Sandcat netbird integration - #107

Draft

wiacekm wants to merge 141 commits into

VirtusLab:masterfrom

wiacekm:sandcat-netbird-integration

Commits on Sep 10, 2026

docs(plans): add NetBird dynamic WireGuard implementation plan

Michał Wiącek
and
cursoragent
committed
c48b641
docs(plans): revise netbird plan — manager/consumer split, no caps on netbird container

Michał Wiącek
and
cursoragent
committed
1c3a385
feat(netbird): install netbird binary in wg-client image
Michał Wiącek
committed
0c3b740
feat(netbird): add netbird daemon startup and supervision to wg-client-init.sh
Michał Wiącek
committed
2ef59bc
feat(netbird): add enable_netbird compose helper with idempotency
Michał Wiącek
committed
1386e87
test(netbird): add compose contract tests enforcing single NET_ADMIN container
Michał Wiącek
committed
9b76c45
feat(netbird): add netbird management API helpers with unit tests
Michał Wiącek
committed
9538b3e
feat(netbird): add sandcat netbird subcommand dispatcher
Michał Wiącek
committed
730917c
feat(init): add --netbird flag and enrollment key seeding
Michał Wiącek
committed
a6a23f4
docs(cli): document --netbird flag and sandcat netbird subcommand
Michał Wiącek
committed
485409e
feat(netbird): pin netbird binary with per-arch sha256 checksums
Michał Wiącek
committed
fe90b1b
feat(netbird): resolve API and enrollment tokens from sandcat settings
Michał Wiącek
committed
90abce8
feat(netbird): add management server selection and template provisioning
Michał Wiącek
committed
1fcfba5
this is kind of working
Michał Wiącek
committed
feea415
working before cleanup
Michał Wiącek
committed
286b11d
feat(netbird): add server lifecycle commands and harden API client
Michał Wiącek
committed
15ce9dd
feat(capability-runtime): add project scaffold and v1 types

Michał Wiącek
and
cursoragent
committed
7db49a5
feat(capability-runtime): add typed error taxonomy (spec §3.3)
Michał Wiącek
committed
780035f
feat(capability-runtime): add observability collector with replay
Michał Wiącek
committed
11d418b
feat(capability-runtime): add capability catalog and lifecycle states
Michał Wiącek
committed
42f9194
feat(capability-runtime): add LeaseManager for grant and quota tracking
Michał Wiącek
committed
5f96b25
feat(capability-runtime): add revocation and discovery
Michał Wiącek
committed
ba52973
Implement CapabilityRuntime with all protocol surfaces

Michał Wiącek
and
cursoragent
committed
f83a310
feat(capability-runtime): add AgentExecutionLoop harness

Michał Wiącek
and
cursoragent
committed
cdc228b
feat(capability-runtime): add mock MCP tool adapter for PoC 2

Michał Wiącek
and
cursoragent
committed
5648527
feat(capability-runtime): add PoC 1 create_pr runnable demo

Michał Wiącek
and
cursoragent
committed
58d677e
feat(capability-runtime): add network capability types and physical backend protocol

Michał Wiącek
and
cursoragent
committed
f629cea
feat(capability-runtime): add NetBird client with mock and REST implementations

Michał Wiącek
and
cursoragent
committed
9ee6274
feat(capability-runtime): add NetBirdRevocationBackend for physical network revoke

Michał Wiącek
and
cursoragent
committed
a440e11
Add network capability catalog and bundle assembly

Michał Wiącek
and
cursoragent
committed
3b30612
Wire logical revoke to physical NetBird backend

Michał Wiącek
and
cursoragent
committed
5d14c15
feat: implement RouteDisappearanceWatcher for physical-to-logical revocation

Michał Wiącek
and
cursoragent
committed
60db8c7
feat(capability-runtime): add PoC 3 network route demo

Michał Wiącek
and
cursoragent
committed
11e3343
docs(capability-runtime): document Phase 3 NetBird networking scope

