[GH-ISSUE #5276] Dashboard stuck on loading screen #11094

Closed
opened 2026-08-05 01:28:28 -04:00 by saavagebueno · 2 comments
Owner

Originally created by @raku-cat on GitHub (Feb 8, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5276

Describe the problem

Hi all, was working on getting this all spun up using podman, i made quadlets for all the services following the guide here https://docs.netbird.io/selfhosted/configuration-files and then made the necessary adjustments as listed here https://www.authelia.com/integration/openid-connect/clients/netbird/#see-also and integrated pretty much anything else I could find here https://github.com/authelia/authelia/discussions/7185 and a couple other threads.
For some reason after all this though, once i start up the containers and navigate to what I assume should be the dashboard at https://netbird.apps.my.site it just has me sign in through authelia, and then directs me back to the root domain with an infinite loading screen.
The console shows no errors anywhere, the only real anomaly is it never seems to save cookies, but i'm not sure if thats really relevant. If I manually navigate to the /peers endpoint I can get an error then due to it requesting a key with none of the required params, but other than that I've got basically nothing.
If I try to sign in to it with a client, the client gives a "login failure" screen in the browser after signing in with the following error in my terminal i initiated the signin from:

login failed with: rpc error: code = Unknown desc = PKCE authorization flow failed: oauth2: "invalid_client" "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'none', however the OAuth 2.0 client registration does not allow this method."

However I assume this is more of a red herring than anything.

To Reproduce

Steps to reproduce the behavior:

  1. Start podman containers based on provided quadlets
  2. Load dashboard
  3. Get redirected to authelia sign in
  4. sign in
  5. infinite loading page

A clear and concise description of what you expected to happen.
I'm not really sure actually, the guide doesn't make it clear what should happen once you get to this point but based on the client setup guide I'm assuming it should be loading the dashboard?

Are you using NetBird Cloud?
No
Please specify whether you use NetBird Cloud or self-host NetBird's control plane.

NetBird version
na/latest

Is any other VPN software installed?
No
If yes, which one?

Debug output

Management server container logs 2026-02-09T02:03:30Z INFO management/internals/server/server.go:187: management server version 0.64.5

2026-02-09T02:03:30Z INFO management/internals/server/server.go:188: running HTTP server and gRPC server on the same port: [::]:80

2026-02-09T02:03:30Z DEBG version/update.go:133: fetching version info from https://pkgs.netbird.io/releases/latest/version

2026-02-09T02:03:52Z INFO [context: HTTP, requestID: d64k1237vi80008ohaug] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:03:52Z DEBG [requestID: d64k1237vi80008ohaug, context: HTTP] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

2026-02-09T02:04:06Z INFO [context: HTTP, requestID: d64k15j7vi80008ohav0] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:04:06Z DEBG [context: HTTP, requestID: d64k15j7vi80008ohav0] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

2026-02-09T02:04:07Z INFO [context: HTTP, requestID: d64k15r7vi80008ohavg] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:04:07Z DEBG [context: HTTP, requestID: d64k15r7vi80008ohavg] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

2026-02-09T02:04:32Z INFO [context: HTTP, requestID: d64k1c37vi80008ohb00] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:04:32Z DEBG [context: HTTP, requestID: d64k1c37vi80008ohb00] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

2026-02-09T02:04:33Z INFO [context: HTTP, requestID: d64k1cb7vi80008ohb0g] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:04:33Z DEBG [context: HTTP, requestID: d64k1cb7vi80008ohb0g] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

2026-02-09T02:04:37Z INFO [context: HTTP, requestID: d64k1db7vi80008ohb10] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:04:37Z DEBG [context: HTTP, requestID: d64k1db7vi80008ohb10] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

2026-02-09T02:06:31Z INFO [context: HTTP, requestID: d64k29r7vi80008ohb1g] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false

2026-02-09T02:06:31Z DEBG [context: HTTP, requestID: d64k29r7vi80008ohb1g] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200

This is the only container with really any relevant logs and its nothing basically, i do have debug logging turned on (i think, unclear how things are meant to be configured if you don't use the script, I'm not sure which variables mentioned in the docs that don't explicitly include them inside a .env or json/other config file aren't just something the script uses)

