLength))
+ }
+
+ m.backendDuration.With(labels).Observe(duration.Seconds())
+
+ return res, err
+ })
+}
+
+func (m *Metrics) AddMapping(mapping proxy.Mapping) {
+ m.configuredDomains.Inc()
+ m.pathsPerDomain.With(prometheus.Labels{
+ "domain": mapping.Host,
+ }).Set(float64(len(mapping.Paths)))
+}
+
+func (m *Metrics) RemoveMapping(mapping proxy.Mapping) {
+ m.configuredDomains.Dec()
+ m.pathsPerDomain.With(prometheus.Labels{
+ "domain": mapping.Host,
+ }).Set(0)
+}
diff --git a/proxy/internal/metrics/metrics_test.go b/proxy/internal/metrics/metrics_test.go
new file mode 100644
index 000000000..31e00ae64
--- /dev/null
+++ b/proxy/internal/metrics/metrics_test.go
@@ -0,0 +1,67 @@
+package metrics_test
+
+import (
+ "net/http"
+ "net/url"
+ "testing"
+
+ "github.com/google/go-cmp/cmp"
+ "github.com/netbirdio/netbird/proxy/internal/metrics"
+ "github.com/prometheus/client_golang/prometheus"
+)
+
+type testRoundTripper struct {
+ response *http.Response
+ err error
+}
+
+func (t *testRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+ return t.response, t.err
+}
+
+func TestMetrics_RoundTripper(t *testing.T) {
+ testResponse := http.Response{
+ StatusCode: http.StatusOK,
+ Body: http.NoBody,
+ }
+
+ tests := map[string]struct {
+ roundTripper http.RoundTripper
+ request *http.Request
+ response *http.Response
+ err error
+ }{
+ "ok": {
+ roundTripper: &testRoundTripper{response: &testResponse},
+ request: &http.Request{Method: "GET", URL: &url.URL{Path: "/foo"}},
+ response: &testResponse,
+ },
+ "nil url": {
+ roundTripper: &testRoundTripper{response: &testResponse},
+ request: &http.Request{Method: "GET", URL: nil},
+ response: &testResponse,
+ },
+ "nil response": {
+ roundTripper: &testRoundTripper{response: nil},
+ request: &http.Request{Method: "GET", URL: &url.URL{Path: "/foo"}},
+ },
+ }
+
+ m := metrics.New(prometheus.NewRegistry())
+
+ for name, test := range tests {
+ t.Run(name, func(t *testing.T) {
+ rt := m.RoundTripper(test.roundTripper)
+ res, err := rt.RoundTrip(test.request)
+ if res != nil && res.Body != nil {
+ defer res.Body.Close()
+ }
+ if diff := cmp.Diff(test.err, err); diff != "" {
+ t.Errorf("Incorrect error (-want +got):\n%s", diff)
+ }
+ if diff := cmp.Diff(test.response, res); diff != "" {
+ t.Errorf("Incorrect response (-want +got):\n%s", diff)
+ }
+ })
+ }
+}
diff --git a/proxy/internal/proxy/context.go b/proxy/internal/proxy/context.go
new file mode 100644
index 000000000..22ebbf371
--- /dev/null
+++ b/proxy/internal/proxy/context.go
@@ -0,0 +1,187 @@
+package proxy
+
+import (
+ "context"
+ "sync"
+
+ "github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+type requestContextKey string
+
+const (
+ serviceIdKey requestContextKey = "serviceId"
+ accountIdKey requestContextKey = "accountId"
+ capturedDataKey requestContextKey = "capturedData"
+)
+
+// ResponseOrigin indicates where a response was generated.
+type ResponseOrigin int
+
+const (
+ // OriginBackend means the response came from the backend service.
+ OriginBackend ResponseOrigin = iota
+ // OriginNoRoute means the proxy had no matching host or path.
+ OriginNoRoute
+ // OriginProxyError means the proxy failed to reach the backend.
+ OriginProxyError
+ // OriginAuth means the proxy intercepted the request for authentication.
+ OriginAuth
+)
+
+func (o ResponseOrigin) String() string {
+ switch o {
+ case OriginNoRoute:
+ return "no_route"
+ case OriginProxyError:
+ return "proxy_error"
+ case OriginAuth:
+ return "auth"
+ default:
+ return "backend"
+ }
+}
+
+// CapturedData is a mutable struct that allows downstream handlers
+// to pass data back up the middleware chain.
+type CapturedData struct {
+ mu sync.RWMutex
+ RequestID string
+ ServiceId string
+ AccountId types.AccountID
+ Origin ResponseOrigin
+ ClientIP string
+ UserID string
+ AuthMethod string
+}
+
+// GetRequestID safely gets the request ID
+func (c *CapturedData) GetRequestID() string {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.RequestID
+}
+
+// SetServiceId safely sets the service ID
+func (c *CapturedData) SetServiceId(serviceId string) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.ServiceId = serviceId
+}
+
+// GetServiceId safely gets the service ID
+func (c *CapturedData) GetServiceId() string {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.ServiceId
+}
+
+// SetAccountId safely sets the account ID
+func (c *CapturedData) SetAccountId(accountId types.AccountID) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.AccountId = accountId
+}
+
+// GetAccountId safely gets the account ID
+func (c *CapturedData) GetAccountId() types.AccountID {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.AccountId
+}
+
+// SetOrigin safely sets the response origin
+func (c *CapturedData) SetOrigin(origin ResponseOrigin) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.Origin = origin
+}
+
+// GetOrigin safely gets the response origin
+func (c *CapturedData) GetOrigin() ResponseOrigin {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.Origin
+}
+
+// SetClientIP safely sets the resolved client IP.
+func (c *CapturedData) SetClientIP(ip string) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.ClientIP = ip
+}
+
+// GetClientIP safely gets the resolved client IP.
+func (c *CapturedData) GetClientIP() string {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.ClientIP
+}
+
+// SetUserID safely sets the authenticated user ID.
+func (c *CapturedData) SetUserID(userID string) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.UserID = userID
+}
+
+// GetUserID safely gets the authenticated user ID.
+func (c *CapturedData) GetUserID() string {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.UserID
+}
+
+// SetAuthMethod safely sets the authentication method used.
+func (c *CapturedData) SetAuthMethod(method string) {
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ c.AuthMethod = method
+}
+
+// GetAuthMethod safely gets the authentication method used.
+func (c *CapturedData) GetAuthMethod() string {
+ c.mu.RLock()
+ defer c.mu.RUnlock()
+ return c.AuthMethod
+}
+
+// WithCapturedData adds a CapturedData struct to the context
+func WithCapturedData(ctx context.Context, data *CapturedData) context.Context {
+ return context.WithValue(ctx, capturedDataKey, data)
+}
+
+// CapturedDataFromContext retrieves the CapturedData from context
+func CapturedDataFromContext(ctx context.Context) *CapturedData {
+ v := ctx.Value(capturedDataKey)
+ data, ok := v.(*CapturedData)
+ if !ok {
+ return nil
+ }
+ return data
+}
+
+func withServiceId(ctx context.Context, serviceId string) context.Context {
+ return context.WithValue(ctx, serviceIdKey, serviceId)
+}
+
+func ServiceIdFromContext(ctx context.Context) string {
+ v := ctx.Value(serviceIdKey)
+ serviceId, ok := v.(string)
+ if !ok {
+ return ""
+ }
+ return serviceId
+}
+func withAccountId(ctx context.Context, accountId types.AccountID) context.Context {
+ return context.WithValue(ctx, accountIdKey, accountId)
+}
+
+func AccountIdFromContext(ctx context.Context) types.AccountID {
+ v := ctx.Value(accountIdKey)
+ accountId, ok := v.(types.AccountID)
+ if !ok {
+ return ""
+ }
+ return accountId
+}
diff --git a/proxy/internal/proxy/proxy_bench_test.go b/proxy/internal/proxy/proxy_bench_test.go
new file mode 100644
index 000000000..b7526e26b
--- /dev/null
+++ b/proxy/internal/proxy/proxy_bench_test.go
@@ -0,0 +1,130 @@
+package proxy_test
+
+import (
+ "crypto/rand"
+ "fmt"
+ "math/big"
+ "net/http"
+ "net/http/httptest"
+ "net/url"
+ "testing"
+
+ "github.com/netbirdio/netbird/proxy/internal/proxy"
+ "github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+type nopTransport struct{}
+
+func (nopTransport) RoundTrip(*http.Request) (*http.Response, error) {
+ return &http.Response{
+ StatusCode: http.StatusOK,
+ Body: http.NoBody,
+ }, nil
+}
+
+func BenchmarkServeHTTP(b *testing.B) {
+ rp := proxy.NewReverseProxy(nopTransport{}, "http", nil, nil)
+ rp.AddMapping(proxy.Mapping{
+ ID: rand.Text(),
+ AccountID: types.AccountID(rand.Text()),
+ Host: "app.example.com",
+ Paths: map[string]*url.URL{
+ "/": {
+ Scheme: "http",
+ Host: "10.0.0.1:8080",
+ },
+ },
+ })
+
+ req := httptest.NewRequest(http.MethodGet, "http://app.example.com", nil)
+ req.Host = "app.example.com"
+ req.RemoteAddr = "203.0.113.50:12345"
+
+ for b.Loop() {
+ rp.ServeHTTP(httptest.NewRecorder(), req)
+ }
+}
+
+func BenchmarkServeHTTPHostCount(b *testing.B) {
+ hostCounts := []int{1, 10, 100, 1_000, 10_000}
+
+ for _, hostCount := range hostCounts {
+ b.Run(fmt.Sprintf("hosts=%d", hostCount), func(b *testing.B) {
+ rp := proxy.NewReverseProxy(nopTransport{}, "http", nil, nil)
+
+ var target string
+ targetIndex, err := rand.Int(rand.Reader, big.NewInt(int64(hostCount)))
+ if err != nil {
+ b.Fatal(err)
+ }
+ for i := range hostCount {
+ id := rand.Text()
+ host := fmt.Sprintf("%s.example.com", id)
+ if int64(i) == targetIndex.Int64() {
+ target = id
+ }
+ rp.AddMapping(proxy.Mapping{
+ ID: id,
+ AccountID: types.AccountID(rand.Text()),
+ Host: host,
+ Paths: map[string]*url.URL{
+ "/": {
+ Scheme: "http",
+ Host: "10.0.0.1:8080",
+ },
+ },
+ })
+ }
+
+ req := httptest.NewRequest(http.MethodGet, "http://"+target+"/", nil)
+ req.Host = target
+ req.RemoteAddr = "203.0.113.50:12345"
+
+ for b.Loop() {
+ rp.ServeHTTP(httptest.NewRecorder(), req)
+ }
+ })
+ }
+}
+
+func BenchmarkServeHTTPPathCount(b *testing.B) {
+ pathCounts := []int{1, 5, 10, 25, 50}
+
+ for _, pathCount := range pathCounts {
+ b.Run(fmt.Sprintf("paths=%d", pathCount), func(b *testing.B) {
+ rp := proxy.NewReverseProxy(nopTransport{}, "http", nil, nil)
+
+ var target string
+ targetIndex, err := rand.Int(rand.Reader, big.NewInt(int64(pathCount)))
+ if err != nil {
+ b.Fatal(err)
+ }
+
+ paths := make(map[string]*url.URL, pathCount)
+ for i := range pathCount {
+ path := "/" + rand.Text()
+ if int64(i) == targetIndex.Int64() {
+ target = path
+ }
+ paths[path] = &url.URL{
+ Scheme: "http",
+ Host: "10.0.0.1:" + fmt.Sprintf("%d", 8080+i),
+ }
+ }
+ rp.AddMapping(proxy.Mapping{
+ ID: rand.Text(),
+ AccountID: types.AccountID(rand.Text()),
+ Host: "app.example.com",
+ Paths: paths,
+ })
+
+ req := httptest.NewRequest(http.MethodGet, "http://app.example.com"+target, nil)
+ req.Host = "app.example.com"
+ req.RemoteAddr = "203.0.113.50:12345"
+
+ for b.Loop() {
+ rp.ServeHTTP(httptest.NewRecorder(), req)
+ }
+ })
+ }
+}
diff --git a/proxy/internal/proxy/reverseproxy.go b/proxy/internal/proxy/reverseproxy.go
new file mode 100644
index 000000000..16607689a
--- /dev/null
+++ b/proxy/internal/proxy/reverseproxy.go
@@ -0,0 +1,406 @@
+package proxy
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "net"
+ "net/http"
+ "net/http/httputil"
+ "net/netip"
+ "net/url"
+ "strings"
+ "sync"
+
+ log "github.com/sirupsen/logrus"
+
+ "github.com/netbirdio/netbird/proxy/auth"
+ "github.com/netbirdio/netbird/proxy/internal/roundtrip"
+ "github.com/netbirdio/netbird/proxy/web"
+)
+
+type ReverseProxy struct {
+ transport http.RoundTripper
+ // forwardedProto overrides the X-Forwarded-Proto header value.
+ // Valid values: "auto" (detect from TLS), "http", "https".
+ forwardedProto string
+ // trustedProxies is a list of IP prefixes for trusted upstream proxies.
+ // When the direct connection comes from a trusted proxy, forwarding
+ // headers are preserved and appended to instead of being stripped.
+ trustedProxies []netip.Prefix
+ mappingsMux sync.RWMutex
+ mappings map[string]Mapping
+ logger *log.Logger
+}
+
+// NewReverseProxy configures a new NetBird ReverseProxy.
+// This is a wrapper around an httputil.ReverseProxy set
+// to dynamically route requests based on internal mapping
+// between requested URLs and targets.
+// The internal mappings can be modified using the AddMapping
+// and RemoveMapping functions.
+func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies []netip.Prefix, logger *log.Logger) *ReverseProxy {
+ if logger == nil {
+ logger = log.StandardLogger()
+ }
+ return &ReverseProxy{
+ transport: transport,
+ forwardedProto: forwardedProto,
+ trustedProxies: trustedProxies,
+ mappings: make(map[string]Mapping),
+ logger: logger,
+ }
+}
+
+func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+ result, exists := p.findTargetForRequest(r)
+ if !exists {
+ if cd := CapturedDataFromContext(r.Context()); cd != nil {
+ cd.SetOrigin(OriginNoRoute)
+ }
+ requestID := getRequestID(r)
+ web.ServeErrorPage(w, r, http.StatusNotFound, "Service Not Found",
+ "The requested service could not be found. Please check the URL, try refreshing, or check if the peer is running. If that doesn't work, see our documentation for help.",
+ requestID, web.ErrorStatus{Proxy: true, Destination: false})
+ return
+ }
+
+ // Set the serviceId in the context for later retrieval.
+ ctx := withServiceId(r.Context(), result.serviceID)
+ // Set the accountId in the context for later retrieval (for middleware).
+ ctx = withAccountId(ctx, result.accountID)
+ // Set the accountId in the context for the roundtripper to use.
+ ctx = roundtrip.WithAccountID(ctx, result.accountID)
+
+ // Also populate captured data if it exists (allows middleware to read after handler completes).
+ // This solves the problem of passing data UP the middleware chain: we put a mutable struct
+ // pointer in the context, and mutate the struct here so outer middleware can read it.
+ if capturedData := CapturedDataFromContext(ctx); capturedData != nil {
+ capturedData.SetServiceId(result.serviceID)
+ capturedData.SetAccountId(result.accountID)
+ }
+
+ rp := &httputil.ReverseProxy{
+ Rewrite: p.rewriteFunc(result.url, result.matchedPath, result.passHostHeader),
+ Transport: p.transport,
+ ErrorHandler: proxyErrorHandler,
+ }
+ if result.rewriteRedirects {
+ rp.ModifyResponse = p.rewriteLocationFunc(result.url, result.matchedPath, r) //nolint:bodyclose
+ }
+ rp.ServeHTTP(w, r.WithContext(ctx))
+}
+
+// rewriteFunc returns a Rewrite function for httputil.ReverseProxy that rewrites
+// inbound requests to target the backend service while setting security-relevant
+// forwarding headers and stripping proxy authentication credentials.
+// When passHostHeader is true, the original client Host header is preserved
+// instead of being rewritten to the backend's address.
+func (p *ReverseProxy) rewriteFunc(target *url.URL, matchedPath string, passHostHeader bool) func(r *httputil.ProxyRequest) {
+ return func(r *httputil.ProxyRequest) {
+ // Strip the matched path prefix from the incoming request path before
+ // SetURL joins it with the target's base path, avoiding path duplication.
+ if matchedPath != "" && matchedPath != "/" {
+ r.Out.URL.Path = strings.TrimPrefix(r.Out.URL.Path, matchedPath)
+ if r.Out.URL.Path == "" {
+ r.Out.URL.Path = "/"
+ }
+ r.Out.URL.RawPath = ""
+ }
+
+ r.SetURL(target)
+ if passHostHeader {
+ r.Out.Host = r.In.Host
+ } else {
+ r.Out.Host = target.Host
+ }
+
+ clientIP := extractClientIP(r.In.RemoteAddr)
+
+ if IsTrustedProxy(clientIP, p.trustedProxies) {
+ p.setTrustedForwardingHeaders(r, clientIP)
+ } else {
+ p.setUntrustedForwardingHeaders(r, clientIP)
+ }
+
+ stripSessionCookie(r)
+ stripSessionTokenQuery(r)
+ }
+}
+
+// rewriteLocationFunc returns a ModifyResponse function that rewrites Location
+// headers in backend responses when they point to the backend's address,
+// replacing them with the public-facing host and scheme.
+func (p *ReverseProxy) rewriteLocationFunc(target *url.URL, matchedPath string, inReq *http.Request) func(*http.Response) error {
+ publicHost := inReq.Host
+ publicScheme := auth.ResolveProto(p.forwardedProto, inReq.TLS)
+
+ return func(resp *http.Response) error {
+ location := resp.Header.Get("Location")
+ if location == "" {
+ return nil
+ }
+
+ locURL, err := url.Parse(location)
+ if err != nil {
+ return fmt.Errorf("parse Location header %q: %w", location, err)
+ }
+
+ // Only rewrite absolute URLs that point to the backend.
+ if locURL.Host == "" || !hostsEqual(locURL, target) {
+ return nil
+ }
+
+ locURL.Host = publicHost
+ locURL.Scheme = publicScheme
+
+ // Re-add the stripped path prefix so the client reaches the correct route.
+ // TrimRight prevents double slashes when matchedPath has a trailing slash.
+ if matchedPath != "" && matchedPath != "/" {
+ locURL.Path = strings.TrimRight(matchedPath, "/") + "/" + strings.TrimLeft(locURL.Path, "/")
+ }
+
+ resp.Header.Set("Location", locURL.String())
+ return nil
+ }
+}
+
+// hostsEqual compares two URL authorities, normalizing default ports per
+// RFC 3986 Section 6.2.3 (https://443 == https, http://80 == http).
+func hostsEqual(a, b *url.URL) bool {
+ return normalizeHost(a) == normalizeHost(b)
+}
+
+// normalizeHost strips the port from a URL's Host field if it matches the
+// scheme's default port (443 for https, 80 for http).
+func normalizeHost(u *url.URL) string {
+ host, port, err := net.SplitHostPort(u.Host)
+ if err != nil {
+ return u.Host
+ }
+ if (u.Scheme == "https" && port == "443") || (u.Scheme == "http" && port == "80") {
+ return host
+ }
+ return u.Host
+}
+
+// setTrustedForwardingHeaders appends to the existing forwarding header chain
+// and preserves upstream-provided headers when the direct connection is from
+// a trusted proxy.
+func (p *ReverseProxy) setTrustedForwardingHeaders(r *httputil.ProxyRequest, clientIP string) {
+ // Append the direct connection IP to the existing X-Forwarded-For chain.
+ if existing := r.In.Header.Get("X-Forwarded-For"); existing != "" {
+ r.Out.Header.Set("X-Forwarded-For", existing+", "+clientIP)
+ } else {
+ r.Out.Header.Set("X-Forwarded-For", clientIP)
+ }
+
+ // Preserve upstream X-Real-IP if present; otherwise resolve through the chain.
+ if realIP := r.In.Header.Get("X-Real-IP"); realIP != "" {
+ r.Out.Header.Set("X-Real-IP", realIP)
+ } else {
+ resolved := ResolveClientIP(r.In.RemoteAddr, r.In.Header.Get("X-Forwarded-For"), p.trustedProxies)
+ r.Out.Header.Set("X-Real-IP", resolved)
+ }
+
+ // Preserve upstream X-Forwarded-Host if present.
+ if fwdHost := r.In.Header.Get("X-Forwarded-Host"); fwdHost != "" {
+ r.Out.Header.Set("X-Forwarded-Host", fwdHost)
+ } else {
+ r.Out.Header.Set("X-Forwarded-Host", r.In.Host)
+ }
+
+ // Trust upstream X-Forwarded-Proto; fall back to local resolution.
+ if fwdProto := r.In.Header.Get("X-Forwarded-Proto"); fwdProto != "" {
+ r.Out.Header.Set("X-Forwarded-Proto", fwdProto)
+ } else {
+ r.Out.Header.Set("X-Forwarded-Proto", auth.ResolveProto(p.forwardedProto, r.In.TLS))
+ }
+
+ // Trust upstream X-Forwarded-Port; fall back to local computation.
+ if fwdPort := r.In.Header.Get("X-Forwarded-Port"); fwdPort != "" {
+ r.Out.Header.Set("X-Forwarded-Port", fwdPort)
+ } else {
+ resolvedProto := r.Out.Header.Get("X-Forwarded-Proto")
+ r.Out.Header.Set("X-Forwarded-Port", extractForwardedPort(r.In.Host, resolvedProto))
+ }
+}
+
+// setUntrustedForwardingHeaders strips all incoming forwarding headers and
+// sets them fresh based on the direct connection. This is the default
+// behavior when no trusted proxies are configured or the direct connection
+// is from an untrusted source.
