getting started changes for l4 proxy

client/cmd/service_test.go

@@ -4,9 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"os/signal"
 	"runtime"
-	"syscall"
 	"testing"
 	"time"
 
@@ -15,22 +13,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// TestMain intercepts when this test binary is run as a daemon subprocess.
-// On FreeBSD, the rc.d service script runs the binary via daemon(8) -r with
-// "service run ..." arguments. Since the test binary can't handle cobra CLI
-// args, it exits immediately, causing daemon -r to respawn rapidly until
-// hitting the rate limit and exiting. This makes service restart unreliable.
-// Blocking here keeps the subprocess alive until the init system sends SIGTERM.
-func TestMain(m *testing.M) {
-	if len(os.Args) > 2 && os.Args[1] == "service" && os.Args[2] == "run" {
-		sig := make(chan os.Signal, 1)
-		signal.Notify(sig, syscall.SIGTERM, os.Interrupt)
-		<-sig
-		return
-	}
-	os.Exit(m.Run())
-}
-
 const (
 	serviceStartTimeout = 10 * time.Second
 	serviceStopTimeout  = 5 * time.Second
@@ -97,34 +79,6 @@ func TestServiceLifecycle(t *testing.T) {
 	logLevel = "info"
 	daemonAddr = fmt.Sprintf("unix://%s/netbird-test.sock", tempDir)
 
-	// Ensure cleanup even if a subtest fails and Stop/Uninstall subtests don't run.
-	t.Cleanup(func() {
-		cfg, err := newSVCConfig()
-		if err != nil {
-			t.Errorf("cleanup: create service config: %v", err)
-			return
-		}
-		ctxSvc, cancel := context.WithCancel(context.Background())
-		defer cancel()
-		s, err := newSVC(newProgram(ctxSvc, cancel), cfg)
-		if err != nil {
-			t.Errorf("cleanup: create service: %v", err)
-			return
-		}
-
-		// If the subtests already cleaned up, there's nothing to do.
-		if _, err := s.Status(); err != nil {
-			return
-		}
-
-		if err := s.Stop(); err != nil {
-			t.Errorf("cleanup: stop service: %v", err)
-		}
-		if err := s.Uninstall(); err != nil {
-			t.Errorf("cleanup: uninstall service: %v", err)
-		}
-	})
-
 	ctx := context.Background()
 
 	t.Run("Install", func(t *testing.T) {

infrastructure_files/getting-started.sh

@@ -532,13 +532,14 @@ render_docker_compose_traefik_builtin() {
     traefik_dynamic_volume="      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
     proxy_service="
   # NetBird Proxy - exposes internal resources to the internet
+  # Uses host network so it can listen on arbitrary ports for TCP/UDP services
   proxy:
     image: $NETBIRD_PROXY_IMAGE
     container_name: netbird-proxy
     ports:
     - 51820:51820/udp
     restart: unless-stopped
-    networks: [netbird]
+    network_mode: host
     depends_on:
       - netbird-server
     env_file:
@@ -646,6 +647,7 @@ $traefik_dynamic_volume
     networks: [netbird]
     ports:
       - '$NETBIRD_STUN_PORT:$NETBIRD_STUN_PORT/udp'
+$(if [[ "$ENABLE_PROXY" == "true" ]]; then echo "      - '$MANAGEMENT_HOST_PORT:80'"; fi)
     volumes:
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
@@ -766,8 +768,8 @@ render_proxy_env() {
   cat <<EOF
 # NetBird Proxy Configuration
 NB_PROXY_DEBUG_LOGS=false
-# Use internal Docker network to connect to management (avoids hairpin NAT issues)
-NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
+# Proxy runs in host network mode for L4 port binding, connect to management via localhost
+NB_PROXY_MANAGEMENT_ADDRESS=http://localhost:$MANAGEMENT_HOST_PORT
 # Allow insecure gRPC connection to management (required for internal Docker network)
 NB_PROXY_ALLOW_INSECURE=true
 # Public URL where this proxy is reachable (used for cluster registration)

