{
  "slug": "netbird",
  "kind": "compose",
  "metadata": {
    "name": "NetBird",
    "description": "Self-hosted NetBird control plane with embedded local user management and optional Traefik integration.",
    "tags": [
      "vpn",
      "wireguard",
      "traefik"
    ],
    "icon": {
      "provider": "selfhst",
      "id": "netbird"
    },
    "draft": false,
    "version": {
      "name": "2026.04.14",
      "source_dep_name": "manual/netbird"
    }
  },
  "variables": [
    {
      "title": "General",
      "name": "general",
      "items": [
        {
          "name": "public_hostname",
          "type": "str",
          "title": "Public Hostname",
          "required": true,
          "description": "Public DNS hostname for the NetBird dashboard and API.",
          "config": {
            "placeholder": "netbird.example.com"
          }
        },
        {
          "name": "restart_policy",
          "type": "enum",
          "title": "Restart Policy",
          "required": true,
          "default": "unless-stopped",
          "config": {
            "options": [
              "unless-stopped",
              "always",
              "on-failure",
              "no"
            ]
          }
        }
      ]
    },
    {
      "title": "NetBird",
      "name": "netbird",
      "items": [
        {
          "name": "stun_port",
          "type": "int",
          "title": "STUN UDP Port",
          "required": true,
          "default": 3478,
          "description": "Public UDP port exposed for the embedded STUN service.",
          "config": {
            "placeholder": "3478"
          }
        },
        {
          "name": "netbird_log_level",
          "type": "enum",
          "title": "Log Level",
          "required": true,
          "default": "info",
          "description": "Log level used by the combined NetBird server.",
          "config": {
            "options": [
              "debug",
              "info",
              "warn",
              "error"
            ]
          }
        },
        {
          "name": "disable_anonymous_metrics",
          "type": "bool",
          "title": "Disable Anonymous Metrics",
          "required": false,
          "default": false,
          "description": "Disable NetBird anonymous usage metrics."
        },
        {
          "name": "disable_geolite_update",
          "type": "bool",
          "title": "Disable GeoLite Updates",
          "required": false,
          "default": false,
          "description": "Disable automatic GeoLite database updates."
        },
        {
          "name": "netbird_relay_auth_secret",
          "type": "secret",
          "title": "Relay Auth Secret",
          "required": true,
          "description": "Shared secret used internally by the embedded relay service.",
          "config": {
            "autogenerated": {
              "length": 32
            }
          }
        },
        {
          "name": "netbird_store_encryption_key",
          "type": "secret",
          "title": "Store Encryption Key",
          "required": true,
          "description": "Base64-encoded 32-byte key used to protect local user data stored by the embedded IdP.",
          "config": {
            "autogenerated": {
              "kind": "base64",
              "bytes": 32
            }
          }
        }
      ]
    },
    {
      "title": "Storage",
      "name": "storage",
      "items": [
        {
          "name": "data_volume_name",
          "type": "str",
          "title": "NetBird Data Volume",
          "required": true,
          "default": "netbird_data",
          "description": "Docker volume name for NetBird state, SQLite data, and embedded IdP files.",
          "config": {
            "placeholder": "netbird_data"
          }
        }
      ]
    },
    {
      "title": "Traefik",
      "name": "traefik",
      "toggle": "traefik_enabled",
      "items": [
        {
          "name": "traefik_enabled",
          "type": "bool",
          "title": "Traefik",
          "required": false,
          "default": true
        },
        {
          "name": "traefik_mode",
          "type": "enum",
          "title": "Traefik Mode",
          "required": true,
          "default": "integrated",
          "config": {
            "options": [
              "integrated",
              "existing"
            ]
          }
        },
        {
          "name": "traefik_network",
          "type": "str",
          "title": "Traefik Network",
          "required": true,
          "default": "traefik",
          "description": "External Docker network shared with the existing Traefik installation.",
          "needs": [
            "traefik_mode=existing"
          ],
          "config": {
            "placeholder": "traefik"
          }
        },
        {
          "name": "traefik_entrypoint",
          "type": "str",
          "title": "Entrypoint",
          "required": true,
          "default": "web",
          "description": "Traefik entrypoint name used by the NetBird routers when TLS is disabled.",
          "config": {
            "placeholder": "web"
          },
          "needs": [
            "traefik_tls_enabled=false"
          ]
        },
        {
          "name": "traefik_tls_enabled",
          "type": "bool",
          "title": "TLS",
          "required": false,
          "default": true
        },
        {
          "name": "traefik_tls_entrypoint",
          "type": "str",
          "title": "TLS Entrypoint",
          "required": true,
          "default": "websecure",
          "description": "Secure Traefik entrypoint name used by the NetBird routers.",
          "config": {
            "placeholder": "websecure"
          },
          "needs": [
            "traefik_tls_enabled=true"
          ]
        },
        {
          "name": "traefik_tls_certresolver",
          "type": "str",
          "title": "Cert Resolver",
          "required": true,
          "default": "letsencrypt",
          "description": "Traefik certificate resolver name used by the NetBird routers.",
          "config": {
            "placeholder": "letsencrypt"
          },
          "needs": [
            "traefik_tls_enabled=true"
          ]
        },
        {
          "name": "letsencrypt_email",
          "type": "str",
          "title": "ACME Email",
          "required": true,
          "description": "Email used for Let's Encrypt registration and expiry notices when the bundled Traefik instance is enabled.",
          "needs": [
            "traefik_tls_enabled=true",
            "traefik_mode=integrated"
          ],
          "config": {
            "placeholder": "admin@example.com"
          }
        },
        {
          "name": "letsencrypt_volume_name",
          "type": "str",
          "title": "Traefik ACME Volume",
          "required": true,
          "default": "netbird_traefik_letsencrypt",
          "description": "Docker volume name for Traefik ACME certificate storage.",
          "needs": [
            "traefik_tls_enabled=true",
            "traefik_mode=integrated"
          ],
          "config": {
            "placeholder": "netbird_traefik_letsencrypt"
          }
        }
      ]
    }
  ]
}