+func (p *ReverseProxy) setUntrustedForwardingHeaders(r *httputil.ProxyRequest, clientIP string) {
+ proto := auth.ResolveProto(p.forwardedProto, r.In.TLS)
+ r.Out.Header.Set("X-Forwarded-For", clientIP)
+ r.Out.Header.Set("X-Real-IP", clientIP)
+ r.Out.Header.Set("X-Forwarded-Host", r.In.Host)
+ r.Out.Header.Set("X-Forwarded-Proto", proto)
+ r.Out.Header.Set("X-Forwarded-Port", extractForwardedPort(r.In.Host, proto))
+}
+
+// stripSessionCookie removes the proxy's session cookie from the outgoing
+// request while preserving all other cookies.
+func stripSessionCookie(r *httputil.ProxyRequest) {
+ cookies := r.In.Cookies()
+ r.Out.Header.Del("Cookie")
+ for _, c := range cookies {
+ if c.Name != auth.SessionCookieName {
+ r.Out.AddCookie(c)
+ }
+ }
+}
+
+// stripSessionTokenQuery removes the OIDC session_token query parameter from
+// the outgoing URL to prevent credential leakage to backends.
+func stripSessionTokenQuery(r *httputil.ProxyRequest) {
+ q := r.Out.URL.Query()
+ if q.Has("session_token") {
+ q.Del("session_token")
+ r.Out.URL.RawQuery = q.Encode()
+ }
+}
+
+// extractClientIP extracts the IP address from an http.Request.RemoteAddr
+// which is always in host:port format.
+func extractClientIP(remoteAddr string) string {
+ ip, _, err := net.SplitHostPort(remoteAddr)
+ if err != nil {
+ return remoteAddr
+ }
+ return ip
+}
+
+// extractForwardedPort returns the port from the Host header if present,
+// otherwise defaults to the standard port for the resolved protocol.
+func extractForwardedPort(host, resolvedProto string) string {
+ _, port, err := net.SplitHostPort(host)
+ if err == nil && port != "" {
+ return port
+ }
+ if resolvedProto == "https" {
+ return "443"
+ }
+ return "80"
+}
+
+// proxyErrorHandler handles errors from the reverse proxy and serves
+// user-friendly error pages instead of raw error responses.
+func proxyErrorHandler(w http.ResponseWriter, r *http.Request, err error) {
+ if cd := CapturedDataFromContext(r.Context()); cd != nil {
+ cd.SetOrigin(OriginProxyError)
+ }
+ requestID := getRequestID(r)
+ clientIP := getClientIP(r)
+ title, message, code, status := classifyProxyError(err)
+
+ log.Warnf("proxy error: request_id=%s client_ip=%s method=%s host=%s path=%s status=%d title=%q err=%v",
+ requestID, clientIP, r.Method, r.Host, r.URL.Path, code, title, err)
+
+ web.ServeErrorPage(w, r, code, title, message, requestID, status)
+}
+
+// getClientIP retrieves the resolved client IP from context.
+func getClientIP(r *http.Request) string {
+ if capturedData := CapturedDataFromContext(r.Context()); capturedData != nil {
+ return capturedData.GetClientIP()
+ }
+ return ""
+}
+
+// getRequestID retrieves the request ID from context or returns empty string.
+func getRequestID(r *http.Request) string {
+ if capturedData := CapturedDataFromContext(r.Context()); capturedData != nil {
+ return capturedData.GetRequestID()
+ }
+ return ""
+}
+
+// classifyProxyError determines the appropriate error title, message, HTTP
+// status code, and component status based on the error type.
+func classifyProxyError(err error) (title, message string, code int, status web.ErrorStatus) {
+ switch {
+ case errors.Is(err, context.DeadlineExceeded),
+ isNetTimeout(err):
+ return "Request Timeout",
+ "The request timed out while trying to reach the service. Please refresh the page and try again.",
+ http.StatusGatewayTimeout,
+ web.ErrorStatus{Proxy: true, Destination: false}
+
+ case errors.Is(err, context.Canceled):
+ return "Request Canceled",
+ "The request was canceled before it could be completed. Please refresh the page and try again.",
+ http.StatusBadGateway,
+ web.ErrorStatus{Proxy: true, Destination: false}
+
+ case errors.Is(err, roundtrip.ErrNoAccountID):
+ return "Configuration Error",
+ "The request could not be processed due to a configuration issue. Please refresh the page and try again.",
+ http.StatusInternalServerError,
+ web.ErrorStatus{Proxy: false, Destination: false}
+
+ case errors.Is(err, roundtrip.ErrNoPeerConnection),
+ errors.Is(err, roundtrip.ErrClientStartFailed):
+ return "Proxy Not Connected",
+ "The proxy is not connected to the NetBird network. Please try again later or contact your administrator.",
+ http.StatusBadGateway,
+ web.ErrorStatus{Proxy: false, Destination: false}
+
+ case errors.Is(err, roundtrip.ErrTooManyInflight):
+ return "Service Overloaded",
+ "The service is currently handling too many requests. Please try again shortly.",
+ http.StatusServiceUnavailable,
+ web.ErrorStatus{Proxy: true, Destination: false}
+
+ case isConnectionRefused(err):
+ return "Service Unavailable",
+ "The connection to the service was refused. Please verify that the service is running and try again.",
+ http.StatusBadGateway,
+ web.ErrorStatus{Proxy: true, Destination: false}
+
+ case isHostUnreachable(err):
+ return "Peer Not Connected",
+ "The connection to the peer could not be established. Please ensure the peer is running and connected to the NetBird network.",
+ http.StatusBadGateway,
+ web.ErrorStatus{Proxy: true, Destination: false}
+ }
+
+ return "Connection Error",
+ "An unexpected error occurred while connecting to the service. Please try again later.",
+ http.StatusBadGateway,
+ web.ErrorStatus{Proxy: true, Destination: false}
+}
+
+// isConnectionRefused checks for connection refused errors by inspecting
+// the inner error of a *net.OpError. This handles both standard net errors
+// (where the inner error is a *os.SyscallError with "connection refused")
+// and gVisor netstack errors ("connection was refused").
+func isConnectionRefused(err error) bool {
+ return opErrorContains(err, "refused")
+}
+
+// isHostUnreachable checks for host/network unreachable errors by inspecting
+// the inner error of a *net.OpError. Covers standard net ("no route to host",
+// "network is unreachable") and gVisor ("host is unreachable", etc.).
+func isHostUnreachable(err error) bool {
+ return opErrorContains(err, "unreachable") || opErrorContains(err, "no route to host")
+}
+
+// isNetTimeout checks whether the error is a network timeout using the
+// net.Error interface.
+func isNetTimeout(err error) bool {
+ var netErr net.Error
+ return errors.As(err, &netErr) && netErr.Timeout()
+}
+
+// opErrorContains extracts the inner error from a *net.OpError and checks
+// whether its message contains the given substring. This handles gVisor
+// netstack errors which wrap tcpip errors as plain strings rather than
+// syscall.Errno values.
+func opErrorContains(err error, substr string) bool {
+ var opErr *net.OpError
+ if errors.As(err, &opErr) && opErr.Err != nil {
+ return strings.Contains(opErr.Err.Error(), substr)
+ }
+ return false
+}
diff --git a/proxy/internal/proxy/reverseproxy_test.go b/proxy/internal/proxy/reverseproxy_test.go
new file mode 100644
index 000000000..f7f231db4
--- /dev/null
+++ b/proxy/internal/proxy/reverseproxy_test.go
@@ -0,0 +1,966 @@
+package proxy
+
+import (
+ "context"
+ "crypto/tls"
+ "errors"
+ "fmt"
+ "net"
+ "net/http"
+ "net/http/httptest"
+ "net/http/httputil"
+ "net/netip"
+ "net/url"
+ "os"
+ "syscall"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+
+ "github.com/netbirdio/netbird/proxy/auth"
+ "github.com/netbirdio/netbird/proxy/internal/roundtrip"
+ "github.com/netbirdio/netbird/proxy/web"
+)
+
+func TestRewriteFunc_HostRewriting(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+ p := &ReverseProxy{forwardedProto: "auto"}
+
+ t.Run("rewrites host to backend by default", func(t *testing.T) {
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "https://public.example.com/path", "203.0.113.1:12345")
+
+ rewrite(pr)
+
+ assert.Equal(t, "backend.internal:8080", pr.Out.Host)
+ })
+
+ t.Run("preserves original host when passHostHeader is true", func(t *testing.T) {
+ rewrite := p.rewriteFunc(target, "", true)
+ pr := newProxyRequest(t, "https://public.example.com/path", "203.0.113.1:12345")
+
+ rewrite(pr)
+
+ assert.Equal(t, "public.example.com", pr.Out.Host,
+ "Host header should be the original client host")
+ assert.Equal(t, "backend.internal:8080", pr.Out.URL.Host,
+ "URL host (used for TLS/SNI) must still point to the backend")
+ })
+}
+
+func TestRewriteFunc_XForwardedForStripping(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ t.Run("sets X-Forwarded-For from direct connection IP", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Forwarded-For"),
+ "should be set to the connecting client IP")
+ })
+
+ t.Run("strips spoofed X-Forwarded-For from client", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
+ pr.In.Header.Set("X-Forwarded-For", "10.0.0.1, 172.16.0.1")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Forwarded-For"),
+ "spoofed XFF must be replaced, not appended to")
+ })
+
+ t.Run("strips spoofed X-Real-IP from client", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
+ pr.In.Header.Set("X-Real-IP", "10.0.0.1")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Real-IP"),
+ "spoofed X-Real-IP must be replaced")
+ })
+}
+
+func TestRewriteFunc_ForwardedHostAndProto(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+
+ t.Run("sets X-Forwarded-Host to original host", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "http://myapp.example.com:8443/path", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "myapp.example.com:8443", pr.Out.Header.Get("X-Forwarded-Host"))
+ })
+
+ t.Run("sets X-Forwarded-Port from explicit host port", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "http://example.com:8443/path", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "8443", pr.Out.Header.Get("X-Forwarded-Port"))
+ })
+
+ t.Run("defaults X-Forwarded-Port to 443 for https", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "https://example.com/", "1.2.3.4:5000")
+ pr.In.TLS = &tls.ConnectionState{}
+
+ rewrite(pr)
+
+ assert.Equal(t, "443", pr.Out.Header.Get("X-Forwarded-Port"))
+ })
+
+ t.Run("defaults X-Forwarded-Port to 80 for http", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "http://example.com/", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "80", pr.Out.Header.Get("X-Forwarded-Port"))
+ })
+
+ t.Run("auto detects https from TLS", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "https://example.com/", "1.2.3.4:5000")
+ pr.In.TLS = &tls.ConnectionState{}
+
+ rewrite(pr)
+
+ assert.Equal(t, "https", pr.Out.Header.Get("X-Forwarded-Proto"))
+ })
+
+ t.Run("auto detects http without TLS", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "http://example.com/", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "http", pr.Out.Header.Get("X-Forwarded-Proto"))
+ })
+
+ t.Run("forced proto overrides TLS detection", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "https"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "http://example.com/", "1.2.3.4:5000")
+ // No TLS, but forced to https
+
+ rewrite(pr)
+
+ assert.Equal(t, "https", pr.Out.Header.Get("X-Forwarded-Proto"))
+ })
+
+ t.Run("forced http proto", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "http"}
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "https://example.com/", "1.2.3.4:5000")
+ pr.In.TLS = &tls.ConnectionState{}
+
+ rewrite(pr)
+
+ assert.Equal(t, "http", pr.Out.Header.Get("X-Forwarded-Proto"))
+ })
+}
+
+func TestRewriteFunc_SessionCookieStripping(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ t.Run("strips nb_session cookie", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/", "1.2.3.4:5000")
+ pr.In.AddCookie(&http.Cookie{Name: auth.SessionCookieName, Value: "jwt-token-here"})
+
+ rewrite(pr)
+
+ cookies := pr.Out.Cookies()
+ for _, c := range cookies {
+ assert.NotEqual(t, auth.SessionCookieName, c.Name,
+ "proxy session cookie must not be forwarded to backend")
+ }
+ })
+
+ t.Run("preserves other cookies", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/", "1.2.3.4:5000")
+ pr.In.AddCookie(&http.Cookie{Name: auth.SessionCookieName, Value: "jwt-token"})
+ pr.In.AddCookie(&http.Cookie{Name: "app_session", Value: "app-value"})
+ pr.In.AddCookie(&http.Cookie{Name: "tracking", Value: "track-value"})
+
+ rewrite(pr)
+
+ cookies := pr.Out.Cookies()
+ cookieNames := make([]string, 0, len(cookies))
+ for _, c := range cookies {
+ cookieNames = append(cookieNames, c.Name)
+ }
+ assert.Contains(t, cookieNames, "app_session", "non-proxy cookies should be preserved")
+ assert.Contains(t, cookieNames, "tracking", "non-proxy cookies should be preserved")
+ assert.NotContains(t, cookieNames, auth.SessionCookieName, "proxy cookie must be stripped")
+ })
+
+ t.Run("handles request with no cookies", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Empty(t, pr.Out.Header.Get("Cookie"))
+ })
+}
+
+func TestRewriteFunc_SessionTokenQueryStripping(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+ p := &ReverseProxy{forwardedProto: "auto"}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ t.Run("strips session_token query parameter", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/callback?session_token=secret123&other=keep", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Empty(t, pr.Out.URL.Query().Get("session_token"),
+ "OIDC session token must be stripped from backend request")
+ assert.Equal(t, "keep", pr.Out.URL.Query().Get("other"),
+ "other query parameters must be preserved")
+ })
+
+ t.Run("preserves query when no session_token present", func(t *testing.T) {
+ pr := newProxyRequest(t, "http://example.com/api?foo=bar&baz=qux", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "bar", pr.Out.URL.Query().Get("foo"))
+ assert.Equal(t, "qux", pr.Out.URL.Query().Get("baz"))
+ })
+}
+
+func TestRewriteFunc_URLRewriting(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+
+ t.Run("rewrites URL to target with path prefix", func(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080/app")
+ rewrite := p.rewriteFunc(target, "", false)
+ pr := newProxyRequest(t, "http://example.com/somepath", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "http", pr.Out.URL.Scheme)
+ assert.Equal(t, "backend.internal:8080", pr.Out.URL.Host)
+ assert.Equal(t, "/app/somepath", pr.Out.URL.Path,
+ "SetURL should join the target base path with the request path")
+ })
+
+ t.Run("strips matched path prefix to avoid duplication", func(t *testing.T) {
+ target, _ := url.Parse("https://backend.example.org:443/app")
+ rewrite := p.rewriteFunc(target, "/app", false)
+ pr := newProxyRequest(t, "http://example.com/app", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "https", pr.Out.URL.Scheme)
+ assert.Equal(t, "backend.example.org:443", pr.Out.URL.Host)
+ assert.Equal(t, "/app/", pr.Out.URL.Path,
+ "matched path prefix should be stripped before joining with target path")
+ })
+
+ t.Run("strips matched prefix and preserves subpath", func(t *testing.T) {
+ target, _ := url.Parse("https://backend.example.org:443/app")
+ rewrite := p.rewriteFunc(target, "/app", false)
+ pr := newProxyRequest(t, "http://example.com/app/article/123", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "/app/article/123", pr.Out.URL.Path,
+ "subpath after matched prefix should be preserved")
+ })
+}
+
+func TestExtractClientIP(t *testing.T) {
+ tests := []struct {
+ name string
+ remoteAddr string
+ expected string
+ }{
+ {"IPv4 with port", "192.168.1.1:12345", "192.168.1.1"},
+ {"IPv6 with port", "[::1]:12345", "::1"},
+ {"IPv6 full with port", "[2001:db8::1]:443", "2001:db8::1"},
+ {"IPv4 without port fallback", "192.168.1.1", "192.168.1.1"},
+ {"IPv6 without brackets fallback", "::1", "::1"},
+ {"empty string fallback", "", ""},
+ {"public IP", "203.0.113.50:9999", "203.0.113.50"},
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ assert.Equal(t, tt.expected, extractClientIP(tt.remoteAddr))
+ })
+ }
+}
+
+func TestExtractForwardedPort(t *testing.T) {
+ tests := []struct {
+ name string
+ host string
+ resolvedProto string
+ expected string
+ }{
+ {"explicit port in host", "example.com:8443", "https", "8443"},
+ {"explicit port overrides proto default", "example.com:9090", "http", "9090"},
+ {"no port defaults to 443 for https", "example.com", "https", "443"},
+ {"no port defaults to 80 for http", "example.com", "http", "80"},
+ {"IPv6 host with port", "[::1]:8080", "http", "8080"},
+ {"IPv6 host without port", "::1", "https", "443"},
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ assert.Equal(t, tt.expected, extractForwardedPort(tt.host, tt.resolvedProto))
+ })
+ }
+}
+
+func TestRewriteFunc_TrustedProxy(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+ trusted := []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")}
+
+ t.Run("appends to X-Forwarded-For", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-For", "203.0.113.50")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50, 10.0.0.1", pr.Out.Header.Get("X-Forwarded-For"))
+ })
+
+ t.Run("preserves upstream X-Real-IP", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-For", "203.0.113.50")
+ pr.In.Header.Set("X-Real-IP", "203.0.113.50")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Real-IP"))
+ })
+
+ t.Run("resolves X-Real-IP from XFF when not set by upstream", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-For", "203.0.113.50, 10.0.0.2")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Real-IP"),
+ "should resolve real client through trusted chain")
+ })
+
+ t.Run("preserves upstream X-Forwarded-Host", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://proxy.internal/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-Host", "original.example.com")
+
+ rewrite(pr)
+
+ assert.Equal(t, "original.example.com", pr.Out.Header.Get("X-Forwarded-Host"))
+ })
+
+ t.Run("preserves upstream X-Forwarded-Proto", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-Proto", "https")
+
+ rewrite(pr)
+
+ assert.Equal(t, "https", pr.Out.Header.Get("X-Forwarded-Proto"))
+ })
+
+ t.Run("preserves upstream X-Forwarded-Port", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-Port", "8443")
+
+ rewrite(pr)
+
+ assert.Equal(t, "8443", pr.Out.Header.Get("X-Forwarded-Port"))
+ })
+
+ t.Run("falls back to local proto when upstream does not set it", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "https", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "https", pr.Out.Header.Get("X-Forwarded-Proto"),
+ "should use configured forwardedProto as fallback")
+ })
+
+ t.Run("sets X-Forwarded-Host from request when upstream does not set it", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "example.com", pr.Out.Header.Get("X-Forwarded-Host"))
+ })
+
+ t.Run("untrusted RemoteAddr strips headers even with trusted list", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "203.0.113.50:9999")
+ pr.In.Header.Set("X-Forwarded-For", "10.0.0.1, 172.16.0.1")
+ pr.In.Header.Set("X-Real-IP", "evil")
+ pr.In.Header.Set("X-Forwarded-Host", "evil.example.com")
+ pr.In.Header.Set("X-Forwarded-Proto", "https")
+ pr.In.Header.Set("X-Forwarded-Port", "9999")
+
+ rewrite(pr)
+
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Forwarded-For"),
+ "untrusted: XFF must be replaced")
+ assert.Equal(t, "203.0.113.50", pr.Out.Header.Get("X-Real-IP"),
+ "untrusted: X-Real-IP must be replaced")
+ assert.Equal(t, "example.com", pr.Out.Header.Get("X-Forwarded-Host"),
+ "untrusted: host must be from direct connection")
+ assert.Equal(t, "http", pr.Out.Header.Get("X-Forwarded-Proto"),
+ "untrusted: proto must be locally resolved")
+ assert.Equal(t, "80", pr.Out.Header.Get("X-Forwarded-Port"),
+ "untrusted: port must be locally computed")
+ })
+
+ t.Run("empty trusted list behaves as untrusted", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: nil}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+ pr.In.Header.Set("X-Forwarded-For", "203.0.113.50")
+
+ rewrite(pr)
+
+ assert.Equal(t, "10.0.0.1", pr.Out.Header.Get("X-Forwarded-For"),
+ "nil trusted list: should strip and use RemoteAddr")
+ })
+
+ t.Run("XFF starts fresh when trusted proxy has no upstream XFF", func(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto", trustedProxies: trusted}
+ rewrite := p.rewriteFunc(target, "", false)
+
+ pr := newProxyRequest(t, "http://example.com/", "10.0.0.1:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "10.0.0.1", pr.Out.Header.Get("X-Forwarded-For"),
+ "no upstream XFF: should set direct connection IP")
+ })
+}
+
+// TestRewriteFunc_PathForwarding verifies what path the backend actually
+// receives given different configurations. This simulates the full pipeline:
+// management builds a target URL (with matching prefix baked into the path),
+// then the proxy strips the prefix and SetURL re-joins with the target path.
+func TestRewriteFunc_PathForwarding(t *testing.T) {
+ p := &ReverseProxy{forwardedProto: "auto"}
+
+ // Simulate what ToProtoMapping does: target URL includes the matching
+ // prefix as its path component, so the proxy strips-then-re-adds.