Michał Wiącek
and
cursoragent
committed
e1f259e
feat(capability-runtime): extract lease policy and add security boundary tests
Michał Wiącek
committed
b590052
chore(tests): fix failing tests
Michał Wiącek
committed
e280034
feat(capability-runtime): enforce caller identity and operator-only revoke
Michał Wiącek
committed
33cfab9
feat(capability-runtime): load NetBird credentials from sandcat settings layers
Michał Wiącek
committed
544fb90
feat(capability-runtime): add JSON-RPC dispatcher with agent and admin surfaces
Michał Wiącek
committed
b7d87df
feat(capability-runtime): add sidecar daemon with dual Unix socket RPC
Michał Wiącek
committed
b4e48ae
feat(capability-runtime): add MCP stdio bridge to agent RPC socket
Michał Wiącek
committed
bd251ea
feat(cli): add capability-runtime sidecar compose integration
Michał Wiącek
committed
c6927dc
feat(cli): add sandcat capability operator subcommand
Michał Wiącek
committed
6ada509
docs: document Phase 3b capability sidecar and MCP bridge
Michał Wiącek
committed
e865645
fix(cli): mount capability socket outside read-only wg-runtime path
Michał Wiącek
committed
eeadf0d
feat(capability-runtime): add NetworkBinding sync_mode and grant protocol

Michał Wiącek
and
cursoragent
committed
2ee2aa6
feat(capability-runtime): add NetBirdClient enable/disable binding
Michał Wiącek
committed
10a8e0b
feat(capability-runtime): wire grant path to NetBird enable_binding
Michał Wiącek
committed
a791f6a
feat(capability-runtime): prefer disable_binding on revoke

Michał Wiącek
and
cursoragent
committed
109ce26
feat(cli): catalog sync_mode and capability watch physical sync events

Michał Wiącek
and
cursoragent
committed
60cc941
docs: Phase 3c NetBird policy sync grant/revoke

Michał Wiącek
and
cursoragent
committed
8491d22
fix(cli): fix capability sidecar startup and agent MCP connectivity
Michał Wiącek
committed
636e6a2
fix(capability-runtime): disable NetBird binding on revoke by lease ID
Michał Wiącek
committed
95ab2d6
test(cli): use yq -e for capability compose existence checks
Michał Wiącek
committed
558c1ce
fix(capability-runtime): allow re-lease after revoke or expiry
Michał Wiącek
committed
ef7a7fb
fix(capability-runtime): mark leases revoked on ref-based revoke
Michał Wiącek
committed
4edbca5
feat(capability-runtime): reconcile route disappearance in watcher
Michał Wiącek
committed
2876774
fix(capability-runtime): tolerate NetBird errors during TTL expiry
Michał Wiącek
committed
4139ace
docs: add Phase 3c engineering gate script and live smoke steps
Michał Wiącek
committed
587bf05
ix(capability-runtime): tolerate NetBird errors on operator revoke
Michał Wiącek
committed
f598631
fixes
Michał Wiącek
committed
b49b3a2
feat(cli): add proxy-peer hello HTTP server for mesh smoke
Michał Wiącek
committed
2006c66
test(cli): harden proxy-peer hello bats harness
Michał Wiącek
committed
086aebc
feat(cli): add proxy-peer NetBird enrollment init script

Michał Wiącek
and
cursoragent
committed
ad59676
feat(cli): add proxy-peer Docker image and compose stack
Michał Wiącek
committed
492f3dc
feat(cli): add sandcat init --proxy-peer template wiring
Michał Wiącek
committed
3a79ef1
docs(cli): add Layer 1 mitmproxy profile for proxy-peer gateway
Michał Wiącek
committed
75624bd
feat(capability-runtime): catalog lease_policy for network capabilities
Michał Wiącek
committed
123a6d9
feat(capability-runtime): admin capability.l7.record for flow quota
Michał Wiącek
committed
dc3da7d
feat(mitmproxy): post-hoc l7 flow record to capability sidecar
Michał Wiącek
committed
da6e98e
docs: add Phase 3e proxy-peer engineering gate
Michał Wiącek
committed
1ce0eda
fix(phase3e): address code review findings for L7 quota loop
Michał Wiącek
committed
7bd6ca5
chore: drop accidental cli/.version from commit
Michał Wiącek
committed
c04b46c
fix(capability-runtime): fail closed on revoke and schedule TTL expiry
Michał Wiącek
committed
fd46105
test(cli): harden proxy-peer hello bats against port flakes
Michał Wiącek
committed
e764e19
docs(spec): add proxy-peer NetBird DNS targeting design

