$ show netbirdio/netbird
NetBird is a configuration-free peer-to-peer VPN and centralized access control system built on WireGuard. It consists of a cross-platform client daemon (Linux, Windows, macOS, Android, iOS, FreeBSD, WebAssembly), a management server, a signal server for NAT traversal coordination, a relay server for fallback connectivity, and a reverse proxy with an LLM gateway layer. The client daemon manages WireGuard interfaces, DNS, firewall rules, and peer connections via ICE/STUN/TURN, while the management server provides REST/gRPC APIs for account management, network map computation, posture checks, and policy enforcement. The proxy component adds middleware for authentication, LLM request parsing, cost metering, and guardrails, enabling identity-aware access to private resources and AI APIs over the encrypted tunnel. Architecturally, the system is a distributed set of microservices: the client runs as a background daemon with a CLI and a desktop GUI (Wails v3 + React), communicating with the management server via gRPC and REST. Relay and signal servers facilitate NAT traversal, and the proxy can be deployed as a standalone reverse proxy. The management server supports multiple database backends (PostgreSQL, SQLite, MySQL) and caching via Redis. Telemetry and metrics are exported to Prometheus or InfluxDB. The codebase is heavily platform-adapted with build-tagged files, and includes extensive unit, integration, and end-to-end tests. Key entry points include client/main.go (CLI), client/ui/main.go (desktop GUI), management/main.go (management server), relay/main.go (relay server), signal/main.go (signal server), proxy/cmd/proxy/main.go (proxy), and combined/main.go (all-in-one server). Data flows involve client authentication, network map retrieval, WireGuard tunnel setup, peer-to-peer connection establishment via ICE/relay, and optional proxy middleware processing for HTTP/LLM traffic. External dependencies include WireGuard, PostgreSQL/SQLite/MySQL, Redis, MaxMind GeoLite2, pyroscope, gRPC, protobuf, Wails, and various system tools (iptables, nftables, resolvconf).
The LLM identified 5 files worth highlighting for reuse:
Provides Base62 encoding and decoding using a fixed-size character lookup table and overflow-safe decode logic. Self-contained and reusable for any application needing compact, URL-safe encoding without external dependencies.
Implements AES-GCM field-level encryption with base64-encoded keys. Offers a simple encrypt/decrypt interface suitable for protecting sensitive configuration values or small payloads. No internal dependencies beyond standard library.
Encodes IPv4 and IPv6 prefixes into a compact binary format (5 bytes for IPv4, 17 bytes for IPv6) for efficient wire transmission. Includes parsing and serialization logic, reusable in any networking or storage component that needs to minimize prefix size.
Manages a thread-safe pool of fake IP addresses from reserved ranges, allocating and releasing addresses on demand. Demonstrates careful concurrency control and resource lifecycle management, reusable for any system needing dynamic IP assignment.
Builds a source-address hash map for O(1) ACL lookups in a userspace packet filter, with fallback for non-host prefixes. Efficiently maps packets to peer rules, reusable in any high-performance packet processing pipeline.