update
This commit is contained in:
Mike McFetridge
@@ -0,0 +1,177 @@
|
||||
services:
|
||||
<%- if traefik_enabled and traefik_mode == 'integrated' %>
|
||||
traefik:
|
||||
image: docker.io/library/traefik:v3.6
|
||||
restart: << restart_policy >>
|
||||
logging:
|
||||
driver: "json-file"
|
||||
options:
|
||||
max-size: "500m"
|
||||
max-file: "2"
|
||||
command:
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.docker.network=netbird"
|
||||
- "--entrypoints.<< traefik_entrypoint >>.address=:80"
|
||||
<%- if traefik_tls_enabled %>
|
||||
- "--entrypoints.<< traefik_tls_entrypoint >>.address=:443"
|
||||
- "--entrypoints.<< traefik_tls_entrypoint >>.transport.respondingTimeouts.readTimeout=0"
|
||||
- "--entrypoints.<< traefik_entrypoint >>.http.redirections.entrypoint.to=<< traefik_tls_entrypoint >>"
|
||||
- "--entrypoints.<< traefik_entrypoint >>.http.redirections.entrypoint.scheme=https"
|
||||
- "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.tlschallenge=true"
|
||||
- "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.email=<< letsencrypt_email >>"
|
||||
- "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.storage=/letsencrypt/acme.json"
|
||||
<%- endif %>
|
||||
ports:
|
||||
- "80:80"
|
||||
<%- if traefik_tls_enabled %>
|
||||
- "443:443"
|
||||
<%- endif %>
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
<%- if traefik_tls_enabled %>
|
||||
- netbird_traefik_letsencrypt:/letsencrypt
|
||||
<%- endif %>
|
||||
networks:
|
||||
- netbird
|
||||
<%- endif %>
|
||||
|
||||
dashboard:
|
||||
image: docker.io/netbirdio/dashboard:latest
|
||||
restart: << restart_policy >>
|
||||
logging:
|
||||
driver: "json-file"
|
||||
options:
|
||||
max-size: "500m"
|
||||
max-file: "2"
|
||||
depends_on:
|
||||
- netbird-server
|
||||
environment:
|
||||
<%- if traefik_tls_enabled %>
|
||||
- NETBIRD_MGMT_API_ENDPOINT=https://<< public_hostname >>
|
||||
- NETBIRD_MGMT_GRPC_API_ENDPOINT=https://<< public_hostname >>
|
||||
<%- else %>
|
||||
- NETBIRD_MGMT_API_ENDPOINT=http://<< public_hostname >>
|
||||
- NETBIRD_MGMT_GRPC_API_ENDPOINT=http://<< public_hostname >>
|
||||
<%- endif %>
|
||||
- AUTH_AUDIENCE=netbird-dashboard
|
||||
- AUTH_CLIENT_ID=netbird-dashboard
|
||||
- AUTH_CLIENT_SECRET=
|
||||
<%- if traefik_tls_enabled %>
|
||||
- AUTH_AUTHORITY=https://<< public_hostname >>/oauth2
|
||||
<%- else %>
|
||||
- AUTH_AUTHORITY=http://<< public_hostname >>/oauth2
|
||||
<%- endif %>
|
||||
- USE_AUTH0=false
|
||||
- AUTH_SUPPORTED_SCOPES=openid profile email groups
|
||||
- AUTH_REDIRECT_URI=/nb-auth
|
||||
- AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
|
||||
<%- if traefik_tls_enabled %>
|
||||
- NGINX_SSL_PORT=443
|
||||
<%- else %>
|
||||
- NGINX_SSL_PORT=80
|
||||
<%- endif %>
|
||||
- LETSENCRYPT_DOMAIN=none
|
||||
<%- if not traefik_enabled %>
|
||||
ports:
|
||||
- "127.0.0.1:8080:80"
|
||||
<%- endif %>
|
||||
<%- if traefik_enabled %>
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
<%- if traefik_mode == 'integrated' %>
|
||||
- "traefik.docker.network=netbird"
|
||||
<%- elif traefik_mode == 'existing' %>
|
||||
- "traefik.docker.network=<< traefik_network >>"
|
||||
<%- endif %>
|
||||
- "traefik.http.routers.netbird-dashboard.rule=Host(`<< public_hostname >>`)"
|
||||
<%- if traefik_tls_enabled %>
|
||||
- "traefik.http.routers.netbird-dashboard.entrypoints=<< traefik_tls_entrypoint >>"
|
||||
- "traefik.http.routers.netbird-dashboard.tls=true"
|
||||
- "traefik.http.routers.netbird-dashboard.tls.certresolver=<< traefik_tls_certresolver >>"
|
||||
<%- else %>
|
||||
- "traefik.http.routers.netbird-dashboard.entrypoints=<< traefik_entrypoint >>"
|
||||
<%- endif %>
|
||||
- "traefik.http.routers.netbird-dashboard.priority=1"
|
||||
- "traefik.http.services.netbird-dashboard.loadbalancer.server.port=80"
|
||||
<%- endif %>
|
||||
networks:
|
||||
- netbird
|
||||
<%- if traefik_enabled and traefik_mode == 'existing' %>
|
||||
- << traefik_network >>
|
||||
<%- endif %>
|
||||
|
||||
netbird-server:
|
||||
image: docker.io/netbirdio/netbird-server:latest
|
||||
restart: << restart_policy >>
|
||||
logging:
|
||||
driver: "json-file"
|
||||
options:
|
||||
max-size: "500m"
|
||||
max-file: "2"
|
||||
command:
|
||||
- --config
|
||||
- /etc/netbird/config.yaml
|
||||
ports:
|
||||
<%- if not traefik_enabled %>
|
||||
- "127.0.0.1:8081:80"
|
||||
<%- endif %>
|
||||
- "<< stun_port >>:<< stun_port >>/udp"
|
||||
volumes:
|
||||
- netbird_data:/var/lib/netbird
|
||||
- ./config:/etc/netbird:ro
|
||||
<%- if traefik_enabled %>
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
<%- if traefik_mode == 'integrated' %>
|
||||
- "traefik.docker.network=netbird"
|
||||
<%- elif traefik_mode == 'existing' %>
|
||||
- "traefik.docker.network=<< traefik_network >>"
|
||||
<%- endif %>
|
||||
# gRPC traffic needs an h2c backend service.
|
||||
- "traefik.http.routers.netbird-grpc.rule=Host(`<< public_hostname >>`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
|
||||
<%- if traefik_tls_enabled %>
|
||||
- "traefik.http.routers.netbird-grpc.entrypoints=<< traefik_tls_entrypoint >>"
|
||||
- "traefik.http.routers.netbird-grpc.tls=true"
|
||||
- "traefik.http.routers.netbird-grpc.tls.certresolver=<< traefik_tls_certresolver >>"
|
||||
<%- else %>
|
||||
- "traefik.http.routers.netbird-grpc.entrypoints=<< traefik_entrypoint >>"
|
||||
<%- endif %>
|
||||
- "traefik.http.routers.netbird-grpc.service=netbird-server-h2c"
|
||||
- "traefik.http.routers.netbird-backend.rule=Host(`<< public_hostname >>`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
|
||||
<%- if traefik_tls_enabled %>
|
||||
- "traefik.http.routers.netbird-backend.entrypoints=<< traefik_tls_entrypoint >>"
|
||||
- "traefik.http.routers.netbird-backend.tls=true"
|
||||
- "traefik.http.routers.netbird-backend.tls.certresolver=<< traefik_tls_certresolver >>"
|
||||
<%- else %>
|
||||
- "traefik.http.routers.netbird-backend.entrypoints=<< traefik_entrypoint >>"
|
||||
<%- endif %>
|
||||
- "traefik.http.routers.netbird-backend.service=netbird-server"
|
||||
- "traefik.http.services.netbird-server.loadbalancer.server.port=80"
|
||||
- "traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80"
|
||||
- "traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c"
|
||||
<%- endif %>
|
||||
networks:
|
||||
- netbird
|
||||
<%- if traefik_enabled and traefik_mode == 'existing' %>
|
||||
- << traefik_network >>
|
||||
<%- endif %>
|
||||
|
||||
networks:
|
||||
netbird:
|
||||
name: netbird
|
||||
driver: bridge
|
||||
<%- if traefik_enabled and traefik_mode == 'existing' %>
|
||||
<< traefik_network >>:
|
||||
external: true
|
||||
<%- endif %>
|
||||
|
||||
volumes:
|
||||
netbird_data:
|
||||
name: << data_volume_name >>
|
||||
driver: local
|
||||
<%- if traefik_enabled and traefik_mode == 'integrated' and traefik_tls_enabled %>
|
||||
netbird_traefik_letsencrypt:
|
||||
name: << letsencrypt_volume_name >>
|
||||
driver: local
|
||||
<%- endif %>
|
||||
@@ -0,0 +1,265 @@
|
||||
{
|
||||
"slug": "netbird",
|
||||
"kind": "compose",
|
||||
"metadata": {
|
||||
"name": "NetBird",
|
||||
"description": "Self-hosted NetBird control plane with embedded local user management and optional Traefik integration.",
|
||||
"tags": [
|
||||
"vpn",
|
||||
"wireguard",
|
||||
"traefik"
|
||||
],
|
||||
"icon": {
|
||||
"provider": "selfhst",
|
||||
"id": "netbird"
|
||||
},
|
||||
"draft": false,
|
||||
"version": {
|
||||
"name": "2026.04.14",
|
||||
"source_dep_name": "manual/netbird"
|
||||
}
|
||||
},
|
||||
"variables": [
|
||||
{
|
||||
"title": "General",
|
||||
"name": "general",
|
||||
"items": [
|
||||
{
|
||||
"name": "public_hostname",
|
||||
"type": "str",
|
||||
"title": "Public Hostname",
|
||||
"required": true,
|
||||
"description": "Public DNS hostname for the NetBird dashboard and API.",
|
||||
"config": {
|
||||
"placeholder": "netbird.example.com"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "restart_policy",
|
||||
"type": "enum",
|
||||
"title": "Restart Policy",
|
||||
"required": true,
|
||||
"default": "unless-stopped",
|
||||
"config": {
|
||||
"options": [
|
||||
"unless-stopped",
|
||||
"always",
|
||||
"on-failure",
|
||||
"no"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "NetBird",
|
||||
"name": "netbird",
|
||||
"items": [
|
||||
{
|
||||
"name": "stun_port",
|
||||
"type": "int",
|
||||
"title": "STUN UDP Port",
|
||||
"required": true,
|
||||
"default": 3478,
|
||||
"description": "Public UDP port exposed for the embedded STUN service.",
|
||||
"config": {
|
||||
"placeholder": "3478"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "netbird_log_level",
|
||||
"type": "enum",
|
||||
"title": "Log Level",
|
||||
"required": true,
|
||||
"default": "info",
|
||||
"description": "Log level used by the combined NetBird server.",
|
||||
"config": {
|
||||
"options": [
|
||||
"debug",
|
||||
"info",
|
||||
"warn",
|
||||
"error"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "disable_anonymous_metrics",
|
||||
"type": "bool",
|
||||
"title": "Disable Anonymous Metrics",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Disable NetBird anonymous usage metrics."
|
||||
},
|
||||
{
|
||||
"name": "disable_geolite_update",
|
||||
"type": "bool",
|
||||
"title": "Disable GeoLite Updates",
|
||||
"required": false,
|
||||
"default": false,
|
||||
"description": "Disable automatic GeoLite database updates."
|
||||
},
|
||||
{
|
||||
"name": "netbird_relay_auth_secret",
|
||||
"type": "secret",
|
||||
"title": "Relay Auth Secret",
|
||||
"required": true,
|
||||
"description": "Shared secret used internally by the embedded relay service.",
|
||||
"config": {
|
||||
"autogenerated": {
|
||||
"length": 32
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "netbird_store_encryption_key",
|
||||
"type": "secret",
|
||||
"title": "Store Encryption Key",
|
||||
"required": true,
|
||||
"description": "Base64-encoded 32-byte key used to protect local user data stored by the embedded IdP.",
|
||||
"config": {
|
||||
"autogenerated": {
|
||||
"kind": "base64",
|
||||
"bytes": 32
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Storage",
|
||||
"name": "storage",
|
||||
"items": [
|
||||
{
|
||||
"name": "data_volume_name",
|
||||
"type": "str",
|
||||
"title": "NetBird Data Volume",
|
||||
"required": true,
|
||||
"default": "netbird_data",
|
||||
"description": "Docker volume name for NetBird state, SQLite data, and embedded IdP files.",
|
||||
"config": {
|
||||
"placeholder": "netbird_data"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Traefik",
|
||||
"name": "traefik",
|
||||
"toggle": "traefik_enabled",
|
||||
"items": [
|
||||
{
|
||||
"name": "traefik_enabled",
|
||||
"type": "bool",
|
||||
"title": "Traefik",
|
||||
"required": false,
|
||||
"default": true
|
||||
},
|
||||
{
|
||||
"name": "traefik_mode",
|
||||
"type": "enum",
|
||||
"title": "Traefik Mode",
|
||||
"required": true,
|
||||
"default": "integrated",
|
||||
"config": {
|
||||
"options": [
|
||||
"integrated",
|
||||
"existing"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_network",
|
||||
"type": "str",
|
||||
"title": "Traefik Network",
|
||||
"required": true,
|
||||
"default": "traefik",
|
||||
"description": "External Docker network shared with the existing Traefik installation.",
|
||||
"needs": [
|
||||
"traefik_mode=existing"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "traefik"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "traefik_entrypoint",
|
||||
"type": "str",
|
||||
"title": "Entrypoint",
|
||||
"required": true,
|
||||
"default": "web",
|
||||
"description": "Traefik entrypoint name used by the NetBird routers when TLS is disabled.",
|
||||
"config": {
|
||||
"placeholder": "web"
|
||||
},
|
||||
"needs": [
|
||||
"traefik_tls_enabled=false"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "traefik_tls_enabled",
|
||||
"type": "bool",
|
||||
"title": "TLS",
|
||||
"required": false,
|
||||
"default": true
|
||||
},
|
||||
{
|
||||
"name": "traefik_tls_entrypoint",
|
||||
"type": "str",
|
||||
"title": "TLS Entrypoint",
|
||||
"required": true,
|
||||
"default": "websecure",
|
||||
"description": "Secure Traefik entrypoint name used by the NetBird routers.",
|
||||
"config": {
|
||||
"placeholder": "websecure"
|
||||
},
|
||||
"needs": [
|
||||
"traefik_tls_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "traefik_tls_certresolver",
|
||||
"type": "str",
|
||||
"title": "Cert Resolver",
|
||||
"required": true,
|
||||
"default": "letsencrypt",
|
||||
"description": "Traefik certificate resolver name used by the NetBird routers.",
|
||||
"config": {
|
||||
"placeholder": "letsencrypt"
|
||||
},
|
||||
"needs": [
|
||||
"traefik_tls_enabled=true"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "letsencrypt_email",
|
||||
"type": "str",
|
||||
"title": "ACME Email",
|
||||
"required": true,
|
||||
"description": "Email used for Let's Encrypt registration and expiry notices when the bundled Traefik instance is enabled.",
|
||||
"needs": [
|
||||
"traefik_tls_enabled=true",
|
||||
"traefik_mode=integrated"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "admin@example.com"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "letsencrypt_volume_name",
|
||||
"type": "str",
|
||||
"title": "Traefik ACME Volume",
|
||||
"required": true,
|
||||
"default": "netbird_traefik_letsencrypt",
|
||||
"description": "Docker volume name for Traefik ACME certificate storage.",
|
||||
"needs": [
|
||||
"traefik_tls_enabled=true",
|
||||
"traefik_mode=integrated"
|
||||
],
|
||||
"config": {
|
||||
"placeholder": "netbird_traefik_letsencrypt"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user