DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #5434] Reverse Proxy: Add field for advanced Traefik configuration and possibility to add static content #10555

New Issue
Open
opened 2026-08-05 01:26:20 -04:00 by saavagebueno · 5 comments
saavagebueno commented 2026-08-05 01:26:20 -04:00
Owner
Copy Link

Originally created by @HeavyTobi on GitHub (Feb 24, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5434

Is your feature request related to a problem? Please describe.
The current Reverse Proxy implementation is a great start for simple forwarding, but it lacks the flexibility needed for real-world application hosting. Specifically:

  • Manual Path Handling: I cannot serve static responses for discovery services (e.g., Matrix .well-known files) without spinning up a separate web server.
  • Double Login: When using NetBird's built-in SSO/Auth, the identity of the authenticated user is not passed to the backend. This forces users to log in twice (once for NetBird, once for the app, e.g., Paperless-ngx), which is a poor user experience.

Describe the solution you'd like
I would like to see the following enhancements to the Reverse Proxy configuration:

  • Static Value Path-Mapping: Ability to define a specific path (e.g., /.well-known/matrix/client) that returns a static text/JSON response directly from the proxy.
  • Identity Propagation via HTTP Headers: An option to inject headers into the request sent to the backend. Ideally, this should allow passing NetBird/OIDC variables. For example, being able to set a header like Remote-User: {{user_email}} or X-Webauth-User: {{user_id}}. This would allow services like Paperless-ngx or Nextcloud to trust the NetBird authentication for Single Sign-On.
  • Advanced Snippets (Optional but preferred): Since NetBird uses Traefik internally, providing a "Custom Middleware" or "Header Snippet" field where users can input custom header logic (similar to Nginx's proxy_set_header) would offer maximum flexibility for power users.

Describe alternatives you've considered

  • External Proxy (Nginx/Traefik): Setting up a manual proxy behind or in front of NetBird. This adds significant architectural complexity and makes the built-in NetBird proxy feature redundant.
  • Sidecar Containers: Running a small Nginx instance just to serve static .well-known files, which is inefficient.

Additional context

  • Example Use Case 1: Serving {"m.homeserver": {"base_url": "https://matrix.example.com"}} at /.well-known/matrix/client.
  • Example Use Case 2: Passing X-Remote-User to a backend service to enable "Header-based Authentication" so the user is automatically logged in after the NetBird SSO check.
Originally created by @HeavyTobi on GitHub (Feb 24, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5434 **Is your feature request related to a problem? Please describe.** The current Reverse Proxy implementation is a great start for simple forwarding, but it lacks the flexibility needed for real-world application hosting. Specifically: - Manual Path Handling: I cannot serve static responses for discovery services (e.g., Matrix .well-known files) without spinning up a separate web server. - Double Login: When using NetBird's built-in SSO/Auth, the identity of the authenticated user is not passed to the backend. This forces users to log in twice (once for NetBird, once for the app, e.g., Paperless-ngx), which is a poor user experience. **Describe the solution you'd like** I would like to see the following enhancements to the Reverse Proxy configuration: - **Static Value Path-Mapping:** Ability to define a specific path (e.g., /.well-known/matrix/client) that returns a static text/JSON response directly from the proxy. - **Identity Propagation via HTTP Headers:** An option to inject headers into the request sent to the backend. Ideally, this should allow passing NetBird/OIDC variables. For example, being able to set a header like Remote-User: {{user_email}} or X-Webauth-User: {{user_id}}. This would allow services like Paperless-ngx or Nextcloud to trust the NetBird authentication for Single Sign-On. - **Advanced Snippets (Optional but preferred):** Since NetBird uses Traefik internally, providing a "Custom Middleware" or "Header Snippet" field where users can input custom header logic (similar to Nginx's proxy_set_header) would offer maximum flexibility for power users. **Describe alternatives you've considered** - **External Proxy (Nginx/Traefik):** Setting up a manual proxy behind or in front of NetBird. This adds significant architectural complexity and makes the built-in NetBird proxy feature redundant. - **Sidecar Containers:** Running a small Nginx instance just to serve static .well-known files, which is inefficient. **Additional context** - **Example Use Case 1**: Serving ```{"m.homeserver": {"base_url": "https://matrix.example.com"}}``` at /.well-known/matrix/client. - Example Use Case 2: Passing X-Remote-User to a backend service to enable "Header-based Authentication" so the user is automatically logged in after the NetBird SSO check.
saavagebueno added the feature-request label 2026-08-05 01:26:20 -04:00
saavagebueno commented 2026-08-05 01:26:20 -04:00
Author
Owner
Copy Link

