NetBird is a configuration-free peer-to-peer VPN and centralized access control system built on WireGuard. It consists of a cross-platform client daemon (Linux, Windows, macOS, Android, iOS, FreeBSD, WebAssembly), a management server, a signal server for NAT traversal coordination, a relay server for fallback connectivity, and a reverse proxy with an LLM gateway layer. The client daemon manages WireGuard interfaces, DNS, firewall rules, and peer connections via ICE/STUN/TURN, while the management server provides REST/gRPC APIs for account management, network map computation, posture checks, and policy enforcement. The proxy component adds middleware for authentication, LLM request parsing, cost metering, and guardrails, enabling identity-aware access to private resources and AI APIs over the encrypted tunnel. Architecturally, the system is a distributed set of microservices: the client runs as a background daemon with a CLI and a desktop GUI (Wails v3 + React), communicating with the management server via gRPC and REST. Relay and signal servers facilitate NAT traversal, and the proxy can be deployed as a standalone reverse proxy. The management server supports multiple database backends (PostgreSQL, SQLite, MySQL) and caching via Redis. Telemetry and metrics are exported to Prometheus or InfluxDB. The codebase is heavily platform-adapted with build-tagged files, and includes extensive unit, integration, and end-to-end tests. Key entry points include client/main.go (CLI), client/ui/main.go (desktop GUI), management/main.go (management server), relay/main.go (relay server), signal/main.go (signal server), proxy/cmd/proxy/main.go (proxy), and combined/main.go (all-in-one server). Data flows involve client authentication, network map retrieval, WireGuard tunnel setup, peer-to-peer connection establishment via ICE/relay, and optional proxy middleware processing for HTTP/LLM traffic. External dependencies include WireGuard, PostgreSQL/SQLite/MySQL, Redis, MaxMind GeoLite2, pyroscope, gRPC, protobuf, Wails, and various system tools (iptables, nftables, resolvconf).
Microbundle is a zero-configuration bundler for small JavaScript/TypeScript libraries, built on top of Rollup. It automatically generates multiple output formats (ESM, CJS, UMD, and a modern ES2017 bundle) from a single source entry, using package.json fields to determine input and output paths. The system reads the package.json, resolves entry points, and creates Rollup configurations for each format, applying Babel for transpilation (with custom presets for modern vs legacy targets), TypeScript via rollup-plugin-typescript2, CSS handling via PostCSS, and minification via Terser. It supports features like JSX, CSS Modules, property mangling, build-time constant replacement, module aliasing, Web Workers, and bundle visualization. The architecture is a CLI tool (`src/cli.js`) that parses arguments with `sade` and calls the core `microbundle()` function (`src/index.js`), which orchestrates the build pipeline. The codebase is well-structured, with reusable utility modules for option normalization, Babel plugin customization, and size reporting. While the dependency versions are somewhat dated (Rollup 2, Babel 7.12), the project remains actively maintained with recent commits and a comprehensive test suite covering many edge cases.