+ t.Run("path prefix baked into target URL is a no-op", func(t *testing.T) {
+ // Management builds: path="/heise", target="https://heise.de:443/heise"
+ target, _ := url.Parse("https://heise.de:443/heise")
+ rewrite := p.rewriteFunc(target, "/heise", false)
+ pr := newProxyRequest(t, "http://external.test/heise", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "/heise/", pr.Out.URL.Path,
+ "backend sees /heise/ because prefix is stripped then re-added by SetURL")
+ })
+
+ t.Run("subpath under prefix also preserved", func(t *testing.T) {
+ target, _ := url.Parse("https://heise.de:443/heise")
+ rewrite := p.rewriteFunc(target, "/heise", false)
+ pr := newProxyRequest(t, "http://external.test/heise/article/123", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "/heise/article/123", pr.Out.URL.Path,
+ "subpath is preserved on top of the re-added prefix")
+ })
+
+ // What the behavior WOULD be if target URL had no path (true stripping)
+ t.Run("target without path prefix gives true stripping", func(t *testing.T) {
+ target, _ := url.Parse("https://heise.de:443")
+ rewrite := p.rewriteFunc(target, "/heise", false)
+ pr := newProxyRequest(t, "http://external.test/heise", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "/", pr.Out.URL.Path,
+ "without path in target URL, backend sees / (true prefix stripping)")
+ })
+
+ t.Run("target without path prefix strips and preserves subpath", func(t *testing.T) {
+ target, _ := url.Parse("https://heise.de:443")
+ rewrite := p.rewriteFunc(target, "/heise", false)
+ pr := newProxyRequest(t, "http://external.test/heise/article/123", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "/article/123", pr.Out.URL.Path,
+ "without path in target URL, prefix is truly stripped")
+ })
+
+ // Root path "/" — no stripping expected
+ t.Run("root path forwards full request path unchanged", func(t *testing.T) {
+ target, _ := url.Parse("https://backend.example.com:443/")
+ rewrite := p.rewriteFunc(target, "/", false)
+ pr := newProxyRequest(t, "http://external.test/heise", "1.2.3.4:5000")
+
+ rewrite(pr)
+
+ assert.Equal(t, "/heise", pr.Out.URL.Path,
+ "root path match must not strip anything")
+ })
+}
+
+func TestRewriteLocationFunc(t *testing.T) {
+ target, _ := url.Parse("http://backend.internal:8080")
+ newProxy := func(proto string) *ReverseProxy { return &ReverseProxy{forwardedProto: proto} }
+ newReq := func(rawURL string) *http.Request {
+ t.Helper()
+ r := httptest.NewRequest(http.MethodGet, rawURL, nil)
+ parsed, _ := url.Parse(rawURL)
+ r.Host = parsed.Host
+ return r
+ }
+ run := func(p *ReverseProxy, matchedPath string, inReq *http.Request, location string) (*http.Response, error) {
+ t.Helper()
+ modifyResp := p.rewriteLocationFunc(target, matchedPath, inReq) //nolint:bodyclose
+ resp := &http.Response{Header: http.Header{}}
+ if location != "" {
+ resp.Header.Set("Location", location)
+ }
+ err := modifyResp(resp)
+ return resp, err
+ }
+
+ t.Run("rewrites Location pointing to backend", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/page"), //nolint:bodyclose
+ "http://backend.internal:8080/login")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/login", resp.Header.Get("Location"))
+ })
+
+ t.Run("does not rewrite Location pointing to other host", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "https://other.example.com/path")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://other.example.com/path", resp.Header.Get("Location"))
+ })
+
+ t.Run("does not rewrite relative Location", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "/dashboard")
+
+ require.NoError(t, err)
+ assert.Equal(t, "/dashboard", resp.Header.Get("Location"))
+ })
+
+ t.Run("re-adds stripped path prefix", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/api", newReq("https://public.example.com/api/users"), //nolint:bodyclose
+ "http://backend.internal:8080/users")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/api/users", resp.Header.Get("Location"))
+ })
+
+ t.Run("uses resolved proto for scheme", func(t *testing.T) {
+ resp, err := run(newProxy("auto"), "", newReq("http://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:8080/path")
+
+ require.NoError(t, err)
+ assert.Equal(t, "http://public.example.com/path", resp.Header.Get("Location"))
+ })
+
+ t.Run("no-op when Location header is empty", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), "") //nolint:bodyclose
+
+ require.NoError(t, err)
+ assert.Empty(t, resp.Header.Get("Location"))
+ })
+
+ t.Run("does not prepend root path prefix", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/", newReq("https://public.example.com/login"), //nolint:bodyclose
+ "http://backend.internal:8080/login")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/login", resp.Header.Get("Location"))
+ })
+
+ // --- Edge cases: query parameters and fragments ---
+
+ t.Run("preserves query parameters", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:8080/login?redirect=%2Fdashboard&lang=en")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/login?redirect=%2Fdashboard&lang=en", resp.Header.Get("Location"))
+ })
+
+ t.Run("preserves fragment", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:8080/docs#section-2")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/docs#section-2", resp.Header.Get("Location"))
+ })
+
+ t.Run("preserves query parameters and fragment together", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:8080/search?q=test&page=1#results")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/search?q=test&page=1#results", resp.Header.Get("Location"))
+ })
+
+ t.Run("preserves query parameters with path prefix re-added", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/api", newReq("https://public.example.com/api/search"), //nolint:bodyclose
+ "http://backend.internal:8080/search?q=hello")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/api/search?q=hello", resp.Header.Get("Location"))
+ })
+
+ // --- Edge cases: slash handling ---
+
+ t.Run("no double slash when matchedPath has trailing slash", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/api/", newReq("https://public.example.com/api/users"), //nolint:bodyclose
+ "http://backend.internal:8080/users")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/api/users", resp.Header.Get("Location"))
+ })
+
+ t.Run("backend redirect to root with path prefix", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/app", newReq("https://public.example.com/app/"), //nolint:bodyclose
+ "http://backend.internal:8080/")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/app/", resp.Header.Get("Location"))
+ })
+
+ t.Run("backend redirect to root with trailing-slash path prefix", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/app/", newReq("https://public.example.com/app/"), //nolint:bodyclose
+ "http://backend.internal:8080/")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/app/", resp.Header.Get("Location"))
+ })
+
+ t.Run("preserves trailing slash on redirect path", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:8080/path/")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/path/", resp.Header.Get("Location"))
+ })
+
+ t.Run("backend redirect to bare root", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/page"), //nolint:bodyclose
+ "http://backend.internal:8080/")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/", resp.Header.Get("Location"))
+ })
+
+ // --- Edge cases: host/port matching ---
+
+ t.Run("does not rewrite when backend host matches but port differs", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:9090/other")
+
+ require.NoError(t, err)
+ assert.Equal(t, "http://backend.internal:9090/other", resp.Header.Get("Location"),
+ "Different port means different host authority, must not rewrite")
+ })
+
+ t.Run("rewrites when redirect omits default port matching target", func(t *testing.T) {
+ // Target is backend.internal:8080, redirect is to backend.internal (no port).
+ // These are different authorities, so should NOT rewrite.
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal/path")
+
+ require.NoError(t, err)
+ assert.Equal(t, "http://backend.internal/path", resp.Header.Get("Location"),
+ "backend.internal != backend.internal:8080, must not rewrite")
+ })
+
+ t.Run("rewrites when target has :443 but redirect omits it for https", func(t *testing.T) {
+ // Target: heise.de:443, redirect: https://heise.de/path (no :443 because it's default)
+ // Per RFC 3986, these are the same authority.
+ target443, _ := url.Parse("https://heise.de:443")
+ p := newProxy("https")
+ modifyResp := p.rewriteLocationFunc(target443, "", newReq("https://public.example.com/")) //nolint:bodyclose
+ resp := &http.Response{Header: http.Header{}}
+ resp.Header.Set("Location", "https://heise.de/path")
+
+ err := modifyResp(resp)
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/path", resp.Header.Get("Location"),
+ "heise.de:443 and heise.de are the same for https")
+ })
+
+ t.Run("rewrites when target has :80 but redirect omits it for http", func(t *testing.T) {
+ target80, _ := url.Parse("http://backend.local:80")
+ p := newProxy("http")
+ modifyResp := p.rewriteLocationFunc(target80, "", newReq("http://public.example.com/")) //nolint:bodyclose
+ resp := &http.Response{Header: http.Header{}}
+ resp.Header.Set("Location", "http://backend.local/path")
+
+ err := modifyResp(resp)
+
+ require.NoError(t, err)
+ assert.Equal(t, "http://public.example.com/path", resp.Header.Get("Location"),
+ "backend.local:80 and backend.local are the same for http")
+ })
+
+ t.Run("rewrites when redirect has :443 but target omits it", func(t *testing.T) {
+ targetNoPort, _ := url.Parse("https://heise.de")
+ p := newProxy("https")
+ modifyResp := p.rewriteLocationFunc(targetNoPort, "", newReq("https://public.example.com/")) //nolint:bodyclose
+ resp := &http.Response{Header: http.Header{}}
+ resp.Header.Set("Location", "https://heise.de:443/path")
+
+ err := modifyResp(resp)
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/path", resp.Header.Get("Location"),
+ "heise.de and heise.de:443 are the same for https")
+ })
+
+ t.Run("does not conflate non-default ports", func(t *testing.T) {
+ target8443, _ := url.Parse("https://backend.internal:8443")
+ p := newProxy("https")
+ modifyResp := p.rewriteLocationFunc(target8443, "", newReq("https://public.example.com/")) //nolint:bodyclose
+ resp := &http.Response{Header: http.Header{}}
+ resp.Header.Set("Location", "https://backend.internal/path")
+
+ err := modifyResp(resp)
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://backend.internal/path", resp.Header.Get("Location"),
+ "backend.internal:8443 != backend.internal (port 443), must not rewrite")
+ })
+
+ // --- Edge cases: encoded paths ---
+
+ t.Run("preserves percent-encoded path segments", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "", newReq("https://public.example.com/"), //nolint:bodyclose
+ "http://backend.internal:8080/path%20with%20spaces/file%2Fname")
+
+ require.NoError(t, err)
+ loc := resp.Header.Get("Location")
+ assert.Contains(t, loc, "public.example.com")
+ parsed, err := url.Parse(loc)
+ require.NoError(t, err)
+ assert.Equal(t, "/path with spaces/file/name", parsed.Path)
+ })
+
+ t.Run("preserves encoded query parameters with path prefix", func(t *testing.T) {
+ resp, err := run(newProxy("https"), "/v1", newReq("https://public.example.com/v1/"), //nolint:bodyclose
+ "http://backend.internal:8080/redirect?url=http%3A%2F%2Fexample.com")
+
+ require.NoError(t, err)
+ assert.Equal(t, "https://public.example.com/v1/redirect?url=http%3A%2F%2Fexample.com", resp.Header.Get("Location"))
+ })
+}
+
+// newProxyRequest creates an httputil.ProxyRequest suitable for testing
+// the Rewrite function. It simulates what httputil.ReverseProxy does internally:
+// Out is a shallow clone of In with headers copied.
+func newProxyRequest(t *testing.T, rawURL, remoteAddr string) *httputil.ProxyRequest {
+ t.Helper()
+
+ parsed, err := url.Parse(rawURL)
+ require.NoError(t, err)
+
+ in := httptest.NewRequest(http.MethodGet, rawURL, nil)
+ in.RemoteAddr = remoteAddr
+ in.Host = parsed.Host
+
+ out := in.Clone(in.Context())
+ out.Header = in.Header.Clone()
+
+ return &httputil.ProxyRequest{In: in, Out: out}
+}
+
+func TestClassifyProxyError(t *testing.T) {
+ tests := []struct {
+ name string
+ err error
+ wantTitle string
+ wantCode int
+ wantStatus web.ErrorStatus
+ }{
+ {
+ name: "context deadline exceeded",
+ err: context.DeadlineExceeded,
+ wantTitle: "Request Timeout",
+ wantCode: http.StatusGatewayTimeout,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "wrapped deadline exceeded",
+ err: fmt.Errorf("dial: %w", context.DeadlineExceeded),
+ wantTitle: "Request Timeout",
+ wantCode: http.StatusGatewayTimeout,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "context canceled",
+ err: context.Canceled,
+ wantTitle: "Request Canceled",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "no account ID",
+ err: roundtrip.ErrNoAccountID,
+ wantTitle: "Configuration Error",
+ wantCode: http.StatusInternalServerError,
+ wantStatus: web.ErrorStatus{Proxy: false, Destination: false},
+ },
+ {
+ name: "no peer connection",
+ err: fmt.Errorf("%w for account: abc", roundtrip.ErrNoPeerConnection),
+ wantTitle: "Proxy Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: false, Destination: false},
+ },
+ {
+ name: "client not started",
+ err: fmt.Errorf("%w: %w", roundtrip.ErrClientStartFailed, errors.New("engine init failed")),
+ wantTitle: "Proxy Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: false, Destination: false},
+ },
+ {
+ name: "syscall ECONNREFUSED via os.SyscallError",
+ err: &net.OpError{
+ Op: "dial",
+ Net: "tcp",
+ Err: &os.SyscallError{Syscall: "connect", Err: syscall.ECONNREFUSED},
+ },
+ wantTitle: "Service Unavailable",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "gvisor connection was refused",
+ err: &net.OpError{
+ Op: "connect",
+ Net: "tcp",
+ Err: errors.New("connection was refused"),
+ },
+ wantTitle: "Service Unavailable",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "syscall EHOSTUNREACH via os.SyscallError",
+ err: &net.OpError{
+ Op: "dial",
+ Net: "tcp",
+ Err: &os.SyscallError{Syscall: "connect", Err: syscall.EHOSTUNREACH},
+ },
+ wantTitle: "Peer Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "syscall ENETUNREACH via os.SyscallError",
+ err: &net.OpError{
+ Op: "dial",
+ Net: "tcp",
+ Err: &os.SyscallError{Syscall: "connect", Err: syscall.ENETUNREACH},
+ },
+ wantTitle: "Peer Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "gvisor host is unreachable",
+ err: &net.OpError{
+ Op: "connect",
+ Net: "tcp",
+ Err: errors.New("host is unreachable"),
+ },
+ wantTitle: "Peer Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "gvisor network is unreachable",
+ err: &net.OpError{
+ Op: "connect",
+ Net: "tcp",
+ Err: errors.New("network is unreachable"),
+ },
+ wantTitle: "Peer Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "standard no route to host",
+ err: &net.OpError{
+ Op: "dial",
+ Net: "tcp",
+ Err: &os.SyscallError{Syscall: "connect", Err: syscall.EHOSTUNREACH},
+ },
+ wantTitle: "Peer Not Connected",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ {
+ name: "unknown error falls to default",
+ err: errors.New("something unexpected"),
+ wantTitle: "Connection Error",
+ wantCode: http.StatusBadGateway,
+ wantStatus: web.ErrorStatus{Proxy: true, Destination: false},
+ },
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ title, _, code, status := classifyProxyError(tt.err)
+ assert.Equal(t, tt.wantTitle, title, "title")
+ assert.Equal(t, tt.wantCode, code, "status code")
+ assert.Equal(t, tt.wantStatus, status, "component status")
+ })
+ }
+}
diff --git a/proxy/internal/proxy/servicemapping.go b/proxy/internal/proxy/servicemapping.go
new file mode 100644
index 000000000..6f5829ebb
--- /dev/null
+++ b/proxy/internal/proxy/servicemapping.go
@@ -0,0 +1,84 @@
+package proxy
+
+import (
+ "net"
+ "net/http"
+ "net/url"
+ "sort"
+ "strings"
+
+ "github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+type Mapping struct {
+ ID string
+ AccountID types.AccountID
+ Host string
+ Paths map[string]*url.URL
+ PassHostHeader bool
+ RewriteRedirects bool
+}
+
+type targetResult struct {
+ url *url.URL
+ matchedPath string
+ serviceID string
+ accountID types.AccountID
+ passHostHeader bool
+ rewriteRedirects bool
+}
+
+func (p *ReverseProxy) findTargetForRequest(req *http.Request) (targetResult, bool) {
+ p.mappingsMux.RLock()
+ defer p.mappingsMux.RUnlock()
+
+ // Strip port from host if present (e.g., "external.test:8443" -> "external.test")
+ host := req.Host
+ if h, _, err := net.SplitHostPort(host); err == nil {
+ host = h
+ }
+
+ m, exists := p.mappings[host]
+ if !exists {
+ p.logger.Debugf("no mapping found for host: %s", host)
+ return targetResult{}, false
+ }
+
+ // Sort paths by length (longest first) in a naive attempt to match the most specific route first.
+ paths := make([]string, 0, len(m.Paths))
+ for path := range m.Paths {
+ paths = append(paths, path)
+ }
+ sort.Slice(paths, func(i, j int) bool {
+ return len(paths[i]) > len(paths[j])
+ })
+
+ for _, path := range paths {
+ if strings.HasPrefix(req.URL.Path, path) {
+ target := m.Paths[path]
+ p.logger.Debugf("matched host: %s, path: %s -> %s", host, path, target)
+ return targetResult{
+ url: target,
+ matchedPath: path,
+ serviceID: m.ID,
+ accountID: m.AccountID,
+ passHostHeader: m.PassHostHeader,
+ rewriteRedirects: m.RewriteRedirects,
+ }, true
+ }
+ }
+ p.logger.Debugf("no path match for host: %s, path: %s", host, req.URL.Path)
+ return targetResult{}, false
+}
+
+func (p *ReverseProxy) AddMapping(m Mapping) {
+ p.mappingsMux.Lock()
+ defer p.mappingsMux.Unlock()
+ p.mappings[m.Host] = m
+}
+
+func (p *ReverseProxy) RemoveMapping(m Mapping) {
+ p.mappingsMux.Lock()
+ defer p.mappingsMux.Unlock()
+ delete(p.mappings, m.Host)
+}
diff --git a/proxy/internal/proxy/trustedproxy.go b/proxy/internal/proxy/trustedproxy.go
new file mode 100644
index 000000000..ad9a5b6c0
--- /dev/null
+++ b/proxy/internal/proxy/trustedproxy.go
@@ -0,0 +1,60 @@
+package proxy
+
+import (
+ "net/netip"
+ "strings"
+)
+
+// IsTrustedProxy checks if the given IP string falls within any of the trusted prefixes.
+func IsTrustedProxy(ipStr string, trusted []netip.Prefix) bool {
+ if len(trusted) == 0 {
+ return false
+ }
+
+ addr, err := netip.ParseAddr(ipStr)
+ if err != nil {
+ return false
+ }
+
+ for _, prefix := range trusted {
+ if prefix.Contains(addr) {
+ return true
+ }
+ }
+ return false
+}
+
+// ResolveClientIP extracts the real client IP from X-Forwarded-For using the trusted proxy list.
+// It walks the XFF chain right-to-left, skipping IPs that match trusted prefixes.
+// The first untrusted IP is the real client.
+//
+// If the trusted list is empty or remoteAddr is not trusted, it returns the
+// remoteAddr IP directly (ignoring any forwarding headers).
+func ResolveClientIP(remoteAddr, xff string, trusted []netip.Prefix) string {
+ remoteIP := extractClientIP(remoteAddr)
+
+ if len(trusted) == 0 || !IsTrustedProxy(remoteIP, trusted) {
+ return remoteIP
+ }
+
+ if xff == "" {
+ return remoteIP
+ }
+
+ parts := strings.Split(xff, ",")
+ for i := len(parts) - 1; i >= 0; i-- {
+ ip := strings.TrimSpace(parts[i])
+ if ip == "" {
+ continue
+ }
+ if !IsTrustedProxy(ip, trusted) {
+ return ip
+ }
+ }
+
+ // All IPs in XFF are trusted; return the leftmost as best guess.
+ if first := strings.TrimSpace(parts[0]); first != "" {
+ return first
+ }
+ return remoteIP
+}
diff --git a/proxy/internal/proxy/trustedproxy_test.go b/proxy/internal/proxy/trustedproxy_test.go
new file mode 100644
index 000000000..827b7babf
--- /dev/null
+++ b/proxy/internal/proxy/trustedproxy_test.go
@@ -0,0 +1,129 @@
+package proxy
+
+import (
+ "net/netip"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+)
+
+func TestIsTrustedProxy(t *testing.T) {
+ trusted := []netip.Prefix{
+ netip.MustParsePrefix("10.0.0.0/8"),
+ netip.MustParsePrefix("192.168.1.0/24"),
+ netip.MustParsePrefix("fd00::/8"),
+ }
+
+ tests := []struct {
+ name string
+ ip string
+ trusted []netip.Prefix
+ want bool
+ }{
+ {"empty trusted list", "10.0.0.1", nil, false},
+ {"IP within /8 prefix", "10.1.2.3", trusted, true},
+ {"IP within /24 prefix", "192.168.1.100", trusted, true},
+ {"IP outside all prefixes", "203.0.113.50", trusted, false},
+ {"boundary IP just outside prefix", "192.168.2.1", trusted, false},
+ {"unparsable IP", "not-an-ip", trusted, false},
+ {"IPv6 in trusted range", "fd00::1", trusted, true},
+ {"IPv6 outside range", "2001:db8::1", trusted, false},
+ {"empty string", "", trusted, false},
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ assert.Equal(t, tt.want, IsTrustedProxy(tt.ip, tt.trusted))
+ })
+ }
+}
+
+func TestResolveClientIP(t *testing.T) {
+ trusted := []netip.Prefix{
+ netip.MustParsePrefix("10.0.0.0/8"),
+ netip.MustParsePrefix("172.16.0.0/12"),
+ }
+
+ tests := []struct {
+ name string
+ remoteAddr string
+ xff string
+ trusted []netip.Prefix
+ want string
+ }{
+ {
+ name: "empty trusted list returns RemoteAddr",
+ remoteAddr: "203.0.113.50:9999",
+ xff: "1.2.3.4",
+ trusted: nil,
+ want: "203.0.113.50",
+ },
+ {
+ name: "untrusted RemoteAddr ignores XFF",
+ remoteAddr: "203.0.113.50:9999",
+ xff: "1.2.3.4, 10.0.0.1",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ {
+ name: "trusted RemoteAddr with single client in XFF",
+ remoteAddr: "10.0.0.1:5000",
+ xff: "203.0.113.50",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ {
+ name: "trusted RemoteAddr walks past trusted entries in XFF",
+ remoteAddr: "10.0.0.1:5000",
+ xff: "203.0.113.50, 10.0.0.2, 172.16.0.5",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ {
+ name: "trusted RemoteAddr with empty XFF falls back to RemoteAddr",
+ remoteAddr: "10.0.0.1:5000",
+ xff: "",
+ trusted: trusted,
+ want: "10.0.0.1",
+ },
+ {
+ name: "all XFF IPs trusted returns leftmost",
+ remoteAddr: "10.0.0.1:5000",
+ xff: "10.0.0.2, 172.16.0.1, 10.0.0.3",
+ trusted: trusted,
+ want: "10.0.0.2",
+ },
+ {
+ name: "XFF with whitespace",
+ remoteAddr: "10.0.0.1:5000",
+ xff: " 203.0.113.50 , 10.0.0.2 ",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ {
+ name: "XFF with empty segments",
+ remoteAddr: "10.0.0.1:5000",
+ xff: "203.0.113.50,,10.0.0.2",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ {
+ name: "multi-hop with mixed trust",
+ remoteAddr: "10.0.0.1:5000",
+ xff: "8.8.8.8, 203.0.113.50, 172.16.0.1",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ {
+ name: "RemoteAddr without port",
+ remoteAddr: "10.0.0.1",
+ xff: "203.0.113.50",
+ trusted: trusted,
+ want: "203.0.113.50",
+ },
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ assert.Equal(t, tt.want, ResolveClientIP(tt.remoteAddr, tt.xff, tt.trusted))
+ })
+ }
+}
diff --git a/proxy/internal/roundtrip/netbird.go b/proxy/internal/roundtrip/netbird.go
new file mode 100644
index 000000000..d7fd2746f
--- /dev/null
+++ b/proxy/internal/roundtrip/netbird.go
@@ -0,0 +1,575 @@
+package roundtrip
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "net/http"
+ "sync"
+ "time"
+
+ "github.com/hashicorp/go-multierror"
+ log "github.com/sirupsen/logrus"
+ "golang.org/x/exp/maps"
+ "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+ "google.golang.org/grpc"
+
+ "github.com/netbirdio/netbird/client/embed"
+ nberrors "github.com/netbirdio/netbird/client/errors"
+ "github.com/netbirdio/netbird/proxy/internal/types"
+ "github.com/netbirdio/netbird/shared/management/domain"
+ "github.com/netbirdio/netbird/shared/management/proto"
+ "github.com/netbirdio/netbird/util"
+)
+
+const deviceNamePrefix = "ingress-proxy-"
+
+// backendKey identifies a backend by its host:port from the target URL.
