From 83d7eddb98d29aaaeaf07a2a94642edc0f106463 Mon Sep 17 00:00:00 2001
From: Viktor Liu <viktor@netbird.io>
Date: Tue, 10 Feb 2026 19:56:59 +0800
Subject: [PATCH] Add wg port

---
 charts/netbird-proxy/templates/deployment.yaml    | 9 +++++++++
 charts/netbird-proxy/templates/networkpolicy.yaml | 4 ++++
 charts/netbird-proxy/templates/service.yaml       | 6 ++++++
 charts/netbird-proxy/values.yaml                  | 8 ++++++++
 4 files changed, 27 insertions(+)

diff --git a/charts/netbird-proxy/templates/deployment.yaml b/charts/netbird-proxy/templates/deployment.yaml
index 344ce28..4a98e05 100644
--- a/charts/netbird-proxy/templates/deployment.yaml
+++ b/charts/netbird-proxy/templates/deployment.yaml
@@ -64,6 +64,11 @@ spec:
               containerPort: {{ include "netbird-proxy.port" .Values.debug.address | default 8444 }}
               protocol: TCP
             {{- end }}
+            {{- if .Values.wireguard.enabled }}
+            - name: wireguard
+              containerPort: {{ .Values.wireguard.port }}
+              protocol: UDP
+            {{- end }}
           env:
             - name: USER
               value: "netbird"
@@ -136,6 +141,10 @@ spec:
             - name: NB_PROXY_OIDC_SCOPES
               value: {{ .Values.oidc.scopes | quote }}
             {{- end }}
+            {{- if .Values.wireguard.enabled }}
+            - name: NB_PROXY_WG_PORT
+              value: {{ .Values.wireguard.port | quote }}
+            {{- end }}
             {{- if .Values.debug.enabled }}
             - name: NB_PROXY_DEBUG_ENDPOINT
               value: "true"
diff --git a/charts/netbird-proxy/templates/networkpolicy.yaml b/charts/netbird-proxy/templates/networkpolicy.yaml
index 48eb5c3..4c9ea34 100644
--- a/charts/netbird-proxy/templates/networkpolicy.yaml
+++ b/charts/netbird-proxy/templates/networkpolicy.yaml
@@ -25,6 +25,10 @@ spec:
         - port: debug
           protocol: TCP
         {{- end }}
+        {{- if .Values.wireguard.enabled }}
+        - port: wireguard
+          protocol: UDP
+        {{- end }}
     {{- with .Values.networkPolicy.additionalIngress }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
diff --git a/charts/netbird-proxy/templates/service.yaml b/charts/netbird-proxy/templates/service.yaml
index d4ac814..9a1b808 100644
--- a/charts/netbird-proxy/templates/service.yaml
+++ b/charts/netbird-proxy/templates/service.yaml
@@ -43,3 +43,9 @@ spec:
       targetPort: debug
       protocol: TCP
     {{- end }}
+    {{- if .Values.wireguard.enabled }}
+    - name: wireguard
+      port: {{ .Values.wireguard.port }}
+      targetPort: wireguard
+      protocol: UDP
+    {{- end }}
diff --git a/charts/netbird-proxy/values.yaml b/charts/netbird-proxy/values.yaml
index 8d7a1e9..c97c0fa 100644
--- a/charts/netbird-proxy/values.yaml
+++ b/charts/netbird-proxy/values.yaml
@@ -33,6 +33,14 @@ proxy:
   # -- Comma-separated CIDR ranges of trusted upstream proxies.
   trustedProxies: ""
 
+wireguard:
+  # -- Enable WireGuard UDP port exposure for P2P connectivity.
+  # Only works with single-account deployments; multiple accounts
+  # will fail to bind the same port.
+  enabled: false
+  # -- Fixed WireGuard port. Set to 0 for random OS-assigned port.
+  port: 51820
+
 acme:
   # -- Enable ACME certificate generation.
   enabled: true