Maycon Santos
57722d3235
Verify access decisions through real management and proxy containers, including upstream delivery and denial. Cover inherited auth, bypass/block, precedence, credential stripping, updates, restrictions, deletion, and private-service rejection. Validation: container E2E and scoped lint passed locally. The workflow builds both components from the checkout.
Reverse-proxy access E2E tests
These tests run a real combined management server, reverse proxy, and HTTP upstream in isolated Docker containers. Services are configured through the management API, then requests go through the proxy's HTTPS listener. No external identity provider, public DNS record, or API credential is needed.
Run from the repository root with Docker and Go available:
go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
The harness builds the combined server and proxy from the current checkout. To test existing images, pass full image references:
NB_E2E_COMBINED_IMAGE=local/netbird-combined:target-access \
NB_E2E_PROXY_IMAGE=local/netbird-proxy:target-access \
go test -tags e2e -timeout 25m -v ./e2e/reverseproxy/...
Rebuild locally tagged images after backend changes. Both components must support target access actions; using an older management image does not test the feature.
The suite checks inherited service authentication, anonymous bypass, blocked paths, longest-prefix precedence, credential stripping, live action updates, service restrictions, deletion, and private-service bypass rejection. Upstream request markers distinguish successful forwarding from proxy-generated responses and verify that denied requests never reach the backend.
The Reverse Proxy E2E workflow runs this package for relevant pull requests
and manual dispatches. It also remains part of the nightly ./e2e/... suite.
Dashboard browser coverage lives in the dashboard repository: it creates and
edits services through the UI, then probes their real proxy behavior.