+type backendKey = string
+
+var (
+ // ErrNoAccountID is returned when a request context is missing the account ID.
+ ErrNoAccountID = errors.New("no account ID in request context")
+ // ErrNoPeerConnection is returned when no embedded client exists for the account.
+ ErrNoPeerConnection = errors.New("no peer connection found")
+ // ErrClientStartFailed is returned when the embedded client fails to start.
+ ErrClientStartFailed = errors.New("client start failed")
+ // ErrTooManyInflight is returned when the per-backend in-flight limit is reached.
+ ErrTooManyInflight = errors.New("too many in-flight requests")
+)
+
+// domainInfo holds metadata about a registered domain.
+type domainInfo struct {
+ serviceID string
+}
+
+type domainNotification struct {
+ domain domain.Domain
+ serviceID string
+}
+
+// clientEntry holds an embedded NetBird client and tracks which domains use it.
+type clientEntry struct {
+ client *embed.Client
+ transport *http.Transport
+ domains map[domain.Domain]domainInfo
+ createdAt time.Time
+ started bool
+ // Per-backend in-flight limiting keyed by target host:port.
+ // TODO: clean up stale entries when backend targets change.
+ inflightMu sync.Mutex
+ inflightMap map[backendKey]chan struct{}
+ maxInflight int
+}
+
+// acquireInflight attempts to acquire an in-flight slot for the given backend.
+// It returns a release function that must always be called, and true on success.
+func (e *clientEntry) acquireInflight(backend backendKey) (release func(), ok bool) {
+ noop := func() {}
+ if e.maxInflight <= 0 {
+ return noop, true
+ }
+
+ e.inflightMu.Lock()
+ sem, exists := e.inflightMap[backend]
+ if !exists {
+ sem = make(chan struct{}, e.maxInflight)
+ e.inflightMap[backend] = sem
+ }
+ e.inflightMu.Unlock()
+
+ select {
+ case sem <- struct{}{}:
+ return func() { <-sem }, true
+ default:
+ return noop, false
+ }
+}
+
+type statusNotifier interface {
+ NotifyStatus(ctx context.Context, accountID, serviceID, domain string, connected bool) error
+}
+
+type managementClient interface {
+ CreateProxyPeer(ctx context.Context, req *proto.CreateProxyPeerRequest, opts ...grpc.CallOption) (*proto.CreateProxyPeerResponse, error)
+}
+
+// NetBird provides an http.RoundTripper implementation
+// backed by underlying NetBird connections.
+// Clients are keyed by AccountID, allowing multiple domains to share the same connection.
+type NetBird struct {
+ mgmtAddr string
+ proxyID string
+ proxyAddr string
+ wgPort int
+ logger *log.Logger
+ mgmtClient managementClient
+ transportCfg transportConfig
+
+ clientsMux sync.RWMutex
+ clients map[types.AccountID]*clientEntry
+ initLogOnce sync.Once
+ statusNotifier statusNotifier
+}
+
+// ClientDebugInfo contains debug information about a client.
+type ClientDebugInfo struct {
+ AccountID types.AccountID
+ DomainCount int
+ Domains domain.List
+ HasClient bool
+ CreatedAt time.Time
+}
+
+// accountIDContextKey is the context key for storing the account ID.
+type accountIDContextKey struct{}
+
+// AddPeer registers a domain for an account. If the account doesn't have a client yet,
+// one is created by authenticating with the management server using the provided token.
+// Multiple domains can share the same client.
+func (n *NetBird) AddPeer(ctx context.Context, accountID types.AccountID, d domain.Domain, authToken, serviceID string) error {
+ n.clientsMux.Lock()
+
+ entry, exists := n.clients[accountID]
+ if exists {
+ // Client already exists for this account, just register the domain
+ entry.domains[d] = domainInfo{serviceID: serviceID}
+ started := entry.started
+ n.clientsMux.Unlock()
+
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ }).Debug("registered domain with existing client")
+
+ // If client is already started, notify this domain as connected immediately
+ if started && n.statusNotifier != nil {
+ if err := n.statusNotifier.NotifyStatus(ctx, string(accountID), serviceID, string(d), true); err != nil {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ }).WithError(err).Warn("failed to notify status for existing client")
+ }
+ }
+ return nil
+ }
+
+ entry, err := n.createClientEntry(ctx, accountID, d, authToken, serviceID)
+ if err != nil {
+ n.clientsMux.Unlock()
+ return err
+ }
+
+ n.clients[accountID] = entry
+ n.clientsMux.Unlock()
+
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ }).Info("created new client for account")
+
+ // Attempt to start the client in the background; if this fails we will
+ // retry on the first request via RoundTrip.
+ go n.runClientStartup(ctx, accountID, entry.client)
+
+ return nil
+}
+
+// createClientEntry generates a WireGuard keypair, authenticates with management,
+// and creates an embedded NetBird client. Must be called with clientsMux held.
+func (n *NetBird) createClientEntry(ctx context.Context, accountID types.AccountID, d domain.Domain, authToken, serviceID string) (*clientEntry, error) {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "service_id": serviceID,
+ }).Debug("generating WireGuard keypair for new peer")
+
+ privateKey, err := wgtypes.GeneratePrivateKey()
+ if err != nil {
+ return nil, fmt.Errorf("generate wireguard private key: %w", err)
+ }
+ publicKey := privateKey.PublicKey()
+
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "service_id": serviceID,
+ "public_key": publicKey.String(),
+ }).Debug("authenticating new proxy peer with management")
+
+ resp, err := n.mgmtClient.CreateProxyPeer(ctx, &proto.CreateProxyPeerRequest{
+ ServiceId: serviceID,
+ AccountId: string(accountID),
+ Token: authToken,
+ WireguardPublicKey: publicKey.String(),
+ Cluster: n.proxyAddr,
+ })
+ if err != nil {
+ return nil, fmt.Errorf("authenticate proxy peer with management: %w", err)
+ }
+ if resp != nil && !resp.GetSuccess() {
+ errMsg := "unknown error"
+ if resp.ErrorMessage != nil {
+ errMsg = *resp.ErrorMessage
+ }
+ return nil, fmt.Errorf("proxy peer authentication failed: %s", errMsg)
+ }
+
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "service_id": serviceID,
+ "public_key": publicKey.String(),
+ }).Info("proxy peer authenticated successfully with management")
+
+ n.initLogOnce.Do(func() {
+ if err := util.InitLog(log.WarnLevel.String(), util.LogConsole); err != nil {
+ n.logger.WithField("account_id", accountID).Warnf("failed to initialize embedded client logging: %v", err)
+ }
+ })
+
+ // Create embedded NetBird client with the generated private key.
+ // The peer has already been created via CreateProxyPeer RPC with the public key.
+ client, err := embed.New(embed.Options{
+ DeviceName: deviceNamePrefix + n.proxyID,
+ ManagementURL: n.mgmtAddr,
+ PrivateKey: privateKey.String(),
+ LogLevel: log.WarnLevel.String(),
+ BlockInbound: true,
+ WireguardPort: &n.wgPort,
+ })
+ if err != nil {
+ return nil, fmt.Errorf("create netbird client: %w", err)
+ }
+
+ // Create a transport using the client dialer. We do this instead of using
+ // the client's HTTPClient to avoid issues with request validation that do
+ // not work with reverse proxied requests.
+ return &clientEntry{
+ client: client,
+ domains: map[domain.Domain]domainInfo{d: {serviceID: serviceID}},
+ transport: &http.Transport{
+ DialContext: client.DialContext,
+ ForceAttemptHTTP2: true,
+ MaxIdleConns: n.transportCfg.maxIdleConns,
+ MaxIdleConnsPerHost: n.transportCfg.maxIdleConnsPerHost,
+ MaxConnsPerHost: n.transportCfg.maxConnsPerHost,
+ IdleConnTimeout: n.transportCfg.idleConnTimeout,
+ TLSHandshakeTimeout: n.transportCfg.tlsHandshakeTimeout,
+ ExpectContinueTimeout: n.transportCfg.expectContinueTimeout,
+ ResponseHeaderTimeout: n.transportCfg.responseHeaderTimeout,
+ WriteBufferSize: n.transportCfg.writeBufferSize,
+ ReadBufferSize: n.transportCfg.readBufferSize,
+ DisableCompression: n.transportCfg.disableCompression,
+ },
+ createdAt: time.Now(),
+ started: false,
+ inflightMap: make(map[backendKey]chan struct{}),
+ maxInflight: n.transportCfg.maxInflight,
+ }, nil
+}
+
+// runClientStartup starts the client and notifies registered domains on success.
+func (n *NetBird) runClientStartup(ctx context.Context, accountID types.AccountID, client *embed.Client) {
+ startCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+ defer cancel()
+
+ if err := client.Start(startCtx); err != nil {
+ if errors.Is(err, context.DeadlineExceeded) {
+ n.logger.WithField("account_id", accountID).Warn("netbird client start timed out, will retry on first request")
+ } else {
+ n.logger.WithField("account_id", accountID).WithError(err).Error("failed to start netbird client")
+ }
+ return
+ }
+
+ // Mark client as started and collect domains to notify outside the lock.
+ n.clientsMux.Lock()
+ entry, exists := n.clients[accountID]
+ if exists {
+ entry.started = true
+ }
+ var domainsToNotify []domainNotification
+ if exists {
+ for dom, info := range entry.domains {
+ domainsToNotify = append(domainsToNotify, domainNotification{domain: dom, serviceID: info.serviceID})
+ }
+ }
+ n.clientsMux.Unlock()
+
+ if n.statusNotifier == nil {
+ return
+ }
+ for _, dn := range domainsToNotify {
+ if err := n.statusNotifier.NotifyStatus(ctx, string(accountID), dn.serviceID, string(dn.domain), true); err != nil {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": dn.domain,
+ }).WithError(err).Warn("failed to notify tunnel connection status")
+ } else {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": dn.domain,
+ }).Info("notified management about tunnel connection")
+ }
+ }
+}
+
+// RemovePeer unregisters a domain from an account. The client is only stopped
+// when no domains are using it anymore.
+func (n *NetBird) RemovePeer(ctx context.Context, accountID types.AccountID, d domain.Domain) error {
+ n.clientsMux.Lock()
+
+ entry, exists := n.clients[accountID]
+ if !exists {
+ n.clientsMux.Unlock()
+ n.logger.WithField("account_id", accountID).Debug("remove peer: account not found")
+ return nil
+ }
+
+ // Get domain info before deleting
+ domInfo, domainExists := entry.domains[d]
+ if !domainExists {
+ n.clientsMux.Unlock()
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ }).Debug("remove peer: domain not registered")
+ return nil
+ }
+
+ delete(entry.domains, d)
+
+ // If there are still domains using this client, keep it running
+ if len(entry.domains) > 0 {
+ n.clientsMux.Unlock()
+
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ "remaining_domains": len(entry.domains),
+ }).Debug("unregistered domain, client still in use")
+
+ // Notify this domain as disconnected
+ if n.statusNotifier != nil {
+ if err := n.statusNotifier.NotifyStatus(ctx, string(accountID), domInfo.serviceID, string(d), false); err != nil {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ }).WithError(err).Warn("failed to notify tunnel disconnection status")
+ }
+ }
+ return nil
+ }
+
+ // No more domains using this client, stop it
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ }).Info("stopping client, no more domains")
+
+ client := entry.client
+ transport := entry.transport
+ delete(n.clients, accountID)
+ n.clientsMux.Unlock()
+
+ // Notify disconnection before stopping
+ if n.statusNotifier != nil {
+ if err := n.statusNotifier.NotifyStatus(ctx, string(accountID), domInfo.serviceID, string(d), false); err != nil {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ }).WithError(err).Warn("failed to notify tunnel disconnection status")
+ }
+ }
+
+ transport.CloseIdleConnections()
+
+ if err := client.Stop(ctx); err != nil {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ }).WithError(err).Warn("failed to stop netbird client")
+ }
+
+ return nil
+}
+
+// RoundTrip implements http.RoundTripper. It looks up the client for the account
+// specified in the request context and uses it to dial the backend.
+func (n *NetBird) RoundTrip(req *http.Request) (*http.Response, error) {
+ accountID := AccountIDFromContext(req.Context())
+ if accountID == "" {
+ return nil, ErrNoAccountID
+ }
+
+ // Copy references while holding lock, then unlock early to avoid blocking
+ // other requests during the potentially slow RoundTrip.
+ n.clientsMux.RLock()
+ entry, exists := n.clients[accountID]
+ if !exists {
+ n.clientsMux.RUnlock()
+ return nil, fmt.Errorf("%w for account: %s", ErrNoPeerConnection, accountID)
+ }
+ client := entry.client
+ transport := entry.transport
+ n.clientsMux.RUnlock()
+
+ release, ok := entry.acquireInflight(req.URL.Host)
+ defer release()
+ if !ok {
+ return nil, ErrTooManyInflight
+ }
+
+ // Attempt to start the client, if the client is already running then
+ // it will return an error that we ignore, if this hits a timeout then
+ // this request is unprocessable.
+ startCtx, cancel := context.WithTimeout(req.Context(), 30*time.Second)
+ defer cancel()
+ if err := client.Start(startCtx); err != nil {
+ if !errors.Is(err, embed.ErrClientAlreadyStarted) {
+ return nil, fmt.Errorf("%w: %w", ErrClientStartFailed, err)
+ }
+ }
+
+ start := time.Now()
+ resp, err := transport.RoundTrip(req)
+ duration := time.Since(start)
+
+ if err != nil {
+ n.logger.Debugf("roundtrip: method=%s host=%s url=%s account=%s duration=%s err=%v",
+ req.Method, req.Host, req.URL.String(), accountID, duration.Truncate(time.Millisecond), err)
+ return nil, err
+ }
+
+ n.logger.Debugf("roundtrip: method=%s host=%s url=%s account=%s status=%d duration=%s",
+ req.Method, req.Host, req.URL.String(), accountID, resp.StatusCode, duration.Truncate(time.Millisecond))
+ return resp, nil
+}
+
+// StopAll stops all clients.
+func (n *NetBird) StopAll(ctx context.Context) error {
+ n.clientsMux.Lock()
+ defer n.clientsMux.Unlock()
+
+ var merr *multierror.Error
+ for accountID, entry := range n.clients {
+ entry.transport.CloseIdleConnections()
+ if err := entry.client.Stop(ctx); err != nil {
+ n.logger.WithFields(log.Fields{
+ "account_id": accountID,
+ }).WithError(err).Warn("failed to stop netbird client during shutdown")
+ merr = multierror.Append(merr, err)
+ }
+ }
+ maps.Clear(n.clients)
+
+ return nberrors.FormatErrorOrNil(merr)
+}
+
+// HasClient returns true if there is a client for the given account.
+func (n *NetBird) HasClient(accountID types.AccountID) bool {
+ n.clientsMux.RLock()
+ defer n.clientsMux.RUnlock()
+ _, exists := n.clients[accountID]
+ return exists
+}
+
+// DomainCount returns the number of domains registered for the given account.
+// Returns 0 if the account has no client.
+func (n *NetBird) DomainCount(accountID types.AccountID) int {
+ n.clientsMux.RLock()
+ defer n.clientsMux.RUnlock()
+ entry, exists := n.clients[accountID]
+ if !exists {
+ return 0
+ }
+ return len(entry.domains)
+}
+
+// ClientCount returns the total number of active clients.
+func (n *NetBird) ClientCount() int {
+ n.clientsMux.RLock()
+ defer n.clientsMux.RUnlock()
+ return len(n.clients)
+}
+
+// GetClient returns the embed.Client for the given account ID.
+func (n *NetBird) GetClient(accountID types.AccountID) (*embed.Client, bool) {
+ n.clientsMux.RLock()
+ defer n.clientsMux.RUnlock()
+ entry, exists := n.clients[accountID]
+ if !exists {
+ return nil, false
+ }
+ return entry.client, true
+}
+
+// ListClientsForDebug returns information about all clients for debug purposes.
+func (n *NetBird) ListClientsForDebug() map[types.AccountID]ClientDebugInfo {
+ n.clientsMux.RLock()
+ defer n.clientsMux.RUnlock()
+
+ result := make(map[types.AccountID]ClientDebugInfo)
+ for accountID, entry := range n.clients {
+ domains := make(domain.List, 0, len(entry.domains))
+ for d := range entry.domains {
+ domains = append(domains, d)
+ }
+ result[accountID] = ClientDebugInfo{
+ AccountID: accountID,
+ DomainCount: len(entry.domains),
+ Domains: domains,
+ HasClient: entry.client != nil,
+ CreatedAt: entry.createdAt,
+ }
+ }
+ return result
+}
+
+// ListClientsForStartup returns all embed.Client instances for health checks.
+func (n *NetBird) ListClientsForStartup() map[types.AccountID]*embed.Client {
+ n.clientsMux.RLock()
+ defer n.clientsMux.RUnlock()
+
+ result := make(map[types.AccountID]*embed.Client)
+ for accountID, entry := range n.clients {
+ if entry.client != nil {
+ result[accountID] = entry.client
+ }
+ }
+ return result
+}
+
+// NewNetBird creates a new NetBird transport. Set wgPort to 0 for a random
+// OS-assigned port. A fixed port only works with single-account deployments;
+// multiple accounts will fail to bind the same port.
+func NewNetBird(mgmtAddr, proxyID, proxyAddr string, wgPort int, logger *log.Logger, notifier statusNotifier, mgmtClient managementClient) *NetBird {
+ if logger == nil {
+ logger = log.StandardLogger()
+ }
+ return &NetBird{
+ mgmtAddr: mgmtAddr,
+ proxyID: proxyID,
+ proxyAddr: proxyAddr,
+ wgPort: wgPort,
+ logger: logger,
+ clients: make(map[types.AccountID]*clientEntry),
+ statusNotifier: notifier,
+ mgmtClient: mgmtClient,
+ transportCfg: loadTransportConfig(logger),
+ }
+}
+
+// WithAccountID adds the account ID to the context.
+func WithAccountID(ctx context.Context, accountID types.AccountID) context.Context {
+ return context.WithValue(ctx, accountIDContextKey{}, accountID)
+}
+
+// AccountIDFromContext retrieves the account ID from the context.
+func AccountIDFromContext(ctx context.Context) types.AccountID {
+ v := ctx.Value(accountIDContextKey{})
+ if v == nil {
+ return ""
+ }
+ accountID, ok := v.(types.AccountID)
+ if !ok {
+ return ""
+ }
+ return accountID
+}
diff --git a/proxy/internal/roundtrip/netbird_bench_test.go b/proxy/internal/roundtrip/netbird_bench_test.go
new file mode 100644
index 000000000..e89213c33
--- /dev/null
+++ b/proxy/internal/roundtrip/netbird_bench_test.go
@@ -0,0 +1,107 @@
+package roundtrip
+
+import (
+ "crypto/rand"
+ "math/big"
+ "sync"
+ "testing"
+ "time"
+
+ "github.com/netbirdio/netbird/proxy/internal/types"
+ "github.com/netbirdio/netbird/shared/management/domain"
+)
+
+// Simple benchmark for comparison with AddPeer contention.
+func BenchmarkHasClient(b *testing.B) {
+ // Knobs for dialling in:
+ initialClientCount := 100 // Size of initial peer map to generate.
