[client, proxy] Remove lazy connection exclusions and run Rosenpass on the embedded proxy

[lixmal]

Describe your changes

Follow-up to #6762. Removes the remaining special-cases that kept lazy connections from applying uniformly, and lets the embedded reverse proxy interoperate with Rosenpass-enabled peers.

• Run the lazy connection manager for Rosenpass-enabled peers instead of disabling it outright. Such connections simply never idle on their own, since Rosenpass rekey traffic keeps them active.
• Treat forward-target peers as normal lazy connections instead of forcing them always-active; they wake on demand like any other peer.
• Run Rosenpass in permissive mode on the embedded proxy so it can connect to Rosenpass-enabled peers (post-quantum) and fall back to plain WireGuard for peers without it. Without this a Rosenpass peer cannot reach the proxy at all (PSK mismatch). Toggle with NB_PROXY_ROSENPASS (default on).

Issue ticket number and link

Stack

Stacked on #6762.

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)
• This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See CONTRIBUTING.md.

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

No user-facing client configuration changes. The proxy NB_PROXY_ROSENPASS option is exposed via the netbird-proxy Helm chart (netbirdio/helms).

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

Summary by CodeRabbit

• New Features

  • Added embedded-client options to enable Rosenpass post-quantum key exchange and configure permissive behavior.
  • Added environment-variable controls for Rosenpass and embedded-client log level settings.
  • Rosenpass is enabled by default for embedded clients and can be overridden through configuration.

• Improvements

  • Improved lazy peer connection handling so peer activity follows configured lazy policies more consistently.
  • Enhanced startup and configuration logging, including Rosenpass settings and clearer invalid log-level warnings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 29aa0977-71ed-4aa0-960f-9c3b2246b070

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lazy-conn-rosenpass

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Release artifacts

Built for PR head ee00271 in workflow run #16844.

Artifact	Link
All release artifacts	Download
Linux packages	Download
Windows packages	Download
macOS packages	Download
UI artifacts	Download
UI macOS artifacts	Download

GHCR images (amd64)

• ghcr.io/netbirdio/management:pr-6763
• ghcr.io/netbirdio/netbird-server:pr-6763
• ghcr.io/netbirdio/netbird:pr-6763
• ghcr.io/netbirdio/relay:pr-6763
• ghcr.io/netbirdio/reverse-proxy:pr-6763
• ghcr.io/netbirdio/signal:pr-6763
• ghcr.io/netbirdio/upload:pr-6763

This comment is updated by the Release workflow. Artifact links expire according to the workflow retention policy.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud