mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-10 03:55:25 -04:00
fa1665fc3d
A self-addressed agent-network pin means the account's gateway proxy serves exactly the gateway, so its address is dropped from the account's reverse-proxy cluster allow list -- and because the free-domain suffix match is depth-independent, dropping the address rejects every name beneath it as well as the bare one. This closes the path where a tenant could create ordinary services under their own gateway hostname and have them delivered to single-purpose gateway infrastructure. The exclusion is derived from the account's own settings row: the allow list only ever contains the account's own BYOP addresses plus the shared public ones, so the account's own gateway address is the only one that ever needs excluding, and the store already records the fact. No config, no schema change -- a labeled pin reserves nothing, and a self-hosted deployment running a dedicated gateway gets the same invariant. A settings-lookup outage fails closed (error, not an empty reservation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>