+
+ nb := mockNetBird()
+
+ var target types.AccountID
+ targetIndex, err := rand.Int(rand.Reader, big.NewInt(int64(initialClientCount)))
+ if err != nil {
+ b.Fatal(err)
+ }
+ for i := range initialClientCount {
+ id := types.AccountID(rand.Text())
+ if int64(i) == targetIndex.Int64() {
+ target = id
+ }
+ nb.clients[id] = &clientEntry{
+ domains: map[domain.Domain]domainInfo{
+ domain.Domain(rand.Text()): {
+ serviceID: rand.Text(),
+ },
+ },
+ createdAt: time.Now(),
+ started: true,
+ }
+ }
+
+ b.ResetTimer()
+ b.RunParallel(func(pb *testing.PB) {
+ for pb.Next() {
+ nb.HasClient(target)
+ }
+ })
+ b.StopTimer()
+}
+
+func BenchmarkHasClientDuringAddPeer(b *testing.B) {
+ // Knobs for dialling in:
+ initialClientCount := 100 // Size of initial peer map to generate.
+ addPeerWorkers := 5 // Number of workers to concurrently call AddPeer.
+
+ nb := mockNetBird()
+
+ // Add random client entries to the netbird instance.
+ // We're trying to test map lock contention, so starting with
+ // a populated map should help with this.
+ // Pick a random one to target for retrieval later.
+ var target types.AccountID
+ targetIndex, err := rand.Int(rand.Reader, big.NewInt(int64(initialClientCount)))
+ if err != nil {
+ b.Fatal(err)
+ }
+ for i := range initialClientCount {
+ id := types.AccountID(rand.Text())
+ if int64(i) == targetIndex.Int64() {
+ target = id
+ }
+ nb.clients[id] = &clientEntry{
+ domains: map[domain.Domain]domainInfo{
+ domain.Domain(rand.Text()): {
+ serviceID: rand.Text(),
+ },
+ },
+ createdAt: time.Now(),
+ started: true,
+ }
+ }
+
+ // Launch workers that continuously call AddPeer with new random accountIDs.
+ var wg sync.WaitGroup
+ for range addPeerWorkers {
+ wg.Go(func() {
+ for {
+ if err := nb.AddPeer(b.Context(),
+ types.AccountID(rand.Text()),
+ domain.Domain(rand.Text()),
+ rand.Text(),
+ rand.Text()); err != nil {
+ b.Log(err)
+ }
+ }
+ })
+ }
+
+ // Benchmark calling HasClient during AddPeer contention.
+ b.ResetTimer()
+ b.RunParallel(func(pb *testing.PB) {
+ for pb.Next() {
+ nb.HasClient(target)
+ }
+ })
+ b.StopTimer()
+}
diff --git a/proxy/internal/roundtrip/netbird_test.go b/proxy/internal/roundtrip/netbird_test.go
new file mode 100644
index 000000000..3e76af9da
--- /dev/null
+++ b/proxy/internal/roundtrip/netbird_test.go
@@ -0,0 +1,328 @@
+package roundtrip
+
+import (
+ "context"
+ "net/http"
+ "sync"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+ "google.golang.org/grpc"
+
+ "github.com/netbirdio/netbird/proxy/internal/types"
+ "github.com/netbirdio/netbird/shared/management/domain"
+ "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+type mockMgmtClient struct{}
+
+func (m *mockMgmtClient) CreateProxyPeer(_ context.Context, _ *proto.CreateProxyPeerRequest, _ ...grpc.CallOption) (*proto.CreateProxyPeerResponse, error) {
+ return &proto.CreateProxyPeerResponse{Success: true}, nil
+}
+
+type mockStatusNotifier struct {
+ mu sync.Mutex
+ statuses []statusCall
+}
+
+type statusCall struct {
+ accountID string
+ serviceID string
+ domain string
+ connected bool
+}
+
+func (m *mockStatusNotifier) NotifyStatus(_ context.Context, accountID, serviceID, domain string, connected bool) error {
+ m.mu.Lock()
+ defer m.mu.Unlock()
+ m.statuses = append(m.statuses, statusCall{accountID, serviceID, domain, connected})
+ return nil
+}
+
+func (m *mockStatusNotifier) calls() []statusCall {
+ m.mu.Lock()
+ defer m.mu.Unlock()
+ return append([]statusCall{}, m.statuses...)
+}
+
+// mockNetBird creates a NetBird instance for testing without actually connecting.
+// It uses an invalid management URL to prevent real connections.
+func mockNetBird() *NetBird {
+ return NewNetBird("http://invalid.test:9999", "test-proxy", "invalid.test", 0, nil, nil, &mockMgmtClient{})
+}
+
+func TestNetBird_AddPeer_CreatesClientForNewAccount(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("account-1")
+
+ // Initially no client exists.
+ assert.False(t, nb.HasClient(accountID), "should not have client before AddPeer")
+ assert.Equal(t, 0, nb.DomainCount(accountID), "domain count should be 0")
+
+ // Add first domain - this should create a new client.
+ // Note: This will fail to actually connect since we use an invalid URL,
+ // but the client entry should still be created.
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "setup-key-1", "proxy-1")
+ require.NoError(t, err)
+
+ assert.True(t, nb.HasClient(accountID), "should have client after AddPeer")
+ assert.Equal(t, 1, nb.DomainCount(accountID), "domain count should be 1")
+}
+
+func TestNetBird_AddPeer_ReuseClientForSameAccount(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("account-1")
+
+ // Add first domain.
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "setup-key-1", "proxy-1")
+ require.NoError(t, err)
+ assert.Equal(t, 1, nb.DomainCount(accountID))
+
+ // Add second domain for the same account - should reuse existing client.
+ err = nb.AddPeer(context.Background(), accountID, domain.Domain("domain2.test"), "setup-key-1", "proxy-2")
+ require.NoError(t, err)
+ assert.Equal(t, 2, nb.DomainCount(accountID), "domain count should be 2 after adding second domain")
+
+ // Add third domain.
+ err = nb.AddPeer(context.Background(), accountID, domain.Domain("domain3.test"), "setup-key-1", "proxy-3")
+ require.NoError(t, err)
+ assert.Equal(t, 3, nb.DomainCount(accountID), "domain count should be 3 after adding third domain")
+
+ // Still only one client.
+ assert.True(t, nb.HasClient(accountID))
+}
+
+func TestNetBird_AddPeer_SeparateClientsForDifferentAccounts(t *testing.T) {
+ nb := mockNetBird()
+ account1 := types.AccountID("account-1")
+ account2 := types.AccountID("account-2")
+
+ // Add domain for account 1.
+ err := nb.AddPeer(context.Background(), account1, domain.Domain("domain1.test"), "setup-key-1", "proxy-1")
+ require.NoError(t, err)
+
+ // Add domain for account 2.
+ err = nb.AddPeer(context.Background(), account2, domain.Domain("domain2.test"), "setup-key-2", "proxy-2")
+ require.NoError(t, err)
+
+ // Both accounts should have their own clients.
+ assert.True(t, nb.HasClient(account1), "account1 should have client")
+ assert.True(t, nb.HasClient(account2), "account2 should have client")
+ assert.Equal(t, 1, nb.DomainCount(account1), "account1 domain count should be 1")
+ assert.Equal(t, 1, nb.DomainCount(account2), "account2 domain count should be 1")
+}
+
+func TestNetBird_RemovePeer_KeepsClientWhenDomainsRemain(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("account-1")
+
+ // Add multiple domains.
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "setup-key-1", "proxy-1")
+ require.NoError(t, err)
+ err = nb.AddPeer(context.Background(), accountID, domain.Domain("domain2.test"), "setup-key-1", "proxy-2")
+ require.NoError(t, err)
+ err = nb.AddPeer(context.Background(), accountID, domain.Domain("domain3.test"), "setup-key-1", "proxy-3")
+ require.NoError(t, err)
+ assert.Equal(t, 3, nb.DomainCount(accountID))
+
+ // Remove one domain - client should remain.
+ err = nb.RemovePeer(context.Background(), accountID, "domain1.test")
+ require.NoError(t, err)
+ assert.True(t, nb.HasClient(accountID), "client should remain after removing one domain")
+ assert.Equal(t, 2, nb.DomainCount(accountID), "domain count should be 2")
+
+ // Remove another domain - client should still remain.
+ err = nb.RemovePeer(context.Background(), accountID, "domain2.test")
+ require.NoError(t, err)
+ assert.True(t, nb.HasClient(accountID), "client should remain after removing second domain")
+ assert.Equal(t, 1, nb.DomainCount(accountID), "domain count should be 1")
+}
+
+func TestNetBird_RemovePeer_RemovesClientWhenLastDomainRemoved(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("account-1")
+
+ // Add single domain.
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "setup-key-1", "proxy-1")
+ require.NoError(t, err)
+ assert.True(t, nb.HasClient(accountID))
+
+ // Remove the only domain - client should be removed.
+ // Note: Stop() may fail since the client never actually connected,
+ // but the entry should still be removed from the map.
+ _ = nb.RemovePeer(context.Background(), accountID, "domain1.test")
+
+ // After removing all domains, client should be gone.
+ assert.False(t, nb.HasClient(accountID), "client should be removed after removing last domain")
+ assert.Equal(t, 0, nb.DomainCount(accountID), "domain count should be 0")
+}
+
+func TestNetBird_RemovePeer_NonExistentAccountIsNoop(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("nonexistent-account")
+
+ // Removing from non-existent account should not error.
+ err := nb.RemovePeer(context.Background(), accountID, "domain1.test")
+ assert.NoError(t, err, "removing from non-existent account should not error")
+}
+
+func TestNetBird_RemovePeer_NonExistentDomainIsNoop(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("account-1")
+
+ // Add one domain.
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "setup-key-1", "proxy-1")
+ require.NoError(t, err)
+
+ // Remove non-existent domain - should not affect existing domain.
+ err = nb.RemovePeer(context.Background(), accountID, domain.Domain("nonexistent.test"))
+ require.NoError(t, err)
+
+ // Original domain should still be registered.
+ assert.True(t, nb.HasClient(accountID))
+ assert.Equal(t, 1, nb.DomainCount(accountID), "original domain should remain")
+}
+
+func TestWithAccountID_AndAccountIDFromContext(t *testing.T) {
+ ctx := context.Background()
+ accountID := types.AccountID("test-account")
+
+ // Initially no account ID in context.
+ retrieved := AccountIDFromContext(ctx)
+ assert.True(t, retrieved == "", "should be empty when not set")
+
+ // Add account ID to context.
+ ctx = WithAccountID(ctx, accountID)
+ retrieved = AccountIDFromContext(ctx)
+ assert.Equal(t, accountID, retrieved, "should retrieve the same account ID")
+}
+
+func TestAccountIDFromContext_ReturnsEmptyForWrongType(t *testing.T) {
+ // Create context with wrong type for account ID key.
+ ctx := context.WithValue(context.Background(), accountIDContextKey{}, "wrong-type-string")
+
+ retrieved := AccountIDFromContext(ctx)
+ assert.True(t, retrieved == "", "should return empty for wrong type")
+}
+
+func TestNetBird_StopAll_StopsAllClients(t *testing.T) {
+ nb := mockNetBird()
+ account1 := types.AccountID("account-1")
+ account2 := types.AccountID("account-2")
+ account3 := types.AccountID("account-3")
+
+ // Add domains for multiple accounts.
+ err := nb.AddPeer(context.Background(), account1, domain.Domain("domain1.test"), "key-1", "proxy-1")
+ require.NoError(t, err)
+ err = nb.AddPeer(context.Background(), account2, domain.Domain("domain2.test"), "key-2", "proxy-2")
+ require.NoError(t, err)
+ err = nb.AddPeer(context.Background(), account3, domain.Domain("domain3.test"), "key-3", "proxy-3")
+ require.NoError(t, err)
+
+ assert.Equal(t, 3, nb.ClientCount(), "should have 3 clients")
+
+ // Stop all clients.
+ // Note: StopAll may return errors since clients never actually connected,
+ // but the clients should still be removed from the map.
+ _ = nb.StopAll(context.Background())
+
+ assert.Equal(t, 0, nb.ClientCount(), "should have 0 clients after StopAll")
+ assert.False(t, nb.HasClient(account1), "account1 should not have client")
+ assert.False(t, nb.HasClient(account2), "account2 should not have client")
+ assert.False(t, nb.HasClient(account3), "account3 should not have client")
+}
+
+func TestNetBird_ClientCount(t *testing.T) {
+ nb := mockNetBird()
+
+ assert.Equal(t, 0, nb.ClientCount(), "should start with 0 clients")
+
+ // Add clients for different accounts.
+ err := nb.AddPeer(context.Background(), types.AccountID("account-1"), domain.Domain("domain1.test"), "key-1", "proxy-1")
+ require.NoError(t, err)
+ assert.Equal(t, 1, nb.ClientCount())
+
+ err = nb.AddPeer(context.Background(), types.AccountID("account-2"), domain.Domain("domain2.test"), "key-2", "proxy-2")
+ require.NoError(t, err)
+ assert.Equal(t, 2, nb.ClientCount())
+
+ // Adding domain to existing account should not increase count.
+ err = nb.AddPeer(context.Background(), types.AccountID("account-1"), domain.Domain("domain1b.test"), "key-1", "proxy-1b")
+ require.NoError(t, err)
+ assert.Equal(t, 2, nb.ClientCount(), "adding domain to existing account should not increase client count")
+}
+
+func TestNetBird_RoundTrip_RequiresAccountIDInContext(t *testing.T) {
+ nb := mockNetBird()
+
+ // Create a request without account ID in context.
+ req, err := http.NewRequest("GET", "http://example.com/", nil)
+ require.NoError(t, err)
+
+ // RoundTrip should fail because no account ID in context.
+ _, err = nb.RoundTrip(req) //nolint:bodyclose
+ require.ErrorIs(t, err, ErrNoAccountID)
+}
+
+func TestNetBird_RoundTrip_RequiresExistingClient(t *testing.T) {
+ nb := mockNetBird()
+ accountID := types.AccountID("nonexistent-account")
+
+ // Create a request with account ID but no client exists.
+ req, err := http.NewRequest("GET", "http://example.com/", nil)
+ require.NoError(t, err)
+ req = req.WithContext(WithAccountID(req.Context(), accountID))
+
+ // RoundTrip should fail because no client for this account.
+ _, err = nb.RoundTrip(req) //nolint:bodyclose // Error case, no response body
+ assert.Error(t, err)
+ assert.Contains(t, err.Error(), "no peer connection found for account")
+}
+
+func TestNetBird_AddPeer_ExistingStartedClient_NotifiesStatus(t *testing.T) {
+ notifier := &mockStatusNotifier{}
+ nb := NewNetBird("http://invalid.test:9999", "test-proxy", "invalid.test", 0, nil, notifier, &mockMgmtClient{})
+ accountID := types.AccountID("account-1")
+
+ // Add first domain — creates a new client entry.
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "key-1", "svc-1")
+ require.NoError(t, err)
+
+ // Manually mark client as started to simulate background startup completing.
+ nb.clientsMux.Lock()
+ nb.clients[accountID].started = true
+ nb.clientsMux.Unlock()
+
+ // Add second domain — should notify immediately since client is already started.
+ err = nb.AddPeer(context.Background(), accountID, domain.Domain("domain2.test"), "key-1", "svc-2")
+ require.NoError(t, err)
+
+ calls := notifier.calls()
+ require.Len(t, calls, 1)
+ assert.Equal(t, string(accountID), calls[0].accountID)
+ assert.Equal(t, "svc-2", calls[0].serviceID)
+ assert.Equal(t, "domain2.test", calls[0].domain)
+ assert.True(t, calls[0].connected)
+}
+
+func TestNetBird_RemovePeer_NotifiesDisconnection(t *testing.T) {
+ notifier := &mockStatusNotifier{}
+ nb := NewNetBird("http://invalid.test:9999", "test-proxy", "invalid.test", 0, nil, notifier, &mockMgmtClient{})
+ accountID := types.AccountID("account-1")
+
+ err := nb.AddPeer(context.Background(), accountID, domain.Domain("domain1.test"), "key-1", "svc-1")
+ require.NoError(t, err)
+ err = nb.AddPeer(context.Background(), accountID, domain.Domain("domain2.test"), "key-1", "svc-2")
+ require.NoError(t, err)
+
+ // Remove one domain — client stays, but disconnection notification fires.
+ err = nb.RemovePeer(context.Background(), accountID, "domain1.test")
+ require.NoError(t, err)
+ assert.True(t, nb.HasClient(accountID))
+
+ calls := notifier.calls()
+ require.Len(t, calls, 1)
+ assert.Equal(t, "domain1.test", calls[0].domain)
+ assert.False(t, calls[0].connected)
+}
diff --git a/proxy/internal/roundtrip/transport.go b/proxy/internal/roundtrip/transport.go
new file mode 100644
index 000000000..7c450bbb7
--- /dev/null
+++ b/proxy/internal/roundtrip/transport.go
@@ -0,0 +1,152 @@
+package roundtrip
+
+import (
+ "os"
+ "strconv"
+ "time"
+
+ log "github.com/sirupsen/logrus"
+)
+
+// Environment variable names for tuning the backend HTTP transport.
+const (
+ EnvMaxIdleConns = "NB_PROXY_MAX_IDLE_CONNS"
+ EnvMaxIdleConnsPerHost = "NB_PROXY_MAX_IDLE_CONNS_PER_HOST"
+ EnvMaxConnsPerHost = "NB_PROXY_MAX_CONNS_PER_HOST"
+ EnvIdleConnTimeout = "NB_PROXY_IDLE_CONN_TIMEOUT"
+ EnvTLSHandshakeTimeout = "NB_PROXY_TLS_HANDSHAKE_TIMEOUT"
+ EnvExpectContinueTimeout = "NB_PROXY_EXPECT_CONTINUE_TIMEOUT"
+ EnvResponseHeaderTimeout = "NB_PROXY_RESPONSE_HEADER_TIMEOUT"
+ EnvWriteBufferSize = "NB_PROXY_WRITE_BUFFER_SIZE"
+ EnvReadBufferSize = "NB_PROXY_READ_BUFFER_SIZE"
+ EnvDisableCompression = "NB_PROXY_DISABLE_COMPRESSION"
+ EnvMaxInflight = "NB_PROXY_MAX_INFLIGHT"
+)
+
+// transportConfig holds tunable parameters for the per-account HTTP transport.
+type transportConfig struct {
+ maxIdleConns int
+ maxIdleConnsPerHost int
+ maxConnsPerHost int
+ idleConnTimeout time.Duration
+ tlsHandshakeTimeout time.Duration
+ expectContinueTimeout time.Duration
+ responseHeaderTimeout time.Duration
+ writeBufferSize int
+ readBufferSize int
+ disableCompression bool
+ // maxInflight limits per-backend concurrent requests. 0 means unlimited.
+ maxInflight int
+}
+
+func defaultTransportConfig() transportConfig {
+ return transportConfig{
+ maxIdleConns: 100,
+ maxIdleConnsPerHost: 100,
+ maxConnsPerHost: 0, // unlimited
+ idleConnTimeout: 90 * time.Second,
+ tlsHandshakeTimeout: 10 * time.Second,
+ expectContinueTimeout: 1 * time.Second,
+ }
+}
+
+func loadTransportConfig(logger *log.Logger) transportConfig {
+ cfg := defaultTransportConfig()
+
+ if v, ok := envInt(EnvMaxIdleConns, logger); ok {
+ cfg.maxIdleConns = v
+ }
+ if v, ok := envInt(EnvMaxIdleConnsPerHost, logger); ok {
+ cfg.maxIdleConnsPerHost = v
+ }
+ if v, ok := envInt(EnvMaxConnsPerHost, logger); ok {
+ cfg.maxConnsPerHost = v
+ }
+ if v, ok := envDuration(EnvIdleConnTimeout, logger); ok {
+ cfg.idleConnTimeout = v
+ }
+ if v, ok := envDuration(EnvTLSHandshakeTimeout, logger); ok {
+ cfg.tlsHandshakeTimeout = v
+ }
+ if v, ok := envDuration(EnvExpectContinueTimeout, logger); ok {
+ cfg.expectContinueTimeout = v
+ }
+ if v, ok := envDuration(EnvResponseHeaderTimeout, logger); ok {
+ cfg.responseHeaderTimeout = v
+ }
+ if v, ok := envInt(EnvWriteBufferSize, logger); ok {
+ cfg.writeBufferSize = v
+ }
+ if v, ok := envInt(EnvReadBufferSize, logger); ok {
+ cfg.readBufferSize = v
+ }
+ if v, ok := envBool(EnvDisableCompression, logger); ok {
+ cfg.disableCompression = v
+ }
+ if v, ok := envInt(EnvMaxInflight, logger); ok {
+ cfg.maxInflight = v
+ }
+
+ logger.WithFields(log.Fields{
+ "max_idle_conns": cfg.maxIdleConns,
+ "max_idle_conns_per_host": cfg.maxIdleConnsPerHost,
+ "max_conns_per_host": cfg.maxConnsPerHost,
+ "idle_conn_timeout": cfg.idleConnTimeout,
+ "tls_handshake_timeout": cfg.tlsHandshakeTimeout,
+ "expect_continue_timeout": cfg.expectContinueTimeout,
+ "response_header_timeout": cfg.responseHeaderTimeout,
+ "write_buffer_size": cfg.writeBufferSize,
+ "read_buffer_size": cfg.readBufferSize,
+ "disable_compression": cfg.disableCompression,
+ "max_inflight": cfg.maxInflight,
+ }).Debug("backend transport configuration")
+
+ return cfg
+}
+
+func envInt(key string, logger *log.Logger) (int, bool) {
+ s := os.Getenv(key)
+ if s == "" {
+ return 0, false
+ }
+ v, err := strconv.Atoi(s)
+ if err != nil {
+ logger.Warnf("failed to parse %s=%q as int: %v", key, s, err)
+ return 0, false
+ }
+ if v < 0 {
+ logger.Warnf("ignoring negative value for %s=%d", key, v)
+ return 0, false
+ }
+ return v, true
+}
+
+func envDuration(key string, logger *log.Logger) (time.Duration, bool) {
+ s := os.Getenv(key)
+ if s == "" {
+ return 0, false
+ }
+ v, err := time.ParseDuration(s)
+ if err != nil {
+ logger.Warnf("failed to parse %s=%q as duration: %v", key, s, err)
+ return 0, false
+ }
+ if v < 0 {
+ logger.Warnf("ignoring negative value for %s=%s", key, v)
+ return 0, false
+ }
+ return v, true
+}
+
+func envBool(key string, logger *log.Logger) (bool, bool) {
+ s := os.Getenv(key)
+ if s == "" {
+ return false, false
+ }
+ v, err := strconv.ParseBool(s)
+ if err != nil {
+ logger.Warnf("failed to parse %s=%q as bool: %v", key, s, err)
+ return false, false
+ }
+ return v, true
+}
diff --git a/proxy/internal/types/types.go b/proxy/internal/types/types.go
new file mode 100644
index 000000000..41acfef40
--- /dev/null
+++ b/proxy/internal/types/types.go
@@ -0,0 +1,5 @@
+// Package types defines common types used across the proxy package.
