mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-13 17:09:07 +02:00
Maycon Santos
57722d3235
Verify access decisions through real management and proxy containers, including upstream delivery and denial. Cover inherited auth, bypass/block, precedence, credential stripping, updates, restrictions, deletion, and private-service rejection. Validation: container E2E and scoped lint passed locally. The workflow builds both components from the checkout.
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# Reverse-proxy access E2E tests
|
|
|
|
These tests run a real combined management server, reverse proxy, and HTTP
|
|
upstream in isolated Docker containers. Services are configured through the
|
|
management API, then requests go through the proxy's HTTPS listener. No external
|
|
identity provider, public DNS record, or API credential is needed.
|
|
|
|
Run from the repository root with Docker and Go available:
|
|
|
|
```bash
|
|
go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
|
|
```
|
|
|
|
The harness builds the combined server and proxy from the current checkout.
|
|
To test existing images, pass full image references:
|
|
|
|
```bash
|
|
NB_E2E_COMBINED_IMAGE=local/netbird-combined:target-access \
|
|
NB_E2E_PROXY_IMAGE=local/netbird-proxy:target-access \
|
|
go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
|
|
```
|
|
|
|
Rebuild locally tagged images after backend changes. Both components must
|
|
support target access actions; using an older management image does not test
|
|
the feature.
|
|
|
|
The suite checks inherited service authentication, anonymous bypass, blocked
|
|
paths, longest-prefix precedence, credential stripping, live action updates,
|
|
service restrictions, deletion, and private-service bypass rejection. Upstream
|
|
request markers distinguish successful forwarding from proxy-generated
|
|
responses and verify that denied requests never reach the backend.
|
|
|
|
The `Reverse Proxy E2E` workflow runs this package for relevant pull requests
|
|
and manual dispatches. It also remains part of the nightly `./e2e/...` suite.
|
|
Dashboard browser coverage lives in the dashboard repository: it creates and
|
|
edits services through the UI, then probes their real proxy behavior.
|