Michał Wiącek
and
cursoragent
committed
fff385e
feat(capability-runtime): resolve network binding from NetBird dns_label

Michał Wiącek
and
cursoragent
committed
cf0df20
feat(wg-client): forward NetBird DNS domain via dnsmasq

Michał Wiącek
and
cursoragent
committed
6e815d3
docs(cli): proxy-peer Layer 1 and gate prefer NetBird FQDN

Michał Wiącek
and
cursoragent
committed
a23c724
docs: wire NetBird DNS targeting into CONTEXT and Phase 3e

Michał Wiącek
and
cursoragent
committed
1488309
fix(netbird-dns): address three review findings

Michał Wiącek
and
cursoragent
committed
f24ce35
fix(l7-record): match FQDN host against dns_label for quota tracking

Michał Wiącek
and
cursoragent
committed
b56b5bc
feat(mitmproxy): honor network rule enabled flag

Michał Wiącek
and
cursoragent
committed
6dd2cf0
feat(capability-runtime): add revocation close policy to network bindings

Michał Wiącek
and
cursoragent
committed
9d5d71a
feat(mitmproxy): apply L7 revoke host deny and close policies

Michał Wiącek
and
cursoragent
committed
a3059be
fix(mitmproxy): complete L7 revocation close policy implementation

Michał Wiącek
and
cursoragent
committed
3280952
fix(mitmproxy): run drain kill after response hooks

Michał Wiącek
and
cursoragent
committed
7f90553
feat(mitmproxy): expose Mitmproxy Revocation Socket for revoke_flows

Michał Wiącek
and
cursoragent
committed
5bb2714
fix(mitmproxy): address Task 4 review findings for revoke RPC

Michał Wiącek
and
cursoragent
committed
6e1c176
feat(capability-runtime): add best-effort L7 revocation push client

Michał Wiącek
and
cursoragent
committed
2eefb32
feat(capability-runtime): push L7 revoke on network logical revocation

Michał Wiącek
and
cursoragent
committed
0df5f10
feat(cli): add --close-policy override for capability revoke

Michał Wiącek
and
cursoragent
committed
08af6ac
feat(compose): wire Mitmproxy Revocation Socket into capability-runtime

Michał Wiącek
and
cursoragent
committed
df9d058
fix(mitmproxy): make L7 revoke server optional and track live flows

Michał Wiącek
and
cursoragent
committed
19617ce
fix(capability-runtime): make L7 push additive and add a restore path

Michał Wiącek
and
cursoragent
committed
9c8b1f6
fix(compose): mount l7_revoke_rpc and declare mitmproxy-config unconditionally

Michał Wiącek
and
cursoragent
committed
d8465b7
fix(compose): isolate the L7 revoke socket on its own volume

Michał Wiącek
and
cursoragent
committed
f05a745
fix(mitmproxy): scope L7 restore to its capability and harden flow kills

Michał Wiącek
and
cursoragent
committed
4a9861c
feat(cli): run NetBird on mitmproxy and bridge mesh DNS to the agent

Michał Wiącek
and
cursoragent
committed
bc93dfe
feat(netbird): add project-scoped peer name settings helpers

Michał Wiącek
and
cursoragent
committed
3b28683
test(netbird): cover empty-string peer name refill

Michał Wiącek
and
cursoragent
committed
8dd82f3
feat(netbird): rewrite catalog and Layer 1 example from peer names

Michał Wiącek
and
cursoragent
committed
caf6c8b
feat(composefile): inject NetBird peer name, token, and state volume

Michał Wiącek
and
cursoragent
committed
78a6227
feat(composefile): project-scope proxy-peer NetBird hostname and state

Michał Wiącek
and
cursoragent
committed
27f0f1c
feat(init): seed and apply project-scoped NetBird peer names

Michał Wiącek
and
cursoragent
committed
c9b4195
test(init): assert NetBird peer name override propagation