+package types
+
+// AccountID represents a unique identifier for a NetBird account.
+type AccountID string
diff --git a/proxy/log.go b/proxy/log.go
new file mode 100644
index 000000000..79562989e
--- /dev/null
+++ b/proxy/log.go
@@ -0,0 +1,21 @@
+package proxy
+
+import (
+ stdlog "log"
+
+ log "github.com/sirupsen/logrus"
+)
+
+const (
+ // HTTP server type identifiers for logging
+ logtagFieldHTTPServer = "http-server"
+ logtagValueHTTPS = "https"
+ logtagValueACME = "acme"
+ logtagValueDebug = "debug"
+)
+
+// newHTTPServerLogger creates a standard library logger that writes to logrus
+// with the specified server type field.
+func newHTTPServerLogger(logger *log.Logger, serverType string) *stdlog.Logger {
+ return stdlog.New(logger.WithField(logtagFieldHTTPServer, serverType).WriterLevel(log.WarnLevel), "", 0)
+}
diff --git a/proxy/management_integration_test.go b/proxy/management_integration_test.go
new file mode 100644
index 000000000..53d7019f7
--- /dev/null
+++ b/proxy/management_integration_test.go
@@ -0,0 +1,548 @@
+package proxy
+
+import (
+ "context"
+ "crypto/ed25519"
+ "crypto/rand"
+ "encoding/base64"
+ "errors"
+ "net"
+ "sync"
+ "sync/atomic"
+ "testing"
+ "time"
+
+ log "github.com/sirupsen/logrus"
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+ "google.golang.org/grpc"
+ "google.golang.org/grpc/credentials/insecure"
+
+ "github.com/netbirdio/netbird/management/internals/modules/reverseproxy"
+ "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+ nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+ "github.com/netbirdio/netbird/management/server/store"
+ "github.com/netbirdio/netbird/management/server/types"
+ "github.com/netbirdio/netbird/management/server/users"
+ "github.com/netbirdio/netbird/proxy/internal/auth"
+ "github.com/netbirdio/netbird/proxy/internal/proxy"
+ proxytypes "github.com/netbirdio/netbird/proxy/internal/types"
+ "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// integrationTestSetup contains all real components for testing.
+type integrationTestSetup struct {
+ store store.Store
+ proxyService *nbgrpc.ProxyServiceServer
+ grpcServer *grpc.Server
+ grpcAddr string
+ cleanup func()
+ services []*reverseproxy.Service
+}
+
+func setupIntegrationTest(t *testing.T) *integrationTestSetup {
+ t.Helper()
+
+ ctx := context.Background()
+
+ // Create real SQLite store
+ testStore, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+ require.NoError(t, err)
+
+ // Create test account
+ testAccount := &types.Account{
+ Id: "test-account-1",
+ Domain: "test.com",
+ DomainCategory: "private",
+ IsDomainPrimaryAccount: true,
+ CreatedAt: time.Now(),
+ }
+ require.NoError(t, testStore.SaveAccount(ctx, testAccount))
+
+ // Generate session keys for reverse proxies
+ pub, priv, err := ed25519.GenerateKey(rand.Reader)
+ require.NoError(t, err)
+ pubKey := base64.StdEncoding.EncodeToString(pub)
+ privKey := base64.StdEncoding.EncodeToString(priv)
+
+ // Create test services in the store
+ services := []*reverseproxy.Service{
+ {
+ ID: "rp-1",
+ AccountID: "test-account-1",
+ Name: "Test App 1",
+ Domain: "app1.test.proxy.io",
+ Targets: []*reverseproxy.Target{{
+ Path: strPtr("/"),
+ Host: "10.0.0.1",
+ Port: 8080,
+ Protocol: "http",
+ TargetId: "peer1",
+ TargetType: "peer",
+ Enabled: true,
+ }},
+ Enabled: true,
+ ProxyCluster: "test.proxy.io",
+ SessionPrivateKey: privKey,
+ SessionPublicKey: pubKey,
+ },
+ {
+ ID: "rp-2",
+ AccountID: "test-account-1",
+ Name: "Test App 2",
+ Domain: "app2.test.proxy.io",
+ Targets: []*reverseproxy.Target{{
+ Path: strPtr("/"),
+ Host: "10.0.0.2",
+ Port: 8080,
+ Protocol: "http",
+ TargetId: "peer2",
+ TargetType: "peer",
+ Enabled: true,
+ }},
+ Enabled: true,
+ ProxyCluster: "test.proxy.io",
+ SessionPrivateKey: privKey,
+ SessionPublicKey: pubKey,
+ },
+ }
+
+ for _, svc := range services {
+ require.NoError(t, testStore.CreateService(ctx, svc))
+ }
+
+ // Create real token store
+ tokenStore := nbgrpc.NewOneTimeTokenStore(5 * time.Minute)
+
+ // Create real users manager
+ usersManager := users.NewManager(testStore)
+
+ // Create real proxy service server with minimal config
+ oidcConfig := nbgrpc.ProxyOIDCConfig{
+ Issuer: "https://fake-issuer.example.com",
+ ClientID: "test-client",
+ HMACKey: []byte("test-hmac-key"),
+ }
+
+ proxyService := nbgrpc.NewProxyServiceServer(
+ &testAccessLogManager{},
+ tokenStore,
+ oidcConfig,
+ nil,
+ usersManager,
+ )
+
+ // Use store-backed service manager
+ svcMgr := &storeBackedServiceManager{store: testStore, tokenStore: tokenStore}
+ proxyService.SetProxyManager(svcMgr)
+
+ // Start real gRPC server
+ lis, err := net.Listen("tcp", "127.0.0.1:0")
+ require.NoError(t, err)
+
+ grpcServer := grpc.NewServer()
+ proto.RegisterProxyServiceServer(grpcServer, proxyService)
+
+ go func() {
+ if err := grpcServer.Serve(lis); err != nil {
+ t.Logf("gRPC server error: %v", err)
+ }
+ }()
+
+ return &integrationTestSetup{
+ store: testStore,
+ proxyService: proxyService,
+ grpcServer: grpcServer,
+ grpcAddr: lis.Addr().String(),
+ services: services,
+ cleanup: func() {
+ grpcServer.GracefulStop()
+ cleanup()
+ },
+ }
+}
+
+// testAccessLogManager provides access log storage for testing.
+type testAccessLogManager struct{}
+
+func (m *testAccessLogManager) SaveAccessLog(_ context.Context, _ *accesslogs.AccessLogEntry) error {
+ return nil
+}
+
+func (m *testAccessLogManager) GetAllAccessLogs(_ context.Context, _, _ string, _ *accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
+ return nil, 0, nil
+}
+
+// storeBackedServiceManager reads directly from the real store.
+type storeBackedServiceManager struct {
+ store store.Store
+ tokenStore *nbgrpc.OneTimeTokenStore
+}
+
+func (m *storeBackedServiceManager) GetAllServices(ctx context.Context, accountID, userID string) ([]*reverseproxy.Service, error) {
+ return m.store.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
+}
+
+func (m *storeBackedServiceManager) GetService(ctx context.Context, accountID, userID, serviceID string) (*reverseproxy.Service, error) {
+ return m.store.GetServiceByID(ctx, store.LockingStrengthNone, accountID, serviceID)
+}
+
+func (m *storeBackedServiceManager) CreateService(_ context.Context, _, _ string, _ *reverseproxy.Service) (*reverseproxy.Service, error) {
+ return nil, errors.New("not implemented")
+}
+
+func (m *storeBackedServiceManager) UpdateService(_ context.Context, _, _ string, _ *reverseproxy.Service) (*reverseproxy.Service, error) {
+ return nil, errors.New("not implemented")
+}
+
+func (m *storeBackedServiceManager) DeleteService(ctx context.Context, accountID, userID, serviceID string) error {
+ return nil
+}
+
+func (m *storeBackedServiceManager) SetCertificateIssuedAt(ctx context.Context, accountID, serviceID string) error {
+ return nil
+}
+
+func (m *storeBackedServiceManager) SetStatus(ctx context.Context, accountID, serviceID string, status reverseproxy.ProxyStatus) error {
+ return nil
+}
+
+func (m *storeBackedServiceManager) ReloadAllServicesForAccount(ctx context.Context, accountID string) error {
+ return nil
+}
+
+func (m *storeBackedServiceManager) ReloadService(ctx context.Context, accountID, serviceID string) error {
+ return nil
+}
+
+func (m *storeBackedServiceManager) GetGlobalServices(ctx context.Context) ([]*reverseproxy.Service, error) {
+ return m.store.GetAccountServices(ctx, store.LockingStrengthNone, "test-account-1")
+}
+
+func (m *storeBackedServiceManager) GetServiceByID(ctx context.Context, accountID, serviceID string) (*reverseproxy.Service, error) {
+ return m.store.GetServiceByID(ctx, store.LockingStrengthNone, accountID, serviceID)
+}
+
+func (m *storeBackedServiceManager) GetAccountServices(ctx context.Context, accountID string) ([]*reverseproxy.Service, error) {
+ return m.store.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
+}
+
+func (m *storeBackedServiceManager) GetServiceIDByTargetID(ctx context.Context, accountID string, targetID string) (string, error) {
+ return "", nil
+}
+
+func strPtr(s string) *string {
+ return &s
+}
+
+func TestIntegration_ProxyConnection_HappyPath(t *testing.T) {
+ setup := setupIntegrationTest(t)
+ defer setup.cleanup()
+
+ conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ require.NoError(t, err)
+ defer conn.Close()
+
+ client := proto.NewProxyServiceClient(conn)
+
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel()
+
+ stream, err := client.GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
+ ProxyId: "test-proxy-1",
+ Version: "test-v1",
+ Address: "test.proxy.io",
+ })
+ require.NoError(t, err)
+
+ // Receive all mappings from the snapshot - server sends each mapping individually
+ mappingsByID := make(map[string]*proto.ProxyMapping)
+ for i := 0; i < 2; i++ {
+ msg, err := stream.Recv()
+ require.NoError(t, err)
+ for _, m := range msg.GetMapping() {
+ mappingsByID[m.GetId()] = m
+ }
+ }
+
+ // Should receive 2 mappings total
+ assert.Len(t, mappingsByID, 2, "Should receive 2 reverse proxy mappings")
+
+ rp1 := mappingsByID["rp-1"]
+ require.NotNil(t, rp1)
+ assert.Equal(t, "app1.test.proxy.io", rp1.GetDomain())
+ assert.Equal(t, "test-account-1", rp1.GetAccountId())
+ assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED, rp1.GetType())
+ assert.NotEmpty(t, rp1.GetAuthToken(), "Should have auth token for peer creation")
+
+ rp2 := mappingsByID["rp-2"]
+ require.NotNil(t, rp2)
+ assert.Equal(t, "app2.test.proxy.io", rp2.GetDomain())
+}
+
+func TestIntegration_ProxyConnection_SendsClusterAddress(t *testing.T) {
+ setup := setupIntegrationTest(t)
+ defer setup.cleanup()
+
+ conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ require.NoError(t, err)
+ defer conn.Close()
+
+ client := proto.NewProxyServiceClient(conn)
+
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel()
+
+ clusterAddress := "test.proxy.io"
+
+ stream, err := client.GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
+ ProxyId: "test-proxy-cluster",
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ // Receive all mappings - server sends each mapping individually
+ mappings := make([]*proto.ProxyMapping, 0)
+ for i := 0; i < 2; i++ {
+ msg, err := stream.Recv()
+ require.NoError(t, err)
+ mappings = append(mappings, msg.GetMapping()...)
+ }
+
+ // Should receive the 2 mappings matching the cluster
+ assert.Len(t, mappings, 2, "Should receive mappings for the cluster")
+
+ for _, mapping := range mappings {
+ t.Logf("Received mapping: id=%s domain=%s", mapping.GetId(), mapping.GetDomain())
+ }
+}
+
+func TestIntegration_ProxyConnection_Reconnect_ReceivesSameConfig(t *testing.T) {
+ setup := setupIntegrationTest(t)
+ defer setup.cleanup()
+
+ conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ require.NoError(t, err)
+ defer conn.Close()
+
+ client := proto.NewProxyServiceClient(conn)
+
+ clusterAddress := "test.proxy.io"
+ proxyID := "test-proxy-reconnect"
+
+ // Helper to receive all mappings from a stream
+ receiveMappings := func(stream proto.ProxyService_GetMappingUpdateClient, count int) []*proto.ProxyMapping {
+ var mappings []*proto.ProxyMapping
+ for i := 0; i < count; i++ {
+ msg, err := stream.Recv()
+ require.NoError(t, err)
+ mappings = append(mappings, msg.GetMapping()...)
+ }
+ return mappings
+ }
+
+ // First connection
+ ctx1, cancel1 := context.WithTimeout(context.Background(), 5*time.Second)
+ stream1, err := client.GetMappingUpdate(ctx1, &proto.GetMappingUpdateRequest{
+ ProxyId: proxyID,
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ firstMappings := receiveMappings(stream1, 2)
+ cancel1()
+
+ time.Sleep(100 * time.Millisecond)
+
+ // Second connection (simulating reconnect)
+ ctx2, cancel2 := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel2()
+
+ stream2, err := client.GetMappingUpdate(ctx2, &proto.GetMappingUpdateRequest{
+ ProxyId: proxyID,
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ secondMappings := receiveMappings(stream2, 2)
+
+ // Should receive the same mappings
+ assert.Equal(t, len(firstMappings), len(secondMappings),
+ "Should receive same number of mappings on reconnect")
+
+ firstIDs := make(map[string]bool)
+ for _, m := range firstMappings {
+ firstIDs[m.GetId()] = true
+ }
+
+ for _, m := range secondMappings {
+ assert.True(t, firstIDs[m.GetId()],
+ "Mapping %s should be present in both connections", m.GetId())
+ }
+}
+
+func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T) {
+ setup := setupIntegrationTest(t)
+ defer setup.cleanup()
+
+ conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ require.NoError(t, err)
+ defer conn.Close()
+
+ client := proto.NewProxyServiceClient(conn)
+
+ // Use real auth middleware and proxy to verify idempotency
+ logger := log.New()
+ logger.SetLevel(log.WarnLevel)
+
+ authMw := auth.NewMiddleware(logger, nil)
+ proxyHandler := proxy.NewReverseProxy(nil, "auto", nil, logger)
+
+ clusterAddress := "test.proxy.io"
+ proxyID := "test-proxy-idempotent"
+
+ var addMappingCalls atomic.Int32
+
+ applyMappings := func(mappings []*proto.ProxyMapping) {
+ for _, mapping := range mappings {
+ if mapping.GetType() == proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED {
+ addMappingCalls.Add(1)
+
+ // Apply to real auth middleware (idempotent)
+ err := authMw.AddDomain(
+ mapping.GetDomain(),
+ nil,
+ "",
+ 0,
+ mapping.GetAccountId(),
+ mapping.GetId(),
+ )
+ require.NoError(t, err)
+
+ // Apply to real proxy (idempotent)
+ proxyHandler.AddMapping(proxy.Mapping{
+ Host: mapping.GetDomain(),
+ ID: mapping.GetId(),
+ AccountID: proxytypes.AccountID(mapping.GetAccountId()),
+ })
+ }
+ }
+ }
+
+ // Helper to receive and apply all mappings
+ receiveAndApply := func(stream proto.ProxyService_GetMappingUpdateClient) {
+ for i := 0; i < 2; i++ {
+ msg, err := stream.Recv()
+ require.NoError(t, err)
+ applyMappings(msg.GetMapping())
+ }
+ }
+
+ // First connection
+ ctx1, cancel1 := context.WithTimeout(context.Background(), 5*time.Second)
+ stream1, err := client.GetMappingUpdate(ctx1, &proto.GetMappingUpdateRequest{
+ ProxyId: proxyID,
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ receiveAndApply(stream1)
+ cancel1()
+
+ firstCallCount := addMappingCalls.Load()
+ t.Logf("First connection: applied %d mappings", firstCallCount)
+
+ time.Sleep(100 * time.Millisecond)
+
+ // Second connection
+ ctx2, cancel2 := context.WithTimeout(context.Background(), 5*time.Second)
+ stream2, err := client.GetMappingUpdate(ctx2, &proto.GetMappingUpdateRequest{
+ ProxyId: proxyID,
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ receiveAndApply(stream2)
+ cancel2()
+
+ time.Sleep(100 * time.Millisecond)
+
+ // Third connection
+ ctx3, cancel3 := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel3()
+
+ stream3, err := client.GetMappingUpdate(ctx3, &proto.GetMappingUpdateRequest{
+ ProxyId: proxyID,
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ receiveAndApply(stream3)
+
+ totalCalls := addMappingCalls.Load()
+ t.Logf("After three connections: total applied %d mappings", totalCalls)
+
+ // Should have called addMapping 6 times (2 mappings x 3 connections)
+ // But internal state is NOT duplicated because auth and proxy use maps keyed by domain/host
+ assert.Equal(t, int32(6), totalCalls, "Should have 6 total calls (2 mappings x 3 connections)")
+}
+
+func TestIntegration_ProxyConnection_MultipleProxiesReceiveUpdates(t *testing.T) {
+ setup := setupIntegrationTest(t)
+ defer setup.cleanup()
+
+ clusterAddress := "test.proxy.io"
+
+ var wg sync.WaitGroup
+ var mu sync.Mutex
+ receivedByProxy := make(map[string]int)
+
+ for i := 1; i <= 3; i++ {
+ wg.Add(1)
+ go func(proxyNum int) {
+ defer wg.Done()
+
+ conn, err := grpc.NewClient(setup.grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+ require.NoError(t, err)
+ defer conn.Close()
+
+ client := proto.NewProxyServiceClient(conn)
+
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+ defer cancel()
+
+ proxyID := "test-proxy-" + string(rune('A'+proxyNum-1))
+
+ stream, err := client.GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
+ ProxyId: proxyID,
+ Version: "test-v1",
+ Address: clusterAddress,
+ })
+ require.NoError(t, err)
+
+ // Receive all mappings - server sends each mapping individually
+ count := 0
+ for i := 0; i < 2; i++ {
+ msg, err := stream.Recv()
+ require.NoError(t, err)
+ count += len(msg.GetMapping())
+ }
+
+ mu.Lock()
+ receivedByProxy[proxyID] = count
+ mu.Unlock()
+ }(i)
+ }
+
+ wg.Wait()
+
+ for proxyID, count := range receivedByProxy {
+ assert.Equal(t, 2, count, "Proxy %s should receive 2 mappings", proxyID)
+ }
+}
diff --git a/proxy/server.go b/proxy/server.go
new file mode 100644
index 000000000..c1be69529
--- /dev/null
+++ b/proxy/server.go
@@ -0,0 +1,653 @@
+// Package proxy runs a NetBird proxy server.
+// It attempts to do everything it needs to do within the context
+// of a single request to the server to try to reduce the amount
+// of concurrency coordination that is required. However, it does
+// run two additional routines in an error group for handling
+// updates from the management server and running a separate
+// HTTP server to handle ACME HTTP-01 challenges (if configured).
+package proxy
+
+import (
+ "context"
+ "crypto/tls"
+ "crypto/x509"
+ "errors"
+ "fmt"
+ "io"
+ "net"
+ "net/http"
+ "net/netip"
+ "net/url"
+ "path/filepath"
+ "sync"
+ "time"
+
+ "github.com/cenkalti/backoff/v4"
+ "github.com/prometheus/client_golang/prometheus"
+ "github.com/prometheus/client_golang/prometheus/promhttp"
+ log "github.com/sirupsen/logrus"
+ "google.golang.org/grpc"
+ "google.golang.org/grpc/credentials"
+ "google.golang.org/grpc/credentials/insecure"
+ "google.golang.org/grpc/keepalive"
+ "google.golang.org/protobuf/types/known/timestamppb"
+
+ "github.com/netbirdio/netbird/proxy/internal/accesslog"
+ "github.com/netbirdio/netbird/proxy/internal/acme"
+ "github.com/netbirdio/netbird/proxy/internal/auth"
+ "github.com/netbirdio/netbird/proxy/internal/certwatch"
+ "github.com/netbirdio/netbird/proxy/internal/debug"
+ proxygrpc "github.com/netbirdio/netbird/proxy/internal/grpc"
+ "github.com/netbirdio/netbird/proxy/internal/health"
+ "github.com/netbirdio/netbird/proxy/internal/k8s"
+ "github.com/netbirdio/netbird/proxy/internal/metrics"
+ "github.com/netbirdio/netbird/proxy/internal/proxy"
+ "github.com/netbirdio/netbird/proxy/internal/roundtrip"
+ "github.com/netbirdio/netbird/proxy/internal/types"
+ "github.com/netbirdio/netbird/proxy/web"
+ "github.com/netbirdio/netbird/shared/management/domain"
+ "github.com/netbirdio/netbird/shared/management/proto"
+ "github.com/netbirdio/netbird/util/embeddedroots"
+)
+
+type Server struct {
+ mgmtClient proto.ProxyServiceClient
+ proxy *proxy.ReverseProxy
+ netbird *roundtrip.NetBird
+ acme *acme.Manager
+ auth *auth.Middleware
+ http *http.Server
+ https *http.Server
+ debug *http.Server
+ healthServer *health.Server
+ healthChecker *health.Checker
+ meter *metrics.Metrics
+
+ // Mostly used for debugging on management.