Screenshots

Image

Additional context
My understanding is this "infinite loading screen" is a generic "something is wrong" basically, typically with the management service. I've searched high and low through many issues and github discussions and also the docs themselves.
I mainly don't understand if I should have set things up to some nebulous "starting point" before integrating authelia, as the docs make it seem like it can be integrated from within the dash, I assume this is for just OIDC and not IDP though which would need to be configured externally.
Either way, here's my config files for my setup:
All keys, secrets, and the netbird instance url have been modified only for privacy, nothing has been removed, these files are copy pastes, so if its not there or unset there, that's how it is for me.
Container quadlets - https://gist.github.com/raku-cat/9ea3435fa0a1b3bdf2632169a32f4699
Container configs (where applicable) - https://gist.github.com/raku-cat/5e8e8ba2aafb84cbab4c73bbb24bc975
Nginx config - https://gist.github.com/raku-cat/c7a32c1432669a594abc427f6df71926
Authelia config - https://gist.github.com/raku-cat/e67edeb7431ed080695fc781d27d670b

Have you tried these troubleshooting steps?

  • [NA] Reviewed client troubleshooting (if applicable)
  • [Yes] Checked for newer NetBird versions
  • [Yes(all are stale or didn't help/seem like different issues)] Searched for similar issues on GitHub (including closed ones)
  • [NA] Restarted the NetBird client
  • [NA] Disabled other VPN software
  • [NA] Checked firewall settings
Originally created by @raku-cat on GitHub (Feb 8, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5276 **Describe the problem** Hi all, was working on getting this all spun up using podman, i made quadlets for all the services following the guide here https://docs.netbird.io/selfhosted/configuration-files and then made the necessary adjustments as listed here https://www.authelia.com/integration/openid-connect/clients/netbird/#see-also and integrated pretty much anything else I could find here https://github.com/authelia/authelia/discussions/7185 and a couple other threads. For some reason after all this though, once i start up the containers and navigate to what I assume should be the dashboard at `https://netbird.apps.my.site` it just has me sign in through authelia, and then directs me back to the root domain with an infinite loading screen. The console shows no errors anywhere, the only real anomaly is it never seems to save cookies, but i'm not sure if thats really relevant. If I manually navigate to the `/peers` endpoint I can get an error then due to it requesting a key with none of the required params, but other than that I've got basically nothing. If I try to sign in to it with a client, the client gives a "login failure" screen in the browser after signing in with the following error in my terminal i initiated the signin from: ``` login failed with: rpc error: code = Unknown desc = PKCE authorization flow failed: oauth2: "invalid_client" "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'none', however the OAuth 2.0 client registration does not allow this method." ``` However I assume this is more of a red herring than anything. **To Reproduce** Steps to reproduce the behavior: 1. Start podman containers based on provided quadlets 2. Load dashboard 3. Get redirected to authelia sign in 4. sign in 5. infinite loading page A clear and concise description of what you expected to happen. I'm not really sure actually, the guide doesn't make it clear what should happen once you get to this point but based on the client setup guide I'm assuming it should be loading the dashboard? **Are you using NetBird Cloud?** No Please specify whether you use NetBird Cloud or self-host NetBird's control plane. **NetBird version** na/latest **Is any other VPN software installed?** No If yes, which one? **Debug output** <details> <summary>Management server container logs</summary> 2026-02-09T02:03:30Z INFO management/internals/server/server.go:187: management server version 0.64.5 2026-02-09T02:03:30Z INFO management/internals/server/server.go:188: running HTTP server and gRPC server on the same port: [::]:80 2026-02-09T02:03:30Z DEBG version/update.go:133: fetching version info from https://pkgs.netbird.io/releases/latest/version 2026-02-09T02:03:52Z INFO [context: HTTP, requestID: d64k1237vi80008ohaug] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:03:52Z DEBG [requestID: d64k1237vi80008ohaug, context: HTTP] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 2026-02-09T02:04:06Z INFO [context: HTTP, requestID: d64k15j7vi80008ohav0] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:04:06Z DEBG [context: HTTP, requestID: d64k15j7vi80008ohav0] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 2026-02-09T02:04:07Z INFO [context: HTTP, requestID: d64k15r7vi80008ohavg] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:04:07Z DEBG [context: HTTP, requestID: d64k15r7vi80008ohavg] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 2026-02-09T02:04:32Z INFO [context: HTTP, requestID: d64k1c37vi80008ohb00] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:04:32Z DEBG [context: HTTP, requestID: d64k1c37vi80008ohb00] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 2026-02-09T02:04:33Z INFO [context: HTTP, requestID: d64k1cb7vi80008ohb0g] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:04:33Z DEBG [context: HTTP, requestID: d64k1cb7vi80008ohb0g] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 2026-02-09T02:04:37Z INFO [context: HTTP, requestID: d64k1db7vi80008ohb10] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:04:37Z DEBG [context: HTTP, requestID: d64k1db7vi80008ohb10] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 2026-02-09T02:06:31Z INFO [context: HTTP, requestID: d64k29r7vi80008ohb1g] management/server/http/handlers/instance/instance_handler.go:49: instance setup status: false 2026-02-09T02:06:31Z DEBG [context: HTTP, requestID: d64k29r7vi80008ohb1g] management/server/telemetry/http_api_metrics.go:214: request GET /api/instance took 0 ms and finished with status 200 </details> This is the only container with really any relevant logs and its nothing basically, i do have debug logging turned on (i think, unclear how things are meant to be configured if you don't use the script, I'm not sure which variables mentioned in the docs that don't explicitly include them inside a .env or json/other config file aren't just something the script uses) **Screenshots** <img width="1852" height="1080" alt="Image" src="https://github.com/user-attachments/assets/123212d1-c964-4fe7-aa89-6ee02b960a66" /> **Additional context** My understanding is this "infinite loading screen" is a generic "something is wrong" basically, typically with the management service. I've searched high and low through many issues and github discussions and also the docs themselves. I mainly don't understand if I should have set things up to some nebulous "starting point" before integrating authelia, as the docs make it seem like it can be integrated from within the dash, I assume this is for just OIDC and not IDP though which would need to be configured externally. Either way, here's my config files for my setup: All keys, secrets, and the netbird instance url have been modified only for privacy, nothing has been removed, these files are copy pastes, so if its not there or unset there, that's how it is for me. Container quadlets - https://gist.github.com/raku-cat/9ea3435fa0a1b3bdf2632169a32f4699 Container configs (where applicable) - https://gist.github.com/raku-cat/5e8e8ba2aafb84cbab4c73bbb24bc975 Nginx config - https://gist.github.com/raku-cat/c7a32c1432669a594abc427f6df71926 Authelia config - https://gist.github.com/raku-cat/e67edeb7431ed080695fc781d27d670b **Have you tried these troubleshooting steps?** - [NA] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [Yes] Checked for newer NetBird versions - [Yes(all are stale or didn't help/seem like different issues)] Searched for similar issues on GitHub (including closed ones) - [NA] Restarted the NetBird client - [NA] Disabled other VPN software - [NA] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:28:28 -04:00
Author
Owner

