values.yaml

# -- Provide a name in place of `netbird-reverse-proxy`
nameOverride: ""

# -- String to fully override `"netbird-reverse-proxy.fullname"`
fullnameOverride: ""

image:
  # -- image registry
  registry: docker.io
  # -- image repository
  repository: netbirdio/reverse-proxy
  # -- image pull policy
  pullPolicy: Always
  # -- Overrides the image tag whose default is the chart appVersion.
  tag: ""

# -- If defined, uses a Secret to pull an image from a private Docker registry or repository.
imagePullSecrets: []

# -- Number of replicas.
# Note: When using built-in ACME certificates (proxy.tls.source=acme), running more than one
# replica is not recommended as certificate state is not shared between pods.
replicaCount: 1

# -- The number of old ReplicaSets to retain
revisionHistoryLimit: 10

serviceAccount:
  # -- Specifies whether a service account should be created
  create: true
  # -- Annotations to add to the service account
  annotations: {}
  # -- The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

rbac:
  # -- Specifies whether a Role/RoleBinding should be created for proxy.tls.certLockMethod=k8s-lease
  # coordination (only rendered when proxy.tls.source=acme and proxy.tls.certLockMethod is "auto" or
  # "k8s-lease" - "auto" resolves to "k8s-lease" automatically inside Kubernetes, so this applies to
  # the default too). Without it, the proxy can't create/update the Lease it uses to coordinate
  # certificate issuance, and ACME certificate acquisition will silently never complete. Disable
  # this if you manage this RBAC yourself.
  create: true

# -- Annotations to be added to the pods
podAnnotations: {}

# -- pod-level security context
# @default -- see [values.yaml](./values.yaml)
podSecurityContext:
  seccompProfile:
    type: RuntimeDefault

# -- container-level security context.
# The image's default user is the non-numeric "netbird" user (uid 1000, gid 1000) - runAsUser/
# runAsGroup must be set explicitly to numeric values, otherwise the kubelet cannot verify
# runAsNonRoot against a non-numeric image user and refuses to start the container.
# No capabilities need to be added by default: proxy.address defaults to the non-privileged
# ":8443", so the container never binds a port below 1024 itself. If you set proxy.address to a
# privileged port, enable proxy.private, or otherwise need port 80/443 bound directly inside the
# container, add the NET_BIND_SERVICE capability here yourself.
# @default -- see [values.yaml](./values.yaml)
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000

service:
  # -- Kubernetes service type. LoadBalancer exposes the proxy directly with its own external IP;
  # since a Service always operates at L4, TLS is never terminated by the Service and passes
  # through to the proxy untouched. Combine with external-dns (see service.annotations) to
  # automatically publish a DNS record for the assigned IP.
  type: LoadBalancer
  # -- Additional annotations for the Service resource. For example, to let external-dns manage
  # a DNS record pointing at this Service's LoadBalancer IP:
  # external-dns.alpha.kubernetes.io/hostname: my-proxy.example.com
  annotations: {}
  http:
    # -- Kubernetes service port for HTTP traffic. The chart only creates this Service port (and
    # the matching container port) when it's actually needed: proxy.private=true (per-account
    # :80/:443 listeners) or proxy.tls.source=acme with proxy.tls.acme.challengeType=http-01.
    # In every other configuration, nothing listens on port 80 at all, so it's omitted entirely.
    port: 80
  https:
    # -- Kubernetes service port for HTTPS traffic. Always forwards to the container port derived
    # from proxy.address (see there), regardless of this external port number.
    port: 443

autoscaling:
  # -- Enable Horizontal POD autoscaling.
  # Note: Not recommended when using built-in ACME certificates (proxy.tls.source=acme) as
  # certificate state is not shared between pods.
  enabled: false
  # -- Minimum number of replicas
  minReplicas: 1
  # -- Maximum number of replicas
  maxReplicas: 100
  # -- Target CPU utilization percentage
  targetCPUUtilizationPercentage: 80
  # -- Target Memory utilization percentage
  # targetMemoryUtilizationPercentage: 80