+ startTime time.Time
+
+ ID string
+ Logger *log.Logger
+ Version string
+ ProxyURL string
+ ManagementAddress string
+ CertificateDirectory string
+ CertificateFile string
+ CertificateKeyFile string
+ GenerateACMECertificates bool
+ ACMEChallengeAddress string
+ ACMEDirectory string
+ // ACMEChallengeType specifies the ACME challenge type: "http-01" or "tls-alpn-01".
+ // Defaults to "tls-alpn-01" if not specified.
+ ACMEChallengeType string
+ // CertLockMethod controls how ACME certificate locks are coordinated
+ // across replicas. Default: CertLockAuto (detect environment).
+ CertLockMethod acme.CertLockMethod
+ OIDCClientId string
+ OIDCClientSecret string
+ OIDCEndpoint string
+ OIDCScopes []string
+
+ // DebugEndpointEnabled enables the debug HTTP endpoint.
+ DebugEndpointEnabled bool
+ // DebugEndpointAddress is the address for the debug HTTP endpoint (default: ":8444").
+ DebugEndpointAddress string
+ // HealthAddress is the address for the health probe endpoint (default: "localhost:8080").
+ HealthAddress string
+ // ProxyToken is the access token for authenticating with the management server.
+ ProxyToken string
+ // ForwardedProto overrides the X-Forwarded-Proto value sent to backends.
+ // Valid values: "auto" (detect from TLS), "http", "https".
+ ForwardedProto string
+ // TrustedProxies is a list of IP prefixes for trusted upstream proxies.
+ // When set, forwarding headers from these sources are preserved and
+ // appended to instead of being stripped.
+ TrustedProxies []netip.Prefix
+ // WireguardPort is the port for the WireGuard interface. Use 0 for a
+ // random OS-assigned port. A fixed port only works with single-account
+ // deployments; multiple accounts will fail to bind the same port.
+ WireguardPort int
+}
+
+// NotifyStatus sends a status update to management about tunnel connectivity
+func (s *Server) NotifyStatus(ctx context.Context, accountID, serviceID, domain string, connected bool) error {
+ status := proto.ProxyStatus_PROXY_STATUS_TUNNEL_NOT_CREATED
+ if connected {
+ status = proto.ProxyStatus_PROXY_STATUS_ACTIVE
+ }
+
+ _, err := s.mgmtClient.SendStatusUpdate(ctx, &proto.SendStatusUpdateRequest{
+ ServiceId: serviceID,
+ AccountId: accountID,
+ Status: status,
+ CertificateIssued: false,
+ })
+ return err
+}
+
+// NotifyCertificateIssued sends a notification to management that a certificate was issued
+func (s *Server) NotifyCertificateIssued(ctx context.Context, accountID, serviceID, domain string) error {
+ _, err := s.mgmtClient.SendStatusUpdate(ctx, &proto.SendStatusUpdateRequest{
+ ServiceId: serviceID,
+ AccountId: accountID,
+ Status: proto.ProxyStatus_PROXY_STATUS_ACTIVE,
+ CertificateIssued: true,
+ })
+ return err
+}
+
+func (s *Server) ListenAndServe(ctx context.Context, addr string) (err error) {
+ s.startTime = time.Now()
+
+ // If no ID is set then one can be generated.
+ if s.ID == "" {
+ s.ID = "netbird-proxy-" + s.startTime.Format("20060102150405")
+ }
+ // Fallback version option in case it is not set.
+ if s.Version == "" {
+ s.Version = "dev"
+ }
+
+ // If no logger is specified fallback to the standard logger.
+ if s.Logger == nil {
+ s.Logger = log.StandardLogger()
+ }
+
+ // Start up metrics gathering
+ reg := prometheus.NewRegistry()
+ s.meter = metrics.New(reg)
+
+ mgmtConn, err := s.dialManagement()
+ if err != nil {
+ return err
+ }
+ defer func() {
+ if err := mgmtConn.Close(); err != nil {
+ s.Logger.Debugf("management connection close: %v", err)
+ }
+ }()
+ s.mgmtClient = proto.NewProxyServiceClient(mgmtConn)
+ go s.newManagementMappingWorker(ctx, s.mgmtClient)
+
+ // Initialize the netbird client, this is required to build peer connections
+ // to proxy over.
+ s.netbird = roundtrip.NewNetBird(s.ManagementAddress, s.ID, s.ProxyURL, s.WireguardPort, s.Logger, s, s.mgmtClient)
+
+ tlsConfig, err := s.configureTLS(ctx)
+ if err != nil {
+ return err
+ }
+
+ // Configure the reverse proxy using NetBird's HTTP Client Transport for proxying.
+ s.proxy = proxy.NewReverseProxy(s.meter.RoundTripper(s.netbird), s.ForwardedProto, s.TrustedProxies, s.Logger)
+
+ // Configure the authentication middleware with session validator for OIDC group checks.
+ s.auth = auth.NewMiddleware(s.Logger, s.mgmtClient)
+
+ // Configure Access logs to management server.
+ accessLog := accesslog.NewLogger(s.mgmtClient, s.Logger, s.TrustedProxies)
+
+ s.healthChecker = health.NewChecker(s.Logger, s.netbird)
+
+ if s.DebugEndpointEnabled {
+ debugAddr := debugEndpointAddr(s.DebugEndpointAddress)
+ debugHandler := debug.NewHandler(s.netbird, s.healthChecker, s.Logger)
+ if s.acme != nil {
+ debugHandler.SetCertStatus(s.acme)
+ }
+ s.debug = &http.Server{
+ Addr: debugAddr,
+ Handler: debugHandler,
+ ErrorLog: newHTTPServerLogger(s.Logger, logtagValueDebug),
+ }
+ go func() {
+ s.Logger.Infof("starting debug endpoint on %s", debugAddr)
+ if err := s.debug.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+ s.Logger.Errorf("debug endpoint error: %v", err)
+ }
+ }()
+ }
+
+ // Start health probe server.
+ healthAddr := s.HealthAddress
+ if healthAddr == "" {
+ healthAddr = "localhost:8080"
+ }
+ s.healthServer = health.NewServer(healthAddr, s.healthChecker, s.Logger, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}))
+ healthListener, err := net.Listen("tcp", healthAddr)
+ if err != nil {
+ return fmt.Errorf("health probe server listen on %s: %w", healthAddr, err)
+ }
+ go func() {
+ if err := s.healthServer.Serve(healthListener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+ s.Logger.Errorf("health probe server: %v", err)
+ }
+ }()
+
+ // Start the reverse proxy HTTPS server.
+ s.https = &http.Server{
+ Addr: addr,
+ Handler: s.meter.Middleware(accessLog.Middleware(web.AssetHandler(s.auth.Protect(s.proxy)))),
+ TLSConfig: tlsConfig,
+ ErrorLog: newHTTPServerLogger(s.Logger, logtagValueHTTPS),
+ }
+
+ httpsErr := make(chan error, 1)
+ go func() {
+ s.Logger.Debugf("starting reverse proxy server on %s", addr)
+ httpsErr <- s.https.ListenAndServeTLS("", "")
+ }()
+
+ select {
+ case err := <-httpsErr:
+ s.shutdownServices()
+ if !errors.Is(err, http.ErrServerClosed) {
+ return fmt.Errorf("https server: %w", err)
+ }
+ return nil
+ case <-ctx.Done():
+ s.gracefulShutdown()
+ return nil
+ }
+}
+
+const (
+ // shutdownPreStopDelay is the time to wait after receiving a shutdown signal
+ // before draining connections. This allows the load balancer to propagate
+ // the endpoint removal.
+ shutdownPreStopDelay = 5 * time.Second
+
+ // shutdownDrainTimeout is the maximum time to wait for in-flight HTTP
+ // requests to complete during graceful shutdown.
+ shutdownDrainTimeout = 30 * time.Second
+
+ // shutdownServiceTimeout is the maximum time to wait for auxiliary
+ // services (health probe, debug endpoint, ACME) to shut down.
+ shutdownServiceTimeout = 5 * time.Second
+)
+
+func (s *Server) dialManagement() (*grpc.ClientConn, error) {
+ mgmtURL, err := url.Parse(s.ManagementAddress)
+ if err != nil {
+ return nil, fmt.Errorf("parse management address: %w", err)
+ }
+ creds := insecure.NewCredentials()
+ // Assume management TLS is enabled for gRPC as well if using HTTPS for the API.
+ if mgmtURL.Scheme == "https" {
+ certPool, err := x509.SystemCertPool()
+ if err != nil || certPool == nil {
+ // Fall back to embedded CAs if no OS-provided ones are available.
+ certPool = embeddedroots.Get()
+ }
+ creds = credentials.NewTLS(&tls.Config{
+ RootCAs: certPool,
+ })
+ }
+ s.Logger.WithFields(log.Fields{
+ "gRPC_address": mgmtURL.Host,
+ "TLS_enabled": mgmtURL.Scheme == "https",
+ }).Debug("starting management gRPC client")
+ conn, err := grpc.NewClient(mgmtURL.Host,
+ grpc.WithTransportCredentials(creds),
+ grpc.WithKeepaliveParams(keepalive.ClientParameters{
+ Time: 20 * time.Second,
+ Timeout: 10 * time.Second,
+ PermitWithoutStream: true,
+ }),
+ proxygrpc.WithProxyToken(s.ProxyToken),
+ )
+ if err != nil {
+ return nil, fmt.Errorf("create management connection: %w", err)
+ }
+ return conn, nil
+}
+
+func (s *Server) configureTLS(ctx context.Context) (*tls.Config, error) {
+ tlsConfig := &tls.Config{}
+ if !s.GenerateACMECertificates {
+ s.Logger.Debug("ACME certificates disabled, using static certificates with file watching")
+ certPath := filepath.Join(s.CertificateDirectory, s.CertificateFile)
+ keyPath := filepath.Join(s.CertificateDirectory, s.CertificateKeyFile)
+
+ certWatcher, err := certwatch.NewWatcher(certPath, keyPath, s.Logger)
+ if err != nil {
+ return nil, fmt.Errorf("initialize certificate watcher: %w", err)
+ }
+ go certWatcher.Watch(ctx)
+ tlsConfig.GetCertificate = certWatcher.GetCertificate
+ return tlsConfig, nil
+ }
+
+ if s.ACMEChallengeType == "" {
+ s.ACMEChallengeType = "tls-alpn-01"
+ }
+ s.Logger.WithFields(log.Fields{
+ "acme_server": s.ACMEDirectory,
+ "challenge_type": s.ACMEChallengeType,
+ }).Debug("ACME certificates enabled, configuring certificate manager")
+ s.acme = acme.NewManager(s.CertificateDirectory, s.ACMEDirectory, s, s.Logger, s.CertLockMethod)
+
+ if s.ACMEChallengeType == "http-01" {
+ s.http = &http.Server{
+ Addr: s.ACMEChallengeAddress,
+ Handler: s.acme.HTTPHandler(nil),
+ ErrorLog: newHTTPServerLogger(s.Logger, logtagValueACME),
+ }
+ go func() {
+ if err := s.http.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+ s.Logger.WithError(err).Error("ACME HTTP-01 challenge server failed")
+ }
+ }()
+ }
+ tlsConfig = s.acme.TLSConfig()
+
+ // ServerName needs to be set to allow for ACME to work correctly
+ // when using CNAME URLs to access the proxy.
+ tlsConfig.ServerName = s.ProxyURL
+
+ s.Logger.WithFields(log.Fields{
+ "ServerName": s.ProxyURL,
+ "challenge_type": s.ACMEChallengeType,
+ }).Debug("ACME certificate manager configured")
+ return tlsConfig, nil
+}
+
+// gracefulShutdown performs a zero-downtime shutdown sequence. It marks the
+// readiness probe as failing, waits for load balancer propagation, drains
+// in-flight connections, and then stops all background services.
+func (s *Server) gracefulShutdown() {
+ s.Logger.Info("shutdown signal received, starting graceful shutdown")
+
+ // Step 1: Fail readiness probe so load balancers stop routing new traffic.
+ if s.healthChecker != nil {
+ s.healthChecker.SetShuttingDown()
+ }
+
+ // Step 2: When running behind a load balancer, wait for endpoint removal
+ // to propagate before draining connections.
+ if k8s.InCluster() {
+ s.Logger.Infof("waiting %s for load balancer propagation", shutdownPreStopDelay)
+ time.Sleep(shutdownPreStopDelay)
+ }
+
+ // Step 3: Stop accepting new connections and drain in-flight requests.
+ drainCtx, drainCancel := context.WithTimeout(context.Background(), shutdownDrainTimeout)
+ defer drainCancel()
+
+ s.Logger.Info("draining in-flight connections")
+ if err := s.https.Shutdown(drainCtx); err != nil {
+ s.Logger.Warnf("https server drain: %v", err)
+ }
+
+ // Step 4: Stop all remaining background services.
+ s.shutdownServices()
+ s.Logger.Info("graceful shutdown complete")
+}
+
+// shutdownServices stops all background services concurrently and waits for
+// them to finish.
+func (s *Server) shutdownServices() {
+ var wg sync.WaitGroup
+
+ shutdownHTTP := func(name string, shutdown func(context.Context) error) {
+ wg.Add(1)
+ go func() {
+ defer wg.Done()
+ ctx, cancel := context.WithTimeout(context.Background(), shutdownServiceTimeout)
+ defer cancel()
+ if err := shutdown(ctx); err != nil {
+ s.Logger.Debugf("%s shutdown: %v", name, err)
+ }
+ }()
+ }
+
+ if s.healthServer != nil {
+ shutdownHTTP("health probe", s.healthServer.Shutdown)
+ }
+ if s.debug != nil {
+ shutdownHTTP("debug endpoint", s.debug.Shutdown)
+ }
+ if s.http != nil {
+ shutdownHTTP("acme http", s.http.Shutdown)
+ }
+
+ if s.netbird != nil {
+ wg.Add(1)
+ go func() {
+ defer wg.Done()
+ ctx, cancel := context.WithTimeout(context.Background(), shutdownDrainTimeout)
+ defer cancel()
+ if err := s.netbird.StopAll(ctx); err != nil {
+ s.Logger.Warnf("stop netbird clients: %v", err)
+ }
+ }()
+ }
+
+ wg.Wait()
+}
+
+func (s *Server) newManagementMappingWorker(ctx context.Context, client proto.ProxyServiceClient) {
+ bo := &backoff.ExponentialBackOff{
+ InitialInterval: 800 * time.Millisecond,
+ RandomizationFactor: 1,
+ Multiplier: 1.7,
+ MaxInterval: 10 * time.Second,
+ MaxElapsedTime: 0, // retry indefinitely until context is canceled
+ Stop: backoff.Stop,
+ Clock: backoff.SystemClock,
+ }
+
+ initialSyncDone := false
+
+ operation := func() error {
+ s.Logger.Debug("connecting to management mapping stream")
+
+ if s.healthChecker != nil {
+ s.healthChecker.SetManagementConnected(false)
+ }
+
+ mappingClient, err := client.GetMappingUpdate(ctx, &proto.GetMappingUpdateRequest{
+ ProxyId: s.ID,
+ Version: s.Version,
+ StartedAt: timestamppb.New(s.startTime),
+ Address: s.ProxyURL,
+ })
+ if err != nil {
+ return fmt.Errorf("create mapping stream: %w", err)
+ }
+
+ if s.healthChecker != nil {
+ s.healthChecker.SetManagementConnected(true)
+ }
+ s.Logger.Debug("management mapping stream established")
+
+ // Stream established — reset backoff so the next failure retries quickly.
+ bo.Reset()
+
+ streamErr := s.handleMappingStream(ctx, mappingClient, &initialSyncDone)
+
+ if s.healthChecker != nil {
+ s.healthChecker.SetManagementConnected(false)
+ }
+
+ if streamErr == nil {
+ return fmt.Errorf("stream closed by server")
+ }
+
+ return fmt.Errorf("mapping stream: %w", streamErr)
+ }
+
+ notify := func(err error, next time.Duration) {
+ s.Logger.Warnf("management connection failed, retrying in %s: %v", next.Truncate(time.Millisecond), err)
+ }
+
+ if err := backoff.RetryNotify(operation, backoff.WithContext(bo, ctx), notify); err != nil {
+ s.Logger.WithError(err).Debug("management mapping worker exiting")
+ }
+}
+
+func (s *Server) handleMappingStream(ctx context.Context, mappingClient proto.ProxyService_GetMappingUpdateClient, initialSyncDone *bool) error {
+ for {
+ // Check for context completion to gracefully shutdown.
+ select {
+ case <-ctx.Done():
+ // Shutting down.
+ return ctx.Err()
+ default:
+ msg, err := mappingClient.Recv()
+ switch {
+ case errors.Is(err, io.EOF):
+ // Mapping connection gracefully terminated by server.
+ return nil
+ case err != nil:
+ // Something has gone horribly wrong, return and hope the parent retries the connection.
+ return fmt.Errorf("receive msg: %w", err)
+ }
+ s.Logger.Debug("Received mapping update, starting processing")
+ s.processMappings(ctx, msg.GetMapping())
+ s.Logger.Debug("Processing mapping update completed")
+
+ if !*initialSyncDone && msg.GetInitialSyncComplete() {
+ if s.healthChecker != nil {
+ s.healthChecker.SetInitialSyncComplete()
+ }
+ *initialSyncDone = true
+ s.Logger.Info("Initial mapping sync complete")
+ }
+ }
+ }
+}
+
+func (s *Server) processMappings(ctx context.Context, mappings []*proto.ProxyMapping) {
+ for _, mapping := range mappings {
+ s.Logger.WithFields(log.Fields{
+ "type": mapping.GetType(),
+ "domain": mapping.GetDomain(),
+ "path": mapping.GetPath(),
+ "id": mapping.GetId(),
+ }).Debug("Processing mapping update")
+ switch mapping.GetType() {
+ case proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED:
+ if err := s.addMapping(ctx, mapping); err != nil {
+ // TODO: Retry this? Or maybe notify the management server that this mapping has failed?
+ s.Logger.WithFields(log.Fields{
+ "service_id": mapping.GetId(),
+ "domain": mapping.GetDomain(),
+ "error": err,
+ }).Error("Error adding new mapping, ignoring this mapping and continuing processing")
+ }
+ case proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED:
+ if err := s.updateMapping(ctx, mapping); err != nil {
+ s.Logger.WithFields(log.Fields{
+ "service_id": mapping.GetId(),
+ "domain": mapping.GetDomain(),
+ }).Errorf("failed to update mapping: %v", err)
+ }
+ case proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED:
+ s.removeMapping(ctx, mapping)
+ }
+ }
+}
+
+func (s *Server) addMapping(ctx context.Context, mapping *proto.ProxyMapping) error {
+ d := domain.Domain(mapping.GetDomain())
+ accountID := types.AccountID(mapping.GetAccountId())
+ serviceID := mapping.GetId()
+ authToken := mapping.GetAuthToken()
+
+ if err := s.netbird.AddPeer(ctx, accountID, d, authToken, serviceID); err != nil {
+ return fmt.Errorf("create peer for domain %q: %w", d, err)
+ }
+ if s.acme != nil {
+ s.acme.AddDomain(d, string(accountID), serviceID)
+ }
+
+ // Pass the mapping through to the update function to avoid duplicating the
+ // setup, currently update is simply a subset of this function, so this
+ // separation makes sense...to me at least.
+ if err := s.updateMapping(ctx, mapping); err != nil {
+ s.removeMapping(ctx, mapping)
+ return fmt.Errorf("update mapping for domain %q: %w", d, err)
+ }
+ return nil
+}
+
+func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping) error {
+ // Very simple implementation here, we don't touch the existing peer
+ // connection or any existing TLS configuration, we simply overwrite
+ // the auth and proxy mappings.
+ // Note: this does require the management server to always send a
+ // full mapping rather than deltas during a modification.
+ var schemes []auth.Scheme
+ if mapping.GetAuth().GetPassword() {
+ schemes = append(schemes, auth.NewPassword(s.mgmtClient, mapping.GetId(), mapping.GetAccountId()))
+ }
+ if mapping.GetAuth().GetPin() {
+ schemes = append(schemes, auth.NewPin(s.mgmtClient, mapping.GetId(), mapping.GetAccountId()))
+ }
+ if mapping.GetAuth().GetOidc() {
+ schemes = append(schemes, auth.NewOIDC(s.mgmtClient, mapping.GetId(), mapping.GetAccountId(), s.ForwardedProto))
+ }
+
+ maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
+ if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, mapping.GetAccountId(), mapping.GetId()); err != nil {
+ return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
+ }
+ s.proxy.AddMapping(s.protoToMapping(mapping))
+ s.meter.AddMapping(s.protoToMapping(mapping))
+ return nil
+}
+
+func (s *Server) removeMapping(ctx context.Context, mapping *proto.ProxyMapping) {
+ d := domain.Domain(mapping.GetDomain())
+ accountID := types.AccountID(mapping.GetAccountId())
+ if err := s.netbird.RemovePeer(ctx, accountID, d); err != nil {
+ s.Logger.WithFields(log.Fields{
+ "account_id": accountID,
+ "domain": d,
+ "error": err,
+ }).Error("Error removing NetBird peer connection for domain, continuing additional domain cleanup but peer connection may still exist")
+ }
+ if s.acme != nil {
+ s.acme.RemoveDomain(d)
+ }
+ s.auth.RemoveDomain(mapping.GetDomain())
+ s.proxy.RemoveMapping(s.protoToMapping(mapping))
+ s.meter.RemoveMapping(s.protoToMapping(mapping))
+}
+
+func (s *Server) protoToMapping(mapping *proto.ProxyMapping) proxy.Mapping {
+ paths := make(map[string]*url.URL)
+ for _, pathMapping := range mapping.GetPath() {
+ targetURL, err := url.Parse(pathMapping.GetTarget())
+ if err != nil {
+ // TODO: Should we warn management about this so it can be bubbled up to a user to reconfigure?
