Maycon Santos 3c4358dd36 [management] Require a private proxy cluster for cluster and direct upstream targets (#7984) ...

* [management] Require a private proxy cluster for cluster and direct upstream targets

Cluster targets and direct upstream targets make the proxy dial the
upstream from its own host network instead of through the embedded
NetBird client. Only clusters running in private mode are meant to do
that, but the service API accepted these targets on any cluster.

Service create and update now reject such targets unless the service's
proxy cluster reports the private capability. An unreported capability
is treated as unsupported.

* [management] Require every proxy in the cluster to be private

The private capability is aggregated as any-true, so a cluster where
only one proxy runs in private mode passed the check. The mapping is
delivered to every proxy in the cluster, so the non-private ones would
serve cluster and direct upstream targets from their host network too.

Validate these targets against a unanimous aggregation instead. The
existing any-true lookup stays as is for the dashboard flags and the
agent network gateway.

2026-10-02 19:03:00 +02:00

..

agentnetwork

[management] Clean up after account deletion (#7812)

2026-09-30 18:25:38 +02:00

peers

[management] expose peer MAC addresses and make peers searchable by MAC (#6553)

2026-10-02 15:00:26 +02:00

reverseproxy

[management] Require a private proxy cluster for cluster and direct upstream targets (#7984)

2026-10-02 19:03:00 +02:00

zones

[client, management] switch to go.uber.org/mock (#7253)

2026-08-20 11:53:19 +02:00