@raku-cat commented on GitHub (Feb 9, 2026):

So after posting in the original discussion as well i got a reply:
https://github.com/authelia/authelia/discussions/7185#discussioncomment-15737471
With this I adjusted my uris to /auth and /silent-auth as mentioned, and this got things working just a little more.
At this point I can consistently get a sign in or authorize page from authelia and no longer get any errors in connection to it querying it.
Now after signin, it tries to direct me to the dashboard and now repeatedly shows an error:

Image

And when I check the management container logs, I do actually have something there:

2026-02-09T05:50:39Z DEBG [context: HTTP, requestID: d64nbburtns000aovg1g] management/server/telemetry/http_api_metrics.go:214: request GET /api/users took 2 ms and finished with status 401
2026-02-09T05:50:44Z DEBG [context: HTTP, requestID: d64nbd6rtns000aovg20] shared/auth/jwt/validator.go:140: keys refreshed, new UTC expiration time: 2026-02-09 05:50:44.426907868 +0000 UTC
2026-02-09T05:50:44Z ERRO [context: HTTP, requestID: d64nbd6rtns000aovg20] shared/auth/jwt/validator.go:191: token could not be parsed: token has invalid claims: token has invalid audience
2026-02-09T05:50:44Z ERRO [context: HTTP, requestID: d64nbd6rtns000aovg20] management/server/http/middleware/auth_middleware.go:91: Error when validating JWT: token could not be parsed: token has invalid claims: token has invalid audience
2026-02-09T05:50:44Z ERRO [requestID: d64nbd6rtns000aovg20, context: HTTP] shared/management/http/util/util.go:85: got a handler error: token invalid
2026-02-09T05:50:44Z ERRO [context: HTTP, requestID: d64nbd6rtns000aovg20] management/server/telemetry/http_api_metrics.go:201: HTTP response d64nbd6rtns000aovg20: GET /api/users/current status 401
2026-02-09T05:50:44Z DEBG [context: HTTP, requestID: d64nbd6rtns000aovg20] management/server/telemetry/http_api_metrics.go:214: request GET /api/users/current took 4 ms and finished with status 401

Which is more than I got before, though this error is even less helpful as there are no mentions of this specific variation of it anywhere, similar issues like this one https://github.com/netbirdio/netbird/issues/2941 are all related to authentik and specific configuration quirks related to authentik, so this is a bit of a dead end for me, will be continuing to work on this though.