+ s.Logger.WithFields(log.Fields{
+ "service_id": mapping.GetId(),
+ "account_id": mapping.GetAccountId(),
+ "domain": mapping.GetDomain(),
+ "path": pathMapping.GetPath(),
+ "target": pathMapping.GetTarget(),
+ }).WithError(err).Error("failed to parse target URL for path, skipping")
+ continue
+ }
+ paths[pathMapping.GetPath()] = targetURL
+ }
+ return proxy.Mapping{
+ ID: mapping.GetId(),
+ AccountID: types.AccountID(mapping.GetAccountId()),
+ Host: mapping.GetDomain(),
+ Paths: paths,
+ PassHostHeader: mapping.GetPassHostHeader(),
+ RewriteRedirects: mapping.GetRewriteRedirects(),
+ }
+}
+
+// debugEndpointAddr returns the address for the debug endpoint.
+// If addr is empty, it defaults to localhost:8444 for security.
+func debugEndpointAddr(addr string) string {
+ if addr == "" {
+ return "localhost:8444"
+ }
+ return addr
+}
diff --git a/proxy/server_test.go b/proxy/server_test.go
new file mode 100644
index 000000000..b4fb4f8ba
--- /dev/null
+++ b/proxy/server_test.go
@@ -0,0 +1,48 @@
+package proxy
+
+import (
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+)
+
+func TestDebugEndpointDisabledByDefault(t *testing.T) {
+ s := &Server{}
+ assert.False(t, s.DebugEndpointEnabled, "debug endpoint should be disabled by default")
+}
+
+func TestDebugEndpointAddr(t *testing.T) {
+ tests := []struct {
+ name string
+ input string
+ expected string
+ }{
+ {
+ name: "empty defaults to localhost",
+ input: "",
+ expected: "localhost:8444",
+ },
+ {
+ name: "explicit localhost preserved",
+ input: "localhost:9999",
+ expected: "localhost:9999",
+ },
+ {
+ name: "explicit address preserved",
+ input: "0.0.0.0:8444",
+ expected: "0.0.0.0:8444",
+ },
+ {
+ name: "127.0.0.1 preserved",
+ input: "127.0.0.1:8444",
+ expected: "127.0.0.1:8444",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ result := debugEndpointAddr(tc.input)
+ assert.Equal(t, tc.expected, result)
+ })
+ }
+}
diff --git a/proxy/trustedproxy.go b/proxy/trustedproxy.go
new file mode 100644
index 000000000..3a1f0ad37
--- /dev/null
+++ b/proxy/trustedproxy.go
@@ -0,0 +1,43 @@
+package proxy
+
+import (
+ "fmt"
+ "net/netip"
+ "strings"
+)
+
+// ParseTrustedProxies parses a comma-separated list of CIDR prefixes or bare IPs
+// into a slice of netip.Prefix values suitable for trusted proxy configuration.
+// Bare IPs are converted to single-host prefixes (/32 or /128).
+func ParseTrustedProxies(raw string) ([]netip.Prefix, error) {
+ if raw == "" {
+ return nil, nil
+ }
+
+ parts := strings.Split(raw, ",")
+ prefixes := make([]netip.Prefix, 0, len(parts))
+ for _, part := range parts {
+ part = strings.TrimSpace(part)
+ if part == "" {
+ continue
+ }
+
+ prefix, err := netip.ParsePrefix(part)
+ if err == nil {
+ prefixes = append(prefixes, prefix)
+ continue
+ }
+
+ addr, addrErr := netip.ParseAddr(part)
+ if addrErr != nil {
+ return nil, fmt.Errorf("parse trusted proxy %q: not a valid CIDR or IP: %w", part, addrErr)
+ }
+
+ bits := 32
+ if addr.Is6() {
+ bits = 128
+ }
+ prefixes = append(prefixes, netip.PrefixFrom(addr, bits))
+ }
+ return prefixes, nil
+}
diff --git a/proxy/trustedproxy_test.go b/proxy/trustedproxy_test.go
new file mode 100644
index 000000000..974e56863
--- /dev/null
+++ b/proxy/trustedproxy_test.go
@@ -0,0 +1,90 @@
+package proxy
+
+import (
+ "net/netip"
+ "testing"
+
+ "github.com/stretchr/testify/assert"
+ "github.com/stretchr/testify/require"
+)
+
+func TestParseTrustedProxies(t *testing.T) {
+ tests := []struct {
+ name string
+ raw string
+ want []netip.Prefix
+ wantErr bool
+ }{
+ {
+ name: "empty string returns nil",
+ raw: "",
+ want: nil,
+ },
+ {
+ name: "single CIDR",
+ raw: "10.0.0.0/8",
+ want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+ },
+ {
+ name: "single bare IPv4",
+ raw: "1.2.3.4",
+ want: []netip.Prefix{netip.MustParsePrefix("1.2.3.4/32")},
+ },
+ {
+ name: "single bare IPv6",
+ raw: "::1",
+ want: []netip.Prefix{netip.MustParsePrefix("::1/128")},
+ },
+ {
+ name: "comma-separated CIDRs",
+ raw: "10.0.0.0/8, 192.168.1.0/24",
+ want: []netip.Prefix{
+ netip.MustParsePrefix("10.0.0.0/8"),
+ netip.MustParsePrefix("192.168.1.0/24"),
+ },
+ },
+ {
+ name: "mixed CIDRs and bare IPs",
+ raw: "10.0.0.0/8, 1.2.3.4, fd00::/8",
+ want: []netip.Prefix{
+ netip.MustParsePrefix("10.0.0.0/8"),
+ netip.MustParsePrefix("1.2.3.4/32"),
+ netip.MustParsePrefix("fd00::/8"),
+ },
+ },
+ {
+ name: "whitespace around entries",
+ raw: " 10.0.0.0/8 , 192.168.0.0/16 ",
+ want: []netip.Prefix{
+ netip.MustParsePrefix("10.0.0.0/8"),
+ netip.MustParsePrefix("192.168.0.0/16"),
+ },
+ },
+ {
+ name: "trailing comma produces no extra entry",
+ raw: "10.0.0.0/8,",
+ want: []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+ },
+ {
+ name: "invalid entry",
+ raw: "not-an-ip",
+ wantErr: true,
+ },
+ {
+ name: "partially invalid",
+ raw: "10.0.0.0/8, garbage",
+ wantErr: true,
+ },
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ got, err := ParseTrustedProxies(tt.raw)
+ if tt.wantErr {
+ require.Error(t, err)
+ return
+ }
+ require.NoError(t, err)
+ assert.Equal(t, tt.want, got)
+ })
+ }
+}
diff --git a/proxy/web/.gitignore b/proxy/web/.gitignore
new file mode 100644
index 000000000..251ce6d2b
--- /dev/null
+++ b/proxy/web/.gitignore
@@ -0,0 +1,23 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
diff --git a/proxy/web/dist/assets/Inter-Italic-VariableFont_opsz_wght.ttf b/proxy/web/dist/assets/Inter-Italic-VariableFont_opsz_wght.ttf
new file mode 100644
index 000000000..43ed4f5ee
Binary files /dev/null and b/proxy/web/dist/assets/Inter-Italic-VariableFont_opsz_wght.ttf differ
diff --git a/proxy/web/dist/assets/Inter-VariableFont_opsz_wght.ttf b/proxy/web/dist/assets/Inter-VariableFont_opsz_wght.ttf
new file mode 100644
index 000000000..e31b51e3e
Binary files /dev/null and b/proxy/web/dist/assets/Inter-VariableFont_opsz_wght.ttf differ
diff --git a/proxy/web/dist/assets/favicon.ico b/proxy/web/dist/assets/favicon.ico
new file mode 100644
index 000000000..50bb80966
Binary files /dev/null and b/proxy/web/dist/assets/favicon.ico differ
diff --git a/proxy/web/dist/assets/index.js b/proxy/web/dist/assets/index.js
new file mode 100644
index 000000000..9ce3e4394
--- /dev/null
+++ b/proxy/web/dist/assets/index.js
@@ -0,0 +1,9 @@
+(function(){const v=document.createElement("link").relList;if(v&&v.supports&&v.supports("modulepreload"))return;for(const _ of document.querySelectorAll('link[rel="modulepreload"]'))f(_);new MutationObserver(_=>{for(const O of _)if(O.type==="childList")for(const D of O.addedNodes)D.tagName==="LINK"&&D.rel==="modulepreload"&&f(D)}).observe(document,{childList:!0,subtree:!0});function S(_){const O={};return _.integrity&&(O.integrity=_.integrity),_.referrerPolicy&&(O.referrerPolicy=_.referrerPolicy),_.crossOrigin==="use-credentials"?O.credentials="include":_.crossOrigin==="anonymous"?O.credentials="omit":O.credentials="same-origin",O}function f(_){if(_.ep)return;_.ep=!0;const O=S(_);fetch(_.href,O)}})();var Sf={exports:{}},Du={};var Yd;function jm(){if(Yd)return Du;Yd=1;var r=Symbol.for("react.transitional.element"),v=Symbol.for("react.fragment");function S(f,_,O){var D=null;if(O!==void 0&&(D=""+O),_.key!==void 0&&(D=""+_.key),"key"in _){O={};for(var U in _)U!=="key"&&(O[U]=_[U])}else O=_;return _=O.ref,{$$typeof:r,type:f,key:D,ref:_!==void 0?_:null,props:O}}return Du.Fragment=v,Du.jsx=S,Du.jsxs=S,Du}var Gd;function Rm(){return Gd||(Gd=1,Sf.exports=jm()),Sf.exports}var A=Rm(),xf={exports:{}},K={};var Xd;function Hm(){if(Xd)return K;Xd=1;var r=Symbol.for("react.transitional.element"),v=Symbol.for("react.portal"),S=Symbol.for("react.fragment"),f=Symbol.for("react.strict_mode"),_=Symbol.for("react.profiler"),O=Symbol.for("react.consumer"),D=Symbol.for("react.context"),U=Symbol.for("react.forward_ref"),N=Symbol.for("react.suspense"),p=Symbol.for("react.memo"),R=Symbol.for("react.lazy"),H=Symbol.for("react.activity"),V=Symbol.iterator;function st(s){return s===null||typeof s!="object"?null:(s=V&&s[V]||s["@@iterator"],typeof s=="function"?s:null)}var ct={isMounted:function(){return!1},enqueueForceUpdate:function(){},enqueueReplaceState:function(){},enqueueSetState:function(){}},G=Object.assign,Q={};function L(s,M,j){this.props=s,this.context=M,this.refs=Q,this.updater=j||ct}L.prototype.isReactComponent={},L.prototype.setState=function(s,M){if(typeof s!="object"&&typeof s!="function"&&s!=null)throw Error("takes an object of state variables to update or a function which returns an object of state variables.");this.updater.enqueueSetState(this,s,M,"setState")},L.prototype.forceUpdate=function(s){this.updater.enqueueForceUpdate(this,s,"forceUpdate")};function gt(){}gt.prototype=L.prototype;function zt(s,M,j){this.props=s,this.context=M,this.refs=Q,this.updater=j||ct}var _t=zt.prototype=new gt;_t.constructor=zt,G(_t,L.prototype),_t.isPureReactComponent=!0;var it=Array.isArray;function Ot(){}var J={H:null,A:null,T:null,S:null},Rt=Object.prototype.hasOwnProperty;function It(s,M,j){var q=j.ref;return{$$typeof:r,type:s,key:M,ref:q!==void 0?q:null,props:j}}function jl(s,M){return It(s.type,M,s.props)}function Pt(s){return typeof s=="object"&&s!==null&&s.$$typeof===r}function I(s){var M={"=":"=0",":":"=2"};return"$"+s.replace(/[=:]/g,function(j){return M[j]})}var Rl=/\/+/g;function tl(s,M){return typeof s=="object"&&s!==null&&s.key!=null?I(""+s.key):M.toString(36)}function ll(s){switch(s.status){case"fulfilled":return s.value;case"rejected":throw s.reason;default:switch(typeof s.status=="string"?s.then(Ot,Ot):(s.status="pending",s.then(function(M){s.status==="pending"&&(s.status="fulfilled",s.value=M)},function(M){s.status==="pending"&&(s.status="rejected",s.reason=M)})),s.status){case"fulfilled":return s.value;case"rejected":throw s.reason}}throw s}function x(s,M,j,q,k){var P=typeof s;(P==="undefined"||P==="boolean")&&(s=null);var yt=!1;if(s===null)yt=!0;else switch(P){case"bigint":case"string":case"number":yt=!0;break;case"object":switch(s.$$typeof){case r:case v:yt=!0;break;case R:return yt=s._init,x(yt(s._payload),M,j,q,k)}}if(yt)return k=k(s),yt=q===""?"."+tl(s,0):q,it(k)?(j="",yt!=null&&(j=yt.replace(Rl,"$&/")+"/"),x(k,M,j,"",function(qa){return qa})):k!=null&&(Pt(k)&&(k=jl(k,j+(k.key==null||s&&s.key===k.key?"":(""+k.key).replace(Rl,"$&/")+"/")+yt)),M.push(k)),1;yt=0;var Wt=q===""?".":q+":";if(it(s))for(var Ut=0;Ut
+
+
+
+
+
+
+
+
+
+
+
+
+ {error &&
+
+ Error {code}
+
+
+ {/* Title */}
+
+
+ )}
+
+ {/* Buttons */}
+
+
+
+
+
+ {/* Request Info */}
+
+
+
+
+ REQUEST-ID: {requestId}
+
+
+ TIMESTAMP: {timestamp}
+
+
+
+ );
+};
diff --git a/proxy/web/src/components/ConnectionLine.tsx b/proxy/web/src/components/ConnectionLine.tsx
new file mode 100644
index 000000000..39080ff6f
--- /dev/null
+++ b/proxy/web/src/components/ConnectionLine.tsx
@@ -0,0 +1,26 @@
+import { X } from "lucide-react";
+
+interface ConnectionLineProps {
+ success?: boolean;
+}
+
+export function ConnectionLine({ success = true }: Readonly
+
+
+ );
+ }
+
+ return (
+
+
+
+ );
+}
diff --git a/proxy/web/src/components/Description.tsx b/proxy/web/src/components/Description.tsx
new file mode 100644
index 000000000..60e7ce1cc
--- /dev/null
+++ b/proxy/web/src/components/Description.tsx
@@ -0,0 +1,14 @@
+import { cn } from "@/utils/helpers";
+
+type Props = {
+ children: React.ReactNode;
+ className?: string;
+};
+
+export function Description({ children, className }: Readonly
+
+
+
+
+ {children}
+
+ );
+}
\ No newline at end of file
diff --git a/proxy/web/src/components/ErrorMessage.tsx b/proxy/web/src/components/ErrorMessage.tsx
new file mode 100644
index 000000000..67a66c20f
--- /dev/null
+++ b/proxy/web/src/components/ErrorMessage.tsx
@@ -0,0 +1,7 @@
+export const ErrorMessage = ({ error }: { error?: string }) => {
+ return (
+
+ {error}
+
+ );
+};
diff --git a/proxy/web/src/components/GradientFadedBackground.tsx b/proxy/web/src/components/GradientFadedBackground.tsx
new file mode 100644
index 000000000..fc0bdc831
--- /dev/null
+++ b/proxy/web/src/components/GradientFadedBackground.tsx
@@ -0,0 +1,22 @@
+import { cn } from "@/utils/helpers";
+
+type Props = {
+ className?: string;
+};
+
+export const GradientFadedBackground = ({ className }: Props) => {
+ return (
+
+
+
+ );
+};
diff --git a/proxy/web/src/components/HelpText.tsx b/proxy/web/src/components/HelpText.tsx
new file mode 100644
index 000000000..ce71bfa6d
--- /dev/null
+++ b/proxy/web/src/components/HelpText.tsx
@@ -0,0 +1,19 @@
+import { cn } from "@/utils/helpers";
+
+interface HelpTextProps {
+ children?: React.ReactNode;
+ className?: string;
+}
+
+export default function HelpText({ children, className }: Readonly
+ {customPrefix && (
+
+ {error && (
+
+ {customPrefix}
+
+ )}
+
+
+ {icon}
+
+
+
+
+
+ {suffix}
+
+ {error}
+ )} + + ); + } +); + +Input.displayName = "Input"; + +export { Input }; diff --git a/proxy/web/src/components/Label.tsx b/proxy/web/src/components/Label.tsx new file mode 100644 index 000000000..09e122f8e --- /dev/null +++ b/proxy/web/src/components/Label.tsx @@ -0,0 +1,19 @@ +import { cn } from "@/utils/helpers"; + +type LabelProps = React.LabelHTMLAttributes
+ {digits.map((digit, index) => (
+ {
+ inputRefs.current[index] = el;
+ }}
+ type="text"
+ inputMode="numeric"
+ maxLength={1}
+ value={digit}
+ onChange={(e) => handleChange(index, e.target.value)}
+ onKeyDown={(e) => handleKeyDown(index, e)}
+ onPaste={handlePaste}
+ onFocus={handleFocus}
+ disabled={disabled}
+ autoFocus={autoFocus && index === 0}
+ className={cn(
+ "flex-1 min-w-0 h-[42px] text-center text-sm rounded-md",
+ "dark:bg-nb-gray-900 border dark:border-nb-gray-700",
+ "dark:placeholder:text-neutral-400/70",
+ "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2",
+ "ring-offset-neutral-200/20 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
+ "disabled:cursor-not-allowed disabled:opacity-40"
+ )}
+ />
+ ))}
+
+ );
+});
+
+export default PinCodeInput;
diff --git a/proxy/web/src/components/PoweredByNetBird.tsx b/proxy/web/src/components/PoweredByNetBird.tsx
new file mode 100644
index 000000000..555d8a79f
--- /dev/null
+++ b/proxy/web/src/components/PoweredByNetBird.tsx
@@ -0,0 +1,17 @@
+import { NetBirdLogo } from "./NetBirdLogo";
+
+export function PoweredByNetBird() {
+ return (
+
+
+ Powered by
+
+
+ {typeof children === "function"
+ ? children({ value: currentValue, onChange: handleChange })
+ : children}
+
+
+ {children}
+
+ );
+}
+
+function Trigger({
+ children,
+ value,
+ disabled = false,
+ className,
+ selected,
+ onClick,
+}: Readonly<{
+ children: React.ReactNode;
+ value: string;
+ disabled?: boolean;
+ className?: string;
+ selected?: boolean;
+ onClick?: () => void;
+}>) {
+ const context = useTabContext();
+ const isSelected = selected ?? value === context.value;
+
+ let stateClassName = "";
+ if (isSelected) {
+ stateClassName = "bg-nb-gray-900 text-white";
+ } else if (!disabled) {
+ stateClassName = "text-nb-gray-400 hover:bg-nb-gray-900/50";
+ }
+
+ const handleClick = () => {
+ context.onChange(value);
+ onClick?.();
+ };
+
+ return (
+
+ );
+}
+
+function Content({
+ children,
+ value,
+ className,
+ visible,
+}: Readonly<{
+ children: React.ReactNode;
+ value: string;
+ className?: string;
+ visible?: boolean;
+}>) {
+ const context = useTabContext();
+ const isVisible = visible ?? value === context.value;
+
+ if (!isVisible) return null;
+
+ return (
+
+ {children}
+
+ );
+}
+
+SegmentedTabs.List = List;
+SegmentedTabs.Trigger = Trigger;
+SegmentedTabs.Content = Content;
+
+export { SegmentedTabs };
diff --git a/proxy/web/src/components/Separator.tsx b/proxy/web/src/components/Separator.tsx
new file mode 100644
index 000000000..877c605cd
--- /dev/null
+++ b/proxy/web/src/components/Separator.tsx
@@ -0,0 +1,10 @@
+export const Separator = () => {
+ return (
+
+
+ OR
+
+
+
+ );
+};
diff --git a/proxy/web/src/components/StatusCard.tsx b/proxy/web/src/components/StatusCard.tsx
new file mode 100644
index 000000000..44ed957ee
--- /dev/null
+++ b/proxy/web/src/components/StatusCard.tsx
@@ -0,0 +1,38 @@
+import type { LucideIcon } from "lucide-react";
+import { ConnectionLine } from "./ConnectionLine";
+
+interface StatusCardProps {
+ icon: LucideIcon;
+ label: string;
+ detail?: string;
+ success?: boolean;
+ line?: boolean;
+}
+
+export function StatusCard({
+ icon: Icon,
+ label,
+ detail,
+ success = true,
+ line = true,
+}: Readonly
+
+
+ );
+}
diff --git a/proxy/web/src/components/TabContext.tsx b/proxy/web/src/components/TabContext.tsx
new file mode 100644
index 000000000..5a606ed49
--- /dev/null
+++ b/proxy/web/src/components/TabContext.tsx
@@ -0,0 +1,13 @@
+import { createContext, useContext } from "react";
+
+type TabContextValue = {
+ value: string;
+ onChange: (value: string) => void;
+};
+
+export const TabContext = createContext
+
+ {label}
+
+ {success ? "Connected" : "Unreachable"}
+
+ {detail && (
+
+ {detail}
+
+ )}
+