Viktor Liu
0765352c99
[management] Persist proxy capabilities to database ( #5720 )
2026-03-30 13:03:42 +02:00
Bethuel Mmbaga
7be8752a00
[management] Add notification endpoints ( #5590 )
2026-03-26 18:26:33 +03:00
Pascal Fischer
a1858a9cb7
[management] recover proxies after cleanup if heartbeat is still running ( #5617 )
2026-03-18 11:48:38 +01:00
Viktor Liu
212b34f639
[management] Add GET /reverse-proxies/clusters endpoint ( #5611 )
2026-03-18 11:15:56 +08:00
Viktor Liu
3e6baea405
[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) ( #5530 )
2026-03-13 18:36:44 +01:00
Pascal Fischer
5c20f13c48
[management] fix domain uniqueness ( #5529 )
2026-03-07 10:46:37 +01:00
Maycon Santos
8e7b016be2
[management] Replace in-memory expose tracker with SQL-backed operations ( #5494 )
...
The expose tracker used sync.Map for in-memory TTL tracking of active expose sessions, which broke and lost all sessions on restart.
Replace with SQL-backed operations that reuse the existing meta_last_renewed_at column:
- Add store methods: RenewEphemeralService, GetExpiredEphemeralServices, CountEphemeralServicesByPeer, EphemeralServiceExists
- Move duplicate/limit checks inside a transaction with row-level locking (SELECT ... FOR UPDATE) to prevent concurrent bypass
- Reaper re-checks expiry under row lock to avoid deleting a just-renewed service and prevent duplicate event emission
- Add composite index on (source, source_peer) for efficient queries
- Batch-limit and column-select the reaper query to avoid DB/GC spikes
- Filter out malformed rows with empty source_peer
2026-03-04 18:15:13 +01:00
Pascal Fischer
d7c8e37ff4
[management] Store connected proxies in DB ( #5472 )
...
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com >
2026-03-03 18:39:46 +01:00
Pascal Fischer
82da606886
[management] Add explicit target delete on service removal ( #5420 )
2026-03-02 18:25:44 +01:00
Maycon Santos
f341d69314
[management] Add custom domain counts and service metrics to self-hosted metrics ( #5414 )
2026-02-24 15:21:14 +01:00
Pascal Fischer
5d171f181a
[proxy] Send proxy updates on account delete ( #5375 )
2026-02-23 16:08:28 +01:00
Pascal Fischer
36752a8cbb
[proxy] add access log cleanup ( #5376 )
2026-02-20 00:11:28 +01:00
Pascal Fischer
f53155562f
[management, reverse proxy] Add reverse proxy feature ( #5291 )
...
* implement reverse proxy
---------
Co-authored-by: Alisdair MacLeod <git@alisdairmacleod.co.uk >
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com >
Co-authored-by: Eduard Gert <kontakt@eduardgert.de >
Co-authored-by: Viktor Liu <viktor@netbird.io >
Co-authored-by: Diego Noguês <diego.sure@gmail.com >
Co-authored-by: Diego Noguês <49420+diegocn@users.noreply.github.com >
Co-authored-by: Bethuel Mmbaga <bethuelmbaga12@gmail.com >
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com >
Co-authored-by: Ashley Mensah <ashleyamo982@gmail.com >
2026-02-13 19:37:43 +01:00
Misha Bragin
64b849c801
[self-hosted] add netbird server ( #5232 )
...
* Unified NetBird combined server (Management, Signal, Relay, STUN) as a single executable with richer YAML configuration, validation, and defaults.
* Official Dockerfile/image for single-container deployment.
* Optional in-process profiling endpoint for diagnostics.
* Multiplexing to route HTTP/gRPC/WebSocket traffic via one port; runtime hooks to inject custom handlers.
* **Chores**
* Updated deployment scripts, compose files, and reverse-proxy templates to target the combined server; added example configs and getting-started updates.