@BLACK4585 commented on GitHub (Mar 7, 2026):

I'd also like to suggest a feature to handle paths further than just returning strings.
For example Nextcloud needs two paths to be redirected behind a reverse proxy to properly support CardDav and CalDav. This is how it looks currently in my Caddyfile:

redir /.well-known/carddav /remote.php/dav/ 301
redir /.well-known/caldav /remote.php/dav/ 301

Would be awesome to recreate this in NB in the UI.

<!-- gh-comment-id:4017304808 --> @BLACK4585 commented on GitHub (Mar 7, 2026): I'd also like to suggest a feature to handle paths further than just returning strings. For example Nextcloud needs two paths to be redirected behind a reverse proxy to properly support CardDav and CalDav. This is how it looks currently in my Caddyfile: ``` Caddyfile redir /.well-known/carddav /remote.php/dav/ 301 redir /.well-known/caldav /remote.php/dav/ 301 ``` Would be awesome to recreate this in NB in the UI.
saavagebueno commented 2026-08-05 01:26:20 -04:00
Author
Owner
Copy Link

@MobileManiC commented on GitHub (Mar 26, 2026):

Would love to see SSO username being propagated by sending a Header to the backend service - only then it can be a real SSO solution. It's absolute killer feature for me.

<!-- gh-comment-id:4138684876 --> @MobileManiC commented on GitHub (Mar 26, 2026): Would love to see SSO username being propagated by sending a Header to the backend service - only then it can be a real SSO solution. It's absolute killer feature for me.
saavagebueno commented 2026-08-05 01:26:20 -04:00
Author
Owner
Copy Link

@lixmal commented on GitHub (Mar 26, 2026):

Just as a note here, netbird's proxy does not use traefik internally so the snippets won't work. However, for the self hosted version with traefik in front (tls passthrough), some plugins might work, e.g. access control, crowdsec.

<!-- gh-comment-id:4139495249 --> @lixmal commented on GitHub (Mar 26, 2026): Just as a note here, netbird's proxy does _not_ use traefik internally so the snippets won't work. However, for the self hosted version with traefik in front (tls passthrough), some plugins might work, e.g. access control, crowdsec.
saavagebueno commented 2026-08-05 01:26:20 -04:00
Author
Owner
Copy Link

@MobileManiC commented on GitHub (Apr 9, 2026):

Identity Propagation via HTTP Headers mentioned above would make sense, just to allow to define some placeholder variable to fill in current SSO username into the variable. Something like this:
Image

<!-- gh-comment-id:4217187579 --> @MobileManiC commented on GitHub (Apr 9, 2026): **Identity Propagation via HTTP Headers** mentioned above would make sense, just to allow to define some placeholder variable to fill in current SSO username into the variable. Something like this: <img width="600" alt="Image" src="https://github.com/user-attachments/assets/2a8114ea-ad4d-439a-a2a9-ad96fdf366b3" />
saavagebueno commented 2026-08-05 01:26:20 -04:00
Author
Owner
Copy Link

@azerioxal commented on GitHub (May 22, 2026):

I'd like the ability to inject the SSO username into a header as well. Basically removing the need for any other forward auth middleware.

<!-- gh-comment-id:4521005982 --> @azerioxal commented on GitHub (May 22, 2026): I'd like the ability to inject the SSO username into a header as well. Basically removing the need for any other forward auth middleware.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10555
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?