livenessProbe:
  # -- HTTP path for livenessProbe, queried against proxy.health.address. Defaults to a pure
  # process check, independent of the management server connection - see proxy.health in
  # README.md for the other paths the proxy exposes (e.g. /healthz/ready, /healthz/startup).
  path: /healthz/live
  # -- Failure threshold for livenessProbe
  failureThreshold: 3
  # -- Initial delay seconds for livenessProbe
  initialDelaySeconds: 0
  # -- Period seconds for livenessProbe
  periodSeconds: 10
  # -- Success threshold for livenessProbe
  successThreshold: 1
  # -- Timeout seconds for livenessProbe
  timeoutSeconds: 1

readinessProbe:
  # -- HTTP path for readinessProbe, queried against proxy.health.address. Defaults to
  # /healthz/ready, which is gated on the management server connection - the pod is taken out of
  # the Service's endpoints while disconnected. Set this to /healthz/live instead (e.g. in a CI
  # pipeline with no real management server reachable) if you want readiness to ignore management
  # connectivity entirely.
  path: /healthz/ready
  # -- Failure threshold for readinessProbe
  failureThreshold: 3
  # -- Initial delay seconds for readinessProbe
  initialDelaySeconds: 0
  # -- Period seconds for readinessProbe
  periodSeconds: 10
  # -- Success threshold for readinessProbe
  successThreshold: 1
  # -- Timeout seconds for readinessProbe
  timeoutSeconds: 1

startupProbe:
  # -- HTTP path for startupProbe, queried against proxy.health.address. Defaults to
  # /healthz/startup, the full check set including initial sync completion.
  path: /healthz/startup
  # -- Failure threshold for startupProbe.
  # Defaults high (60 x periodSeconds=5s = 5 minutes) to comfortably cover the GeoLite2 database
  # download the proxy performs at startup before it's ready to serve.
  failureThreshold: 60
  # -- Initial delay seconds for startupProbe
  initialDelaySeconds: 0
  # -- Period seconds for startupProbe
  periodSeconds: 5
  # -- Success threshold for startupProbe
  successThreshold: 1
  # -- Timeout seconds for startupProbe
  timeoutSeconds: 1

# -- Resource limits and requests for the controller pods.
resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

# -- Node labels for pod assignment
nodeSelector: {}

# -- Toleration labels for pod assignment
tolerations: []

# -- Affinity settings for pod assignment
affinity: {}

# -- additional environment variables to be added to the pods
extraEnv: []
  # - name: FOO
  #   value: BAR

# -- additional environment variables from ConfigMaps or Secrets
extraEnvFrom: []
  # - configMapRef:
  #     name: my-configmap
  # - secretRef:
  #     name: my-secret

# -- additional volumes to add to the pod. Useful for example to mount a pre-populated GeoLite2
# database (proxy.geoDataDir) or a wildcard certificate directory, neither of which this chart
# provisions directly.
extraVolumes: []
  # - name: geo-data
  #   persistentVolumeClaim:
  #     claimName: my-geo-data-pvc

# -- additional volume mounts to add to the container, paired with extraVolumes
extraVolumeMounts: []
  # - name: geo-data
  #   mountPath: /var/lib/netbird/geolocation