2026-02-12 19:24:43 +01:00
Misha Bragin
7d791620a6
Add user invite link feature for embedded IdP ( #5157 )
2026-01-27 09:42:20 +01:00
Zoltan Papp
58daa674ef
[Management/Client] Trigger debug bundle runs from API/Dashboard ( #4592 ) ( #4832 )
...
This PR adds the ability to trigger debug bundle generation remotely from the Management API/Dashboard.
2026-01-19 11:22:16 +01:00
Bethuel Mmbaga
067c77e49e
[management] Add custom dns zones ( #4849 )
2026-01-16 12:12:05 +03:00
Vlad
684fc0d2a2
[management] fix the issue with duplicated peers with the same key ( #5053 )
2026-01-09 11:49:26 +01:00
Misha Bragin
e586c20e36
[management, infrastructure, idp] Simplified IdP Management - Embedded IdP ( #5008 )
...
Embed Dex as a built-in IdP to simplify self-hosting setup.
Adds an embedded OIDC Identity Provider (Dex) with local user management and optional external IdP connectors (Google/GitHub/OIDC/SAML), plus device-auth flow for CLI login. Introduces instance onboarding/setup endpoints (including owner creation), field-level encryption for sensitive user data, a streamlined self-hosting provisioning script, and expanded APIs + test coverage for IdP management.
more at https://github.com/netbirdio/netbird/pull/5008#issuecomment-3718987393
2026-01-07 14:52:32 +01:00
Pascal Fischer
1d2c7776fd
[management] apply login filter only for setup key peers ( #4943 )
2025-12-30 10:46:00 +01:00
Bethuel Mmbaga
932c02eaab
[management] Approve all pending peers when peer approval is disabled ( #4806 )
2025-12-12 18:49:57 +03:00
Vlad
6aa4ba7af4
[management] incremental network map builder ( #4753 )
2025-11-07 10:44:46 +01:00
Viktor Liu
b5daec3b51
[client,signal,management] Add browser client support ( #4415 )
2025-10-01 20:10:11 +02:00
Bethuel Mmbaga
5113c70943
[management] Extends integration and peers manager ( #4450 )
2025-09-06 13:13:49 +03:00
Pascal Fischer
5e273c121a
[management] Remove store locks 3 ( #4390 )
2025-08-21 20:47:28 +02:00
Pascal Fischer
f9d64a06c2
[management] Remove all store locks from grpc side ( #4374 )
2025-08-20 12:41:14 +02:00
Pascal Fischer
6a3846a8b7
[management] Remove save account calls ( #4349 )
2025-08-18 12:37:20 +02:00
Pascal Fischer
5860e5343f
[management] Rework DB locks ( #4291 )
2025-08-06 18:55:14 +02:00
Pascal Fischer
552dc60547
[management] migrate group peers into seperate table ( #4096 )
2025-08-01 12:22:07 +02:00
Maycon Santos
2c81cf2c1e
[management] Add account onboarding ( #4084 )
...
This PR introduces a new onboarding feature to handle such flows in the dashboard by defining an AccountOnboarding model, persisting it in the store, exposing CRUD operations in the manager and HTTP handlers, and updating API schemas and tests accordingly.
Add AccountOnboarding struct and embed it in Account
Extend Store and DefaultAccountManager with onboarding methods and SQL migrations
Update HTTP handlers, API types, OpenAPI spec, and add end-to-end tests
2025-07-03 09:01:32 +02:00
Pascal Fischer
22678bce7f
[management] add uniqueness constraint for peer ip and label and optimize generation ( #4042 )
2025-07-02 18:13:10 +02:00
Ali Amer
d9402168ad
[management] Add option to disable default all-to-all policy ( #3970 )
...
This PR introduces a new configuration option `DisableDefaultPolicy` that prevents the creation of the default all-to-all policy when new accounts are created. This is useful for automation scenarios where explicit policies are preferred.