management/server/types/networkmap_benchmark_test.go

@@ -1,217 +0,0 @@
-package types_test
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"testing"
-
-	nbdns "github.com/netbirdio/netbird/dns"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-type benchmarkScale struct {
-	name   string
-	peers  int
-	groups int
-}
-
-var defaultScales = []benchmarkScale{
-	{"100peers_5groups", 100, 5},
-	{"500peers_20groups", 500, 20},
-	{"1000peers_50groups", 1000, 50},
-	{"5000peers_100groups", 5000, 100},
-	{"10000peers_200groups", 10000, 200},
-	{"20000peers_200groups", 20000, 200},
-	{"30000peers_300groups", 30000, 300},
-}
-
-func skipCIBenchmark(b *testing.B) {
-	if os.Getenv("CI") == "true" {
-		b.Skip("Skipping benchmark in CI")
-	}
-}
-
-// ──────────────────────────────────────────────────────────────────────────────
-// Single Peer Network Map Generation
-// ──────────────────────────────────────────────────────────────────────────────
-
-// BenchmarkNetworkMapGeneration_Components benchmarks the components-based approach for a single peer.
-func BenchmarkNetworkMapGeneration_Components(b *testing.B) {
-	skipCIBenchmark(b)
-	for _, scale := range defaultScales {
-		b.Run(scale.name, func(b *testing.B) {
-			account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
-			ctx := context.Background()
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetPeerNetworkMapFromComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
-			}
-		})
-	}
-}
-
-// ──────────────────────────────────────────────────────────────────────────────
-// All Peers (UpdateAccountPeers hot path)
-// ──────────────────────────────────────────────────────────────────────────────
-
-// BenchmarkNetworkMapGeneration_AllPeers benchmarks generating network maps for ALL peers.
-func BenchmarkNetworkMapGeneration_AllPeers(b *testing.B) {
-	skipCIBenchmark(b)
-	scales := []benchmarkScale{
-		{"100peers_5groups", 100, 5},
-		{"500peers_20groups", 500, 20},
-		{"1000peers_50groups", 1000, 50},
-		{"5000peers_100groups", 5000, 100},
-	}
-
-	for _, scale := range scales {
-		account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
-		ctx := context.Background()
-
-		peerIDs := make([]string, 0, len(account.Peers))
-		for peerID := range account.Peers {
-			peerIDs = append(peerIDs, peerID)
-		}
-
-		b.Run("components/"+scale.name, func(b *testing.B) {
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				for _, peerID := range peerIDs {
-					_ = account.GetPeerNetworkMapFromComponents(ctx, peerID, nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
-				}
-			}
-		})
-	}
-}
-
-// ──────────────────────────────────────────────────────────────────────────────
-// Sub-operations
-// ──────────────────────────────────────────────────────────────────────────────
-
-// BenchmarkNetworkMapGeneration_ComponentsCreation benchmarks components extraction.
-func BenchmarkNetworkMapGeneration_ComponentsCreation(b *testing.B) {
-	skipCIBenchmark(b)
-	for _, scale := range defaultScales {
-		b.Run(scale.name, func(b *testing.B) {
-			account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
-			ctx := context.Background()
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetPeerNetworkMapComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, groupIDToUserIDs)
-			}
-		})
-	}
-}
-
-// BenchmarkNetworkMapGeneration_ComponentsCalculation benchmarks calculation from pre-built components.
-func BenchmarkNetworkMapGeneration_ComponentsCalculation(b *testing.B) {
-	skipCIBenchmark(b)
-	for _, scale := range defaultScales {
-		b.Run(scale.name, func(b *testing.B) {
-			account, validatedPeers := scalableTestAccount(scale.peers, scale.groups)
-			ctx := context.Background()
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-			components := account.GetPeerNetworkMapComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, groupIDToUserIDs)
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = types.CalculateNetworkMapFromComponents(ctx, components)
-			}
-		})
-	}
-}
-
-// BenchmarkNetworkMapGeneration_PrecomputeMaps benchmarks precomputed map costs.
-func BenchmarkNetworkMapGeneration_PrecomputeMaps(b *testing.B) {
-	skipCIBenchmark(b)
-	for _, scale := range defaultScales {
-		b.Run("ResourcePoliciesMap/"+scale.name, func(b *testing.B) {
-			account, _ := scalableTestAccount(scale.peers, scale.groups)
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetResourcePoliciesMap()
-			}
-		})
-		b.Run("ResourceRoutersMap/"+scale.name, func(b *testing.B) {
-			account, _ := scalableTestAccount(scale.peers, scale.groups)
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetResourceRoutersMap()
-			}
-		})
-		b.Run("ActiveGroupUsers/"+scale.name, func(b *testing.B) {
-			account, _ := scalableTestAccount(scale.peers, scale.groups)
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetActiveGroupUsers()
-			}
-		})
-	}
-}
-
-// ──────────────────────────────────────────────────────────────────────────────
-// Scaling Analysis
-// ──────────────────────────────────────────────────────────────────────────────
-
-// BenchmarkNetworkMapGeneration_GroupScaling tests group count impact on performance.
-func BenchmarkNetworkMapGeneration_GroupScaling(b *testing.B) {
-	skipCIBenchmark(b)
-	groupCounts := []int{1, 5, 20, 50, 100, 200, 500}
-	for _, numGroups := range groupCounts {
-		b.Run(fmt.Sprintf("components_%dgroups", numGroups), func(b *testing.B) {
-			account, validatedPeers := scalableTestAccount(1000, numGroups)
-			ctx := context.Background()
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetPeerNetworkMapFromComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
-			}
-		})
-	}
-}
-
-// BenchmarkNetworkMapGeneration_PeerScaling tests peer count impact on performance.
-func BenchmarkNetworkMapGeneration_PeerScaling(b *testing.B) {
-	skipCIBenchmark(b)
-	peerCounts := []int{50, 100, 500, 1000, 2000, 5000, 10000, 20000, 30000}
-	for _, numPeers := range peerCounts {
-		numGroups := numPeers / 20
-		if numGroups < 1 {
-			numGroups = 1
-		}
-		b.Run(fmt.Sprintf("components_%dpeers", numPeers), func(b *testing.B) {
-			account, validatedPeers := scalableTestAccount(numPeers, numGroups)
-			ctx := context.Background()
-			resourcePolicies := account.GetResourcePoliciesMap()
-			routers := account.GetResourceRoutersMap()
-			groupIDToUserIDs := account.GetActiveGroupUsers()
-			b.ReportAllocs()
-			b.ResetTimer()
-			for range b.N {
-				_ = account.GetPeerNetworkMapFromComponents(ctx, "peer-0", nbdns.CustomZone{}, nil, validatedPeers, resourcePolicies, routers, nil, groupIDToUserIDs)
-			}
-		})
-	}
-}