mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-12 17:59:06 +02:00
Claude
083906b84d
The agent network gateway service is synthesised as private: agents reach it over the WireGuard tunnel and are authorised by ValidateTunnelPeer against the enabled policies' source groups, and its only target is the cluster itself with DirectUpstream. Only a proxy running embedded in a netbird client can serve that, which management already reports per cluster as the `private` capability. CreateSettings accepted any hostname as proxy_address, so a labeled bootstrap could pin the account to a cluster that cannot serve its gateway — another account's BYOP cluster, or one whose proxies are all centralised. The endpoint assigned at bootstrap is immutable, so the account is then stuck with a dead gateway until someone deletes and re-bootstraps the settings row. Validate the cluster before allocating an endpoint beneath it: a cluster whose live proxies have reported their capabilities must be one the account may route through and must be private-capable. A cluster nothing is connected to is left alone, so claiming an address ahead of the proxy's first connection keeps working — the same address-first order the dedicated (self-addressed) path documents, and the one the e2e suite and self-hosted setups follow. The e2e coverage drives the real thing: one combined server and two proxies in the same cluster — a centralised one that makes the cluster live but unusable, then an embedded one that makes it usable — so both the refusal and the acceptance are exercised against the same account and cluster address, with the domains endpoint (the list the dashboard picks from) as the barrier between starting a proxy and asserting on it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>