Add proxy protocol

charts/netbird-proxy/templates/NOTES.txt

@@ -30,3 +30,15 @@ ACME certificate management is enabled ({{ .Values.acme.directory }}).
 Certificates are stored in {{ .Values.certDir }}.
 Lock method: {{ .Values.acme.certLockMethod }}
 {{- end }}
+
+{{- if .Values.proxy.proxyProtocol }}
+
+PROXY protocol is enabled. Ensure your L4 load balancer sends
+PROXY protocol v1 or v2 headers.
+{{- if .Values.proxy.trustedProxies }}
+Trusted sources: {{ .Values.proxy.trustedProxies }}
+{{- else }}
+WARNING: No trustedProxies set. Any source can send PROXY headers.
+Set proxy.trustedProxies to your load balancer's CIDR for security.
+{{- end }}
+{{- end }}

charts/netbird-proxy/templates/deployment.yaml

@@ -107,6 +107,10 @@ spec:
             - name: NB_PROXY_TRUSTED_PROXIES
               value: {{ .Values.proxy.trustedProxies | quote }}
             {{- end }}
+            {{- if .Values.proxy.proxyProtocol }}
+            - name: NB_PROXY_PROXY_PROTOCOL
+              value: "true"
+            {{- end }}
             {{- if .Values.acme.enabled }}
             - name: NB_PROXY_ACME_CERTIFICATES
               value: "true"

charts/netbird-proxy/values.yaml

@@ -32,6 +32,10 @@ proxy:
   forwardedProto: "auto"
   # -- Comma-separated CIDR ranges of trusted upstream proxies.
   trustedProxies: ""
+  # -- Enable PROXY protocol (v1/v2) on TCP listeners.
+  # Required when behind L4 proxies that support PROXY protocol.
+  # that use PROXY protocol to forward real client IPs.
+  proxyProtocol: false
 
 wireguard:
   # -- Enable WireGuard UDP port exposure for P2P connectivity.