Edit to add as its directly related to this update:
Trying to login with the netbird client now does give a login success screen:

Image But in the console it shows; `Error: daemon up failed: sso login failed: waiting sso login failed with: rpc error: code = Unknown desc = authentication failed: invalid access token - invalid JWT token audience field` Which is practically the same error, again though I'm not sure what could be causing this.
<!-- gh-comment-id:3869552419 --> @raku-cat commented on GitHub (Feb 9, 2026): So after posting in the original discussion as well i got a reply: https://github.com/authelia/authelia/discussions/7185#discussioncomment-15737471 With this I adjusted my uris to `/auth` and `/silent-auth` as mentioned, and this got things working just a little more. At this point I can consistently get a sign in or authorize page from authelia and no longer get any errors in connection to it querying it. Now after signin, it tries to direct me to the dashboard and now repeatedly shows an error: <img width="661" height="151" alt="Image" src="https://github.com/user-attachments/assets/81dce3c7-983c-403e-8f7a-c52d6c9f82e1" /> And when I check the management container logs, I do actually have something there: ``` 2026-02-09T05:50:39Z DEBG [context: HTTP, requestID: d64nbburtns000aovg1g] management/server/telemetry/http_api_metrics.go:214: request GET /api/users took 2 ms and finished with status 401 2026-02-09T05:50:44Z DEBG [context: HTTP, requestID: d64nbd6rtns000aovg20] shared/auth/jwt/validator.go:140: keys refreshed, new UTC expiration time: 2026-02-09 05:50:44.426907868 +0000 UTC 2026-02-09T05:50:44Z ERRO [context: HTTP, requestID: d64nbd6rtns000aovg20] shared/auth/jwt/validator.go:191: token could not be parsed: token has invalid claims: token has invalid audience 2026-02-09T05:50:44Z ERRO [context: HTTP, requestID: d64nbd6rtns000aovg20] management/server/http/middleware/auth_middleware.go:91: Error when validating JWT: token could not be parsed: token has invalid claims: token has invalid audience 2026-02-09T05:50:44Z ERRO [requestID: d64nbd6rtns000aovg20, context: HTTP] shared/management/http/util/util.go:85: got a handler error: token invalid 2026-02-09T05:50:44Z ERRO [context: HTTP, requestID: d64nbd6rtns000aovg20] management/server/telemetry/http_api_metrics.go:201: HTTP response d64nbd6rtns000aovg20: GET /api/users/current status 401 2026-02-09T05:50:44Z DEBG [context: HTTP, requestID: d64nbd6rtns000aovg20] management/server/telemetry/http_api_metrics.go:214: request GET /api/users/current took 4 ms and finished with status 401 ``` Which is more than I got before, though this error is even less helpful as there are no mentions of this specific variation of it anywhere, similar issues like this one https://github.com/netbirdio/netbird/issues/2941 are all related to authentik and specific configuration quirks related to authentik, so this is a bit of a dead end for me, will be continuing to work on this though. Edit to add as its directly related to this update: Trying to login with the netbird client now does give a login success screen: <img width="835" height="493" alt="Image" src="https://github.com/user-attachments/assets/0b68274b-e609-462c-a8e9-87002de7a746" /> But in the console it shows; `Error: daemon up failed: sso login failed: waiting sso login failed with: rpc error: code = Unknown desc = authentication failed: invalid access token - invalid JWT token audience field` Which is practically the same error, again though I'm not sure what could be causing this.
Author
Owner

@raku-cat commented on GitHub (Feb 9, 2026):

Here happy to report I've gotten my install working!
The key things I needed to update in addition to the uri, i checked the request which was failing, copied the authorization beraer, and used jwt.io to decode it, and checked which audience it was using, which was my client ID (in my case, was not netbird, which caused some confusion for me while reading guides).
After updating the audience to this ID in all relevant spots in netbird's side, and the same in authelia, everything is working!
I think the biggest thing was actually the peers and add-peers redirect URIs being used, the client id and audience mixup was purely on my end.

<!-- gh-comment-id:3869881816 --> @raku-cat commented on GitHub (Feb 9, 2026): Here happy to report I've gotten my install working! The key things I needed to update in addition to the uri, i checked the request which was failing, copied the authorization beraer, and used jwt.io to decode it, and checked which audience it was using, which was my client ID (in my case, was not netbird, which caused some confusion for me while reading guides). After updating the audience to this ID in all relevant spots in netbird's side, and the same in authelia, everything is working! I think the biggest thing was actually the `peers` and `add-peers` redirect URIs being used, the client id and audience mixup was purely on my end.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11094