Add wg port

charts/netbird-proxy/templates/deployment.yaml

@@ -64,6 +64,11 @@ spec:
               containerPort: {{ include "netbird-proxy.port" .Values.debug.address | default 8444 }}
               protocol: TCP
             {{- end }}
+            {{- if .Values.wireguard.enabled }}
+            - name: wireguard
+              containerPort: {{ .Values.wireguard.port }}
+              protocol: UDP
+            {{- end }}
           env:
             - name: USER
               value: "netbird"
@@ -136,6 +141,10 @@ spec:
             - name: NB_PROXY_OIDC_SCOPES
               value: {{ .Values.oidc.scopes | quote }}
             {{- end }}
+            {{- if .Values.wireguard.enabled }}
+            - name: NB_PROXY_WG_PORT
+              value: {{ .Values.wireguard.port | quote }}
+            {{- end }}
             {{- if .Values.debug.enabled }}
             - name: NB_PROXY_DEBUG_ENDPOINT
               value: "true"

charts/netbird-proxy/templates/networkpolicy.yaml

@@ -25,6 +25,10 @@ spec:
         - port: debug
           protocol: TCP
         {{- end }}
+        {{- if .Values.wireguard.enabled }}
+        - port: wireguard
+          protocol: UDP
+        {{- end }}
     {{- with .Values.networkPolicy.additionalIngress }}
     {{- toYaml . | nindent 4 }}
     {{- end }}

charts/netbird-proxy/templates/service.yaml

@@ -43,3 +43,9 @@ spec:
       targetPort: debug
       protocol: TCP
     {{- end }}
+    {{- if .Values.wireguard.enabled }}
+    - name: wireguard
+      port: {{ .Values.wireguard.port }}
+      targetPort: wireguard
+      protocol: UDP
+    {{- end }}

charts/netbird-proxy/values.yaml

@@ -33,6 +33,14 @@ proxy:
   # -- Comma-separated CIDR ranges of trusted upstream proxies.
   trustedProxies: ""
 
+wireguard:
+  # -- Enable WireGuard UDP port exposure for P2P connectivity.
+  # Only works with single-account deployments; multiple accounts
+  # will fail to bind the same port.
+  enabled: false
+  # -- Fixed WireGuard port. Set to 0 for random OS-assigned port.
+  port: 51820
+
 acme:
   # -- Enable ACME certificate generation.
   enabled: true