Michał Wiącek
and
cursoragent
committed
b8a0962
feat(netbird): share peer reconnect and replacement lifecycle

Michał Wiącek
and
cursoragent
committed
2e24c88
fix(netbird): make peer replacement deterministic

Michał Wiącek
and
cursoragent
committed
6838f1c
fix(netbird): restore delete peer by name helper

Michał Wiącek
and
cursoragent
committed
92dc130
feat(netbird): wire peer lifecycle into proxy enrollment

Michał Wiącek
and
cursoragent
committed
4564e39
docs(netbird): retire peer-proxy spelling in Phase A operator surfaces

Michał Wiącek
and
cursoragent
committed
082945b
fix revoking in capability-runtime
Michał Wiącek
committed
83fdd56
refactor(cli): configure NetBird instead of provisioning it
Michał Wiącek
committed
158ec58
cleanup POC leftovers
Michał Wiącek
committed
9c16468
feat: bind-mount project catalog into capability-runtime
Michał Wiącek
committed
4e41e87
feat: add sandcat edit capability-catalog
Michał Wiącek
committed
981c0c6
feat: restart capability-runtime from catalog edit with --restart
Michał Wiącek
committed
fd33d5b
fix: warn when catalog is not bind-mounted into capability-runtime
Michał Wiącek
committed
3d05ffb
docs: edit capability-catalog instead of hand-restarting a baked file
Michał Wiącek
committed
f19f983
fix: catalog-edit warning, mounted no-restart test, and remount docs
Michał Wiącek
committed
983b394
fix(cli): reject --capability so init no longer wires the sidecar

Michał Wiącek
and
cursoragent
committed
7019c6c
refactor(cli): remove capability-runtime sidecar and operator commands

Michał Wiącek
and
cursoragent
committed
5a191cb
fix(mitmproxy): drop L7 revoke and record paths

Michał Wiącek
and
cursoragent
committed
29d0f0b
refactor(cli): remove sandcat netbird host REST commands

Michał Wiącek
and
cursoragent
committed
b70b0be
feat(netbird): flatten settings objects into NB_* compose env

Michał Wiącek
and
cursoragent
committed
d211000
feat(netbird): resolve op:// and pass:// enroll creds in the container

Michał Wiącek
and
cursoragent
committed
490ec1e
fix(netbird): let prepare flatten enrollment key from settings.json

Michał Wiącek
and
cursoragent
committed
a5ac03e
fix(examples): drive proxy-peer from env files without committed secrets

Michał Wiącek
and
cursoragent
committed
f6fde9f
docs: thin NetBird PoC runbooks to compose, ACL, and mitmproxy enroll

Michał Wiącek
and
cursoragent
committed
a1f7b13
docs: drop Layer 2 route wording from proxy-peer settings comment
Michał Wiącek
committed
a24f3aa
fix(netbird): bound secret CLI timeouts and flatten API token resolve

Michał Wiącek
and
cursoragent
committed
e088ebd
fix(netbird): pin clients to 0.72.4 so Docker peers can use the embedded relay

Michał Wiącek
and
cursoragent
committed
d7514e8
fix(netbird): skip replace without a PAT and keep one lifecycle script
Michał Wiącek
committed
b903d90
Add postgres-peer compose contract and env scaffolding.

Michał Wiącek
and
cursoragent
committed
504d563
Add postgres-peer NetBird sidecar image without an HTTP hello server.

Michał Wiącek
and
cursoragent
committed
f200471
Seed postgres-peer with a notes table and Layer 1 TCP 5432 allow.

Michał Wiącek
and
cursoragent
committed
5a92e4e
Document postgres-peer as a manual mesh database example.

Michał Wiącek
and
cursoragent
committed
379c16b
Clarify Layer 1 port is documentary and document postgres netns recreate.

Michał Wiącek
and
cursoragent
committed
56b82c3
fix(cli): heal post-rebase compose include and test fallout
Michał Wiącek
committed
2abeade
fix(netbird): keep mitmproxy healthy and stop mesh/repo credential leaks

Michał Wiącek
and
cursoragent
committed
dc8466e
perf(cli): cut yq process overhead during sandcat init

Michał Wiącek
and
cursoragent
committed
d194bbf