proxy:
  # -- Address the proxy's main TLS listener binds to (NB_PROXY_ADDRESS). The proxy always
  # terminates TLS itself for client-facing traffic - there is no plain-HTTP mode for this listener.
  # Defaults to the binary's own non-privileged default port, so the container never needs to bind
  # a privileged port (<1024) itself; service.https.port still exposes the conventional 443
  # externally - the Service's named targetPort maps it to whatever numeric port is set here.
  # Must be in ":PORT" form (no host part) - the chart derives the container's port from it.
  address: ":8443"
  # -- Base domain the proxy serves (NB_PROXY_DOMAIN). Services exposed via the NetBird UI/API
  # typically get their own auto-generated, UUID-prefixed subdomain under this base domain (e.g.
  # "<uuid>.<proxy.domain>") rather than using proxy.domain itself - see proxy.tls.source for how
  # that affects which domain(s) actually need a valid certificate.
  domain: ""
  # -- Log level for the proxy (NB_PROXY_LOG_LEVEL)
  logLevel: "info"
  managementServer:
    # -- Address of the NetBird management server (NB_PROXY_MANAGEMENT_ADDRESS). Leave empty to
    # use the binary's own default, NetBird Cloud (https://api.netbird.io:443) - only set this if
    # you run your own self-hosted management server.
    address: ""
    # -- Allow an insecure (non-TLS) gRPC connection to the management server (NB_PROXY_ALLOW_INSECURE).
    allowInsecure: true
    auth:
      # -- Name of an existing secret containing the proxy's management server token.
      # If set, proxy.managementServer.auth.token will be ignored.
      # The secret must contain a key named `token`.
      existingSecret: ""
      # -- Token used to authenticate this proxy against the management server (NB_PROXY_TOKEN),
      # generated via `netbird-server token create` (or your management server's equivalent).
      # It is strongly recommended to use proxy.managementServer.auth.existingSecret instead of
      # providing the token here.
      token: ""
  # -- Advertises this proxy cluster's support for "NetBird-Only" private services (NB_PROXY_PRIVATE) -
  # see https://netbird.io/knowledge-hub/netbird-only-private-services. This is an opt-in,
  # per-service access-control feature configured in the NetBird UI/API, not a network-exposure
  # setting - most deployments don't need it. Enabling it makes the proxy set up an additional,
  # hardcoded :80/:443 listener pair for such services regardless of proxy.address, which requires
  # NET_BIND_SERVICE for both ports rather than just the one proxy.address points at.
  private: false
  tls:
    # -- Source of the TLS certificate served to clients. One of:
    # - "selfSigned" (default): the chart generates a self-signed certificate for proxy.domain
    #   (required) and stores it in a Secret it manages itself - no external dependency at all, so
    #   `helm install` works out of the box. The generated certificate is stable across upgrades
    #   (re-used if the Secret already exists) but is not renewed automatically; delete the
    #   generated Secret to force regeneration. Fine for CI/testing or fully private/internal
    #   deployments where clients don't need a publicly-trusted certificate - switch to "secret"
    #   for a production setup with real external clients.
    # - "secret": mount an existing Kubernetes Secret of type kubernetes.io/tls (e.g. issued by a
    #   cert-manager Certificate resource) into proxy.tls.certificateDirectory. The proxy hot-reloads
    #   the certificate when the file changes on disk, so cert-manager renewals (which update the
    #   Secret, which kubelet syncs to the mounted volume) are picked up without restarting the pod.
    #   Recommended for production with real, publicly-trusted certificates.
    # - "acme": the proxy requests and renews its own certificates via ACME (Let's Encrypt) - sets
    #   NB_PROXY_ACME_CERTIFICATES=true. Requires the proxy to be reachable from the internet and
    #   proxy.domain to be set. Unlike "secret"/"selfSigned", this isn't a single static
