From 912a430f6a2b66b8adaae53cfda35ef7d38339bb Mon Sep 17 00:00:00 2001
From: Viktor Liu <viktor@netbird.io>
Date: Sun, 15 Feb 2026 10:47:52 +0100
Subject: [PATCH] Add proxy protocol

---
 charts/netbird-proxy/templates/NOTES.txt       | 12 ++++++++++++
 charts/netbird-proxy/templates/deployment.yaml |  4 ++++
 charts/netbird-proxy/values.yaml               |  4 ++++
 3 files changed, 20 insertions(+)

diff --git a/charts/netbird-proxy/templates/NOTES.txt b/charts/netbird-proxy/templates/NOTES.txt
index deb67fe..aac9033 100644
--- a/charts/netbird-proxy/templates/NOTES.txt
+++ b/charts/netbird-proxy/templates/NOTES.txt
@@ -30,3 +30,15 @@ ACME certificate management is enabled ({{ .Values.acme.directory }}).
 Certificates are stored in {{ .Values.certDir }}.
 Lock method: {{ .Values.acme.certLockMethod }}
 {{- end }}
+
+{{- if .Values.proxy.proxyProtocol }}
+
+PROXY protocol is enabled. Ensure your L4 load balancer sends
+PROXY protocol v1 or v2 headers.
+{{- if .Values.proxy.trustedProxies }}
+Trusted sources: {{ .Values.proxy.trustedProxies }}
+{{- else }}
+WARNING: No trustedProxies set. Any source can send PROXY headers.
+Set proxy.trustedProxies to your load balancer's CIDR for security.
+{{- end }}
+{{- end }}
diff --git a/charts/netbird-proxy/templates/deployment.yaml b/charts/netbird-proxy/templates/deployment.yaml
index b293cd9..205326d 100644
--- a/charts/netbird-proxy/templates/deployment.yaml
+++ b/charts/netbird-proxy/templates/deployment.yaml
@@ -107,6 +107,10 @@ spec:
             - name: NB_PROXY_TRUSTED_PROXIES
               value: {{ .Values.proxy.trustedProxies | quote }}
             {{- end }}
+            {{- if .Values.proxy.proxyProtocol }}
+            - name: NB_PROXY_PROXY_PROTOCOL
+              value: "true"
+            {{- end }}
             {{- if .Values.acme.enabled }}
             - name: NB_PROXY_ACME_CERTIFICATES
               value: "true"
diff --git a/charts/netbird-proxy/values.yaml b/charts/netbird-proxy/values.yaml
index 63b7b69..dfa5b3b 100644
--- a/charts/netbird-proxy/values.yaml
+++ b/charts/netbird-proxy/values.yaml
@@ -32,6 +32,10 @@ proxy:
   forwardedProto: "auto"
   # -- Comma-separated CIDR ranges of trusted upstream proxies.
   trustedProxies: ""
+  # -- Enable PROXY protocol (v1/v2) on TCP listeners.
+  # Required when behind L4 proxies that support PROXY protocol.
+  # that use PROXY protocol to forward real client IPs.
+  proxyProtocol: false
 
 wireguard:
   # -- Enable WireGuard UDP port exposure for P2P connectivity.