### Key Changes:
- Added DisableDefaultPolicy flag to the management server config
- Modified account creation logic to respect this flag
- Updated all test cases to explicitly pass the flag (defaulting to false to maintain backward compatibility)
- Propagated the flag through the account manager initialization chain
### Testing:
- Verified default behavior remains unchanged when flag is false
- Confirmed no default policy is created when flag is true
- All existing tests pass with the new parameter
2025-07-02 02:41:59 +02:00
Bethuel Mmbaga
7c6b85b4cb
[management] Refactor routes to use store methods ( #2928 )
2025-06-18 16:40:29 +03:00
Bethuel Mmbaga
4ee1635baa
[management] Propagate user groups when group propagation setting is re-enabled ( #3912 )
2025-06-11 14:32:16 +03:00
Bethuel Mmbaga
5523040acd
[management] Add correlated network traffic event schema ( #3680 )
2025-05-27 13:47:53 +03:00
Pedro Maia Costa
5bed6777d5
[management] force account id on save groups update ( #3850 )
2025-05-23 14:42:42 +01:00
Pascal Fischer
207fa059d2
[management] make locking strength clause optional ( #3844 )
2025-05-19 16:42:47 +02:00
Pascal Fischer
701c13807a
[management] add flag to disable auto-migration ( #3840 )
2025-05-19 13:36:24 +02:00
Pascal Fischer
055df9854c
[management] add gorm tag for primary key for the networks objects ( #3758 )
2025-05-04 20:58:04 +02:00
Bethuel Mmbaga
d8dc107bee
[management] Skip IdP cache warm-up on Redis if data exists ( #3733 )
...
* Add Redis cache check to skip warm-up on startup if cache is already populated
* Refactor Redis test container setup for reusability
2025-04-28 15:10:40 +03:00
Misha Bragin
c69df13515
[management] Add account meta ( #3724 )
2025-04-23 18:44:22 +02:00
Pedro Maia Costa
cbec7bda80
[management] permission manager validate account access ( #3444 )
2025-03-30 17:08:22 +02:00
Maycon Santos
a4f04f5570
[management] fix extend call and move config to types ( #3575 )
...
This PR fixes configuration inconsistencies and updates the store engine type usage throughout the management code. Key changes include:
- Replacing outdated server.Config references with types.Config and updating related flag variables (e.g. types.MgmtConfigPath).
- Converting engine constants (SqliteStoreEngine, PostgresStoreEngine, MysqlStoreEngine) to use types.Engine for consistent type–safety.
- Adjusting various test and migration code paths to correctly reference the new configuration and engine types.
2025-03-27 13:04:50 +01:00
Maycon Santos
c02e236196
[client,management] add netflow support to client and update management ( #3414 )
...
adds NetFlow functionality to track and log network traffic information between peers, with features including:
- Flow logging for TCP, UDP, and ICMP traffic
- Integration with connection tracking system
- Resource ID tracking in NetFlow events
- DNS and exit node collection configuration
- Flow API and Redis cache in management
- Memory-based flow storage implementation
- Kernel conntrack counters and userspace counters
- TCP state machine improvements for more accurate tracking
- Migration from net.IP to netip.Addr in the userspace firewall
2025-03-20 17:05:48 +01:00
Viktor Liu
fc1da94520
[client, management] Add port forwarding ( #3275 )
...
Add initial support to ingress ports on the client code.
- new types where added
- new protocol messages and controller
2025-03-09 16:06:43 +01:00
Pascal Fischer
c8a558f797
[tests] Retry mysql store creation on reused containers ( #3370 )
2025-02-24 13:40:11 +01:00
Pedro Maia Costa
b64bee35fa
[management] faster server bootstrap ( #3365 )
...
Faster server bootstrap by counting accounts rather than fetching all from storage in the account manager instantiation.
This change moved the deprecated need to ensure accounts have an All group to tests instead.
