docs,fix: Address CodeRabbit review on transparent-proxy PR

- config: clarify TransparentProxyAddr doc — the proxy-sidecar/lite presets
  default it to :8082 (always-on by design); empty only disables it for modes
  without a preset default. Removes the misleading 'empty disables' claim that
  the preset contradicts.
- transparentproxy.NewServer: guard against a nil ConnHandler (fall back to a
  close-and-log handler) so a misconfiguration degrades to no-capture instead of
  a dispatch-time panic.
- proxy-init README: list 'lite' alongside 'proxy-sidecar' in the mode table to
  match the injection section.

Declined: SSH (port 22) exclusion for enforce-redirect. Excluding 22 would punch
a deliberate egress bypass hole, contradicting the fail-closed purpose; the
transparent listener blind-tunnels any TCP so captured SSH still works (unlike
redirect mode, which forwards to Envoy's HTTP listener — the reason it excludes
22). enforce-drop does not exclude 22 either.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -321,8 +321,13 @@ type ListenerConfig struct {
 	// listener used by proxy-sidecar enforce-redirect mode: iptables REDIRECTs
 	// the agent's bypass egress here, and the listener recovers the original
 	// destination via SO_ORIGINAL_DST and tunnels it through the same outbound
-	// pipeline as the forward proxy. Default per proxy-sidecar preset is
-	// ":8082". Empty disables the listener (cooperative HTTP_PROXY only).
+	// pipeline as the forward proxy. The proxy-sidecar / lite presets default it
+	// to ":8082", so for those shapes the listener is effectively always on —
+	// binding is harmless when nothing is redirected to it (cooperative
+	// HTTP_PROXY deployments simply never receive connections on it). An empty
+	// value only disables the listener for modes that have no preset default for
+	// this field (e.g. waypoint / envoy-sidecar); under proxy-sidecar / lite the
+	// preset refills it, matching the always-on enforce-redirect design.
 	TransparentProxyAddr string `yaml:"transparent_proxy_addr" json:"transparent_proxy_addr"`
 
 	// SessionAPIAddr is the bind address for the session events HTTP server

authbridge/authlib/listener/transparentproxy/server.go

@@ -34,6 +34,16 @@ type Server struct {
 // forwardproxy.Server.HandleTransparentConn, so transparent and explicit-proxy
 // egress share one auth pipeline.
 func NewServer(handle ConnHandler) *Server {
+	if handle == nil {
+		// Defensive: a nil handler would panic at dispatch and take down the
+		// process. Fall back to closing the connection so a misconfiguration
+		// degrades to "no capture" rather than a crash.
+		handle = func(conn net.Conn, _ string) {
+			slog.Error("transparent-proxy: nil connection handler; closing connection",
+				"remote", conn.RemoteAddr().String())
+			_ = conn.Close()
+		}
+	}
 	return &Server{handle: handle}
 }
 

authbridge/proxy-init/README.md

@@ -8,8 +8,8 @@ env var:
 | `MODE` | Used by | What it does |
 |---|---|---|
 | `redirect` (default) | `envoy-sidecar` | Transparently **REDIRECT**s pod traffic to the Envoy listeners. |
-| `enforce-redirect` | `proxy-sidecar` | Fail-closed egress guard that **captures**: REDIRECTs external TCP that bypasses the forward proxy to AuthBridge's transparent listener; DROPs non-TCP external egress. |
-| `enforce-drop` | `proxy-sidecar` | Fail-closed egress guard that **DROP**s any egress that bypasses the forward proxy. Predates `enforce-redirect`; retained as a no-transparent-listener fallback. |
+| `enforce-redirect` | `proxy-sidecar`, `lite` | Fail-closed egress guard that **captures**: REDIRECTs external TCP that bypasses the forward proxy to AuthBridge's transparent listener; DROPs non-TCP external egress. |
+| `enforce-drop` | `proxy-sidecar`, `lite` | Fail-closed egress guard that **DROP**s any egress that bypasses the forward proxy. Predates `enforce-redirect`; retained as a no-transparent-listener fallback. |
 
 ## `redirect` mode (envoy-sidecar)