    #   certificate - the proxy obtains one on demand per actual hostname the management server
    #   reports (including each exposed service's auto-generated subdomain), the first time a
    #   client connects for it. The default ACME challenge type (tls-alpn-01) validates on
    #   whatever port is externally reachable as 443 - this chart's Service already forwards
    #   external 443 to proxy.address internally, so the non-privileged ":8443" default works
    #   fine; no need to change proxy.address. Enable persistence.enabled to avoid re-requesting
    #   certificates (and risking Let's Encrypt rate limits) on every pod restart.
    source: selfSigned
    # -- Name of an existing Secret of type kubernetes.io/tls containing tls.crt and tls.key.
    # Required when proxy.tls.source=secret.
    existingSecret: ""
    # -- Directory where TLS certificate files are read from / stored (NB_PROXY_CERTIFICATE_DIRECTORY).
    # The proxy expects tls.crt and tls.key inside this directory (NB_PROXY_CERTIFICATE_FILE /
    # NB_PROXY_CERTIFICATE_KEY_FILE default to those names) - which is also the default key layout
    # of a Kubernetes Secret of type kubernetes.io/tls, so cert-manager output can be mounted as-is.
    certificateDirectory: "/certs"
    # -- TLS certificate filename within proxy.tls.certificateDirectory (NB_PROXY_CERTIFICATE_FILE).
    # Only needs changing if you mount a Secret/volume that uses different filenames.
    certificateFile: "tls.crt"
    # -- TLS private key filename within proxy.tls.certificateDirectory (NB_PROXY_CERTIFICATE_KEY_FILE).
    # Only needs changing if you mount a Secret/volume that uses different filenames.
    certificateKeyFile: "tls.key"
    # -- Certificate coordination method for multi-replica deployments (NB_PROXY_CERT_LOCK_METHOD).
    # One of "auto", "flock", or "k8s-lease". "flock" only works with a single replica (it
    # coordinates via a local file lock). "k8s-lease" coordinates across replicas using a
    # Kubernetes Lease object - the chart auto-detects and uses this inside Kubernetes (the
    # default, "auto", resolves to it), and creates the RBAC it needs automatically (see
    # rbac.create). Note that the Lease only coordinates *issuance timing* (so replicas don't
    # race to request the same certificate); it does not share already-issued certificate state
    # between replicas - see the multi-replica note under proxy.tls.source=acme above.
    certLockMethod: "auto"
    acme:
      # -- ACME challenge type when proxy.tls.source=acme (NB_PROXY_ACME_CHALLENGE_TYPE).
      # "tls-alpn-01" (default) validates on whatever port is externally reachable as 443 - this
      # chart's Service already forwards that to proxy.address internally, so it works fine at
      # proxy.address's non-privileged default. "http-01" instead validates on
      # proxy.tls.acme.address (default :80), requiring service.http.port (80) to actually reach
      # the pod from the internet.
      challengeType: "tls-alpn-01"
      # -- HTTP address for ACME http-01 challenges (NB_PROXY_ACME_ADDRESS). Only used when
      # proxy.tls.acme.challengeType=http-01.
      address: ":80"
      # -- Override the ACME directory URL (NB_PROXY_ACME_DIRECTORY), e.g. to use Let's Encrypt's
      # staging environment while testing (to avoid production rate limits) or a different ACME CA.
      # Defaults to the Let's Encrypt production directory when empty.
      directory: ""
      eab:
        # -- ACME External Account Binding key ID (NB_PROXY_ACME_EAB_KID), required by some ACME
        # CAs (e.g. ZeroSSL, some enterprise CAs). Leave empty if your CA doesn't require EAB.
        kid: ""
        # -- Name of an existing Secret containing the ACME EAB HMAC key (NB_PROXY_ACME_EAB_HMAC_KEY).
        # The secret must contain a key named `hmacKey`. Required together with proxy.tls.acme.eab.kid
        # if your ACME CA requires EAB.
        existingSecret: ""
  # -- Directory for the GeoLite2 city database (NB_PROXY_GEO_DATA_DIR), auto-downloaded from
  # pkgs.netbird.io at startup if missing. Not backed by a volume by default, so it is re-downloaded
  # on every pod restart; mount a volume here via extraVolumes/extraVolumeMounts (e.g. a small PVC)
  # if you want to avoid that, or are running in an environment without egress to pkgs.netbird.io.
  geoDataDir: "/var/lib/netbird/geolocation"
  # -- Require a subdomain label in front of proxy.domain for routed services (NB_PROXY_REQUIRE_SUBDOMAIN).
  requireSubdomain: false
  # -- Value to set for the X-Forwarded-Proto header sent to backends (NB_PROXY_FORWARDED_PROTO).
  # One of "auto", "http", or "https".
  forwardedProto: "auto"
  # -- Comma-separated list of trusted upstream proxy CIDR ranges (NB_PROXY_TRUSTED_PROXIES), e.g.
  # "10.0.0.0/8,192.168.1.1". Only set this if there is an L4 load balancer or proxy in front of
  # the Service that the proxy should trust for client-IP forwarding headers. Empty by default.
  trustedProxies: ""
  # -- Enable PROXY protocol on the proxy's TCP listeners to preserve real client IPs behind an L4
  # load balancer that supports it, e.g. an AWS NLB with proxy protocol enabled (NB_PROXY_PROXY_PROTOCOL).
  proxyProtocol: false
  # -- Cap the per-service backend dial timeout (NB_PROXY_MAX_DIAL_TIMEOUT), e.g. "5s". Empty means
  # no cap (binary default).
  maxDialTimeout: ""
  # -- Cap the per-service session idle timeout (NB_PROXY_MAX_SESSION_IDLE_TIMEOUT), e.g. "30m".
  # Empty means no cap (binary default).
  maxSessionIdleTimeout: ""
  health:
    # -- Address for the health probe endpoint (NB_PROXY_HEALTH_ADDRESS), used for this chart's
    # liveness/readiness/startup probes. Deliberately overrides the binary's own "localhost:8080"
    # default to bind all interfaces within the pod's network namespace, since the kubelet's
    # httpGet probes connect to the Pod IP and cannot reach a port bound only to 127.0.0.1 inside
    # the container. This is not exposed via the Service, so it stays unreachable from outside the
    # pod's network namespace regardless.
    address: ":8080"
  debugEndpoint:
    # -- Enable the debug HTTP endpoint (NB_PROXY_DEBUG_ENDPOINT), which exposes richer
    # introspection (connected clients, runtime stats, packet capture) than the health endpoint.
    # Disabled by default since it's a more sensitive surface; left bound to localhost (not
    # exposed via the Service) even when enabled - reach it via `kubectl exec`/port-forward.
    enabled: false
    # -- Address for the debug HTTP endpoint (NB_PROXY_DEBUG_ENDPOINT_ADDRESS). Only relevant when
    # proxy.debugEndpoint.enabled=true.
    address: "localhost:8444"
  crowdsec:
    # -- CrowdSec LAPI URL for IP reputation checks (NB_PROXY_CROWDSEC_API_URL). Leave empty to
    # disable the CrowdSec integration entirely.
    apiUrl: ""
    auth:
      # -- Name of an existing secret containing the CrowdSec bouncer API key.
      # If set, proxy.crowdsec.auth.apiKey will be ignored. The secret must contain a key named `apiKey`.
      existingSecret: ""
      # -- CrowdSec bouncer API key (NB_PROXY_CROWDSEC_API_KEY).
      # It is strongly recommended to use proxy.crowdsec.auth.existingSecret instead of providing
      # the key here.
      apiKey: ""

persistence:
  # -- Enable persistent storage for the certs directory. Only relevant when proxy.tls.source=acme;
  # recommended in that case to avoid re-requesting certificates on every pod restart. Has no
  # effect for proxy.tls.source=secret or selfSigned, since both mount the certificate directly
  # from a Secret rather than writing to the certs directory.
  enabled: false
  # -- Provide an existing PersistentVolumeClaim. If set, no new PVC will be created.
  existingClaim: ""
  # -- Name of the StorageClass required by the claim
  storageClassName: ""
  # -- The desired access modes the volume should have
  accessModes:
    - ReadWriteOnce
  # -- Annotations to be added to the PersistentVolumeClaim
  annotations: {}
  # -- Represents the minimum and maximum resources the volume should have
  resources:
    requests:
      storage: 1Gi