2025-02-22 11:31:39 +01:00
Pascal Fischer
7e6beee7f6
[management] optimize test execution ( #3204 )
2025-02-19 19:13:45 +01:00
Pascal Fischer
2a864832c6
[management] remove gorm preparestmt from all DB connections ( #3292 )
2025-02-18 15:24:17 +01:00
Bethuel Mmbaga
4cdb2e533a
[management] Refactor users to use store methods ( #2917 )
...
* Refactor setup key handling to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* add lock to get account groups
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* add check for regular user
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* get only required groups for auto-group validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* add account lock and return auto groups map on validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* refactor account peers update
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor groups to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* refactor GetGroupByID and add NewGroupNotFoundError
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add AddPeer and RemovePeer methods to Group struct
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Preserve store engine in SqlStore transactions
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Run groups ops in transaction
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix missing group removed from setup key activity
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor posture checks to remove get and save account
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix refactor
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix sonar
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Change setup key log level to debug for missing group
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Retrieve modified peers once for group events
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor policy get and save account to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Retrieve policy groups and posture checks once for validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix typo
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add policy tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor anyGroupHasPeers to retrieve all groups once
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor dns settings to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add account locking and merge group deletion methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor name server groups to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add peer store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor ephemeral peers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add lock for peer store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor peer handlers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor peer to use store methods
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix typo
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add locks and remove log
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* run peer ops in transaction
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* remove duplicate store method
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix peer fields updated after save
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Use update strength and simplify check
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* prevent changing ruleID when not empty
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* prevent duplicate rules during updates
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix lint
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor auth middleware
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor account methods and mock
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor user and PAT handling
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Remove db query context and fix get user by id
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix database transaction locking issue
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Use UTC time in test
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add account locks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix prevent users from creating PATs for other users
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add store locks and prevent fetching setup keys peers when retrieving user peers with empty userID
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add missing tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor test names and remove duplicate TestPostgresql_SavePeerStatus
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add account locks and remove redundant ephemeral check
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Retrieve all groups for peers and restrict groups for regular users
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix store tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* use account object to get validated peers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Improve peer performance
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Get account direct from store without buffer
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Add get peer groups tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Adjust benchmarks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Adjust benchmarks
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* [management] Update benchmark workflow (#3181 )
* update local benchmark expectations
* update cloud expectations
* Add status error for generic result error
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Use integrated validator direct
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* update expectations
* update expectations
* update expectations
* Refactor peer scheduler to retry every 3 seconds on errors
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* update expectations
* fix validator
* fix validator
* fix validator
* update timeouts
* Refactor ToGroupsInfo to process slices of groups
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* update expectations
* update expectations
* update expectations
* Bump integrations version
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor GetValidatedPeers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* go mod tidy
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Use peers and groups map for peers validation
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* remove mysql from api benchmark tests
* Fix merge
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix blocked db calls on user auto groups update
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* update expectations
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* update expectations
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Skip user check for system initiated peer deletion
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Remove context in db calls
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* update expectations
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* [management] Improve group peer/resource counting (#3192 )
* Fix sonar
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Adjust bench expectations
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Rename GetAccountInfoFromPAT to GetTokenInfo
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Remove global account lock for ListUsers
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* build userinfo after updating users in db
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* [management] Optimize user bulk deletion (#3315 )
* refactor building user infos
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* fix tests
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* remove unused code
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Refactor GetUsersFromAccount to return a map of UserInfo instead of a slice
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Export BuildUserInfosForAccount to account manager
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Fetch account user info once for bulk users save
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Update user deletion expectations
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Set max open conns for activity store
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
* Update bench expectations
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
---------
Signed-off-by: bcmmbaga <bethuelmbaga12@gmail.com >
Co-authored-by: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com >
Co-authored-by: Pascal Fischer <pascal@netbird.io >
Co-authored-by: Pedro Costa <550684+pnmcosta@users.noreply.github.com >
2025-02-17 21:43:12 +03:00