[GH-ISSUE #5450] Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container. #11228

New Issue

saavagebueno · 2026-08-05T01:28:59-04:00

saavagebueno commented

2026-08-05 01:28:59 -04:00

Originally created by @heymoe on GitHub (Feb 25, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5450

Is your feature request related to a problem? Please describe.

There could be a deployment scenario where one might not have the ability to make the needed changes to satisfy the requirements to allow the currently supported "tls-alpn-01" and "http-01" challenge methods to be successful. An example might be having an upstream firewall that you don't have to ability to manage that is blocking the inbound ACME connections that are trying to do the verification. Having the ability to use the DNS challenge method (dns-01) would provide an alternative method of getting SSL certs issued.

Updating the Traefik container to use the DNS challenge method was pretty simple. For example to enable DNS challenge using Cloudflare you would modify the commands section in the docker-compose.yml for the Traefik container like so:

#      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.provider=cloudflare"
      - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53"

and then add the necessary environment variables required for the specific DNS provider:

    environment:
      - CF_API_EMAIL=<email address>
      - CF_DNS_API_TOKEN=<your token>

There doesn't seem to be a way to make similar changes for the proxy container.

Describe the solution you'd like

Enable the ability to configure use the ACME DNS challenge methods in addition to the already supported "tls-alpn-01" and "http-01" methods. I could see this being implemented by adding 2 additional NB_PROXY environmental variable to configure the DNS challenge (e.g: NB_PROXY_ACME_DNS_CHALLENGE_PROVIDER and NB_PROXY_ACME_DNS_CHALLENGE_RESOLVERS) which can set set as needed in the proxy.env file as well as adding the DNS provider specific variables to the proxy.env file too.

Describe alternatives you've considered

none at the moment

Additional context

none at the moment

Originally created by @heymoe on GitHub (Feb 25, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5450 **Is your feature request related to a problem? Please describe.** There could be a deployment scenario where one might not have the ability to make the needed changes to satisfy the requirements to allow the currently supported "tls-alpn-01" and "http-01" challenge methods to be successful. An example might be having an upstream firewall that you don't have to ability to manage that is blocking the inbound ACME connections that are trying to do the verification. Having the ability to use the DNS challenge method (dns-01) would provide an alternative method of getting SSL certs issued. Updating the Traefik container to use the DNS challenge method was pretty simple. For example to enable DNS challenge using Cloudflare you would modify the commands section in the docker-compose.yml for the Traefik container like so: ``` # - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true" - "--certificatesresolvers.letsencrypt.acme.dnsChallenge=true" - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.provider=cloudflare" - "--certificatesresolvers.letsencrypt.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53" ``` and then add the necessary environment variables required for the specific DNS provider: ``` environment: - CF_API_EMAIL=<email address> - CF_DNS_API_TOKEN=<your token> ``` There doesn't seem to be a way to make similar changes for the proxy container. **Describe the solution you'd like** Enable the ability to configure use the ACME DNS challenge methods in addition to the already supported "tls-alpn-01" and "http-01" methods. I could see this being implemented by adding 2 additional NB_PROXY environmental variable to configure the DNS challenge (e.g: NB_PROXY_ACME_DNS_CHALLENGE_PROVIDER and NB_PROXY_ACME_DNS_CHALLENGE_RESOLVERS) which can set set as needed in the proxy.env file as well as adding the DNS provider specific variables to the proxy.env file too. **Describe alternatives you've considered** none at the moment **Additional context** none at the moment

saavagebueno added the feature-request label 2026-08-05 01:28:59 -04:00

saavagebueno commented

2026-08-05 01:29:00 -04:00

@ghazyami commented on GitHub (Feb 25, 2026):

I would prefer dns-01 as well

@ghazyami commented on GitHub (Feb 25, 2026): I would prefer `dns-01` as well

saavagebueno commented

2026-08-05 01:29:00 -04:00

@Dalewn commented on GitHub (Feb 26, 2026):

I hit the same roadblock trying to get the proxy to work. This would be a nice feature!

@Dalewn commented on GitHub (Feb 26, 2026): I hit the same roadblock trying to get the proxy to work. This would be a nice feature!

saavagebueno commented

2026-08-05 01:29:00 -04:00

@werlitong commented on GitHub (Mar 1, 2026):

i managed to get dns-1 working by setting NB_PROXY_ACME_CERTIFICATES to false and letting traefik generate those certificates. In order to netbird-proxy service get the certificates i pull the acme.json and extract both tls.cert and tls.key.

so the proxy.env will be something like:
NB_PROXY_ACME_CERTIFICATES=false
NB_PROXY_CERTIFICATE_FILE=tls.crt
NB_PROXY_CERTIFICATE_KEY_FILE=tls.key
NB_PROXY_CERTIFICATE_DIRECTORY=/certs/your-proxy-domain.tld

i've also migrated my old netbird deploy with caddy to traefik, so i've added these cmd lines to traefik section in docker-compose.yml:

     volumes:
      [...]
      - traefik_letsencrypt:/letsencrypt
     command:
       [...]
       # Let's Encrypt via DNS-01 Cloudflare
       - "--certificatesresolvers.letsencrypt.acme.email=your-user@your-domain.tld"
       - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
       - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
       - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
       - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
     environment:
       - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}

also add a cert-dumper to docker-compose.yml, this guy will use traefik volume and then he will run a script too dump the cert and key from the acme.json (stored in traefik's volume).

  certs-dumper:
    image: python:3-alpine
    container_name: certs-dumper
    restart: unless-stopped
    entrypoint: sh -c 'python3 /scripts/dump.py'
    volumes:
      - traefik_letsencrypt:/letsencrypt:ro
      - netbird_proxy_certs:/output
      - ./certs-dump.py:/scripts/dump.py:ro
    networks: [netbird]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

# certs-dump.py
import json, base64, os, time, hashlib

ACME = "/letsencrypt/acme.json"
DOMAIN = "your-proxy-domain.tld"
OUT = f"/output/{DOMAIN}"
last_hash = None

os.makedirs(OUT, exist_ok=True)

while True:
    try:
        with open(ACME) as f:
            raw = f.read()
        h = hashlib.md5(raw.encode()).hexdigest()
        if h != last_hash:
            data = json.loads(raw)
            for cert in data.get("letsencrypt", {}).get("Certificates", []):
                if cert["domain"]["main"] == DOMAIN:
                    crt = base64.b64decode(cert["certificate"])
                    key = base64.b64decode(cert["key"])
                    if len(crt) > 100 and len(key) > 100:
                        open(f"{OUT}/tls.crt", "wb").write(crt)
                        open(f"{OUT}/tls.key", "wb").write(key)
                        print(f"[OK] Cert: {len(crt)}B crt, {len(key)}B key", flush=True)
            last_hash = h
    except Exception as e:
        print(f"[ERR] {e}", flush=True)
    time.sleep(60)

@werlitong commented on GitHub (Mar 1, 2026): i managed to get dns-1 working by setting NB_PROXY_ACME_CERTIFICATES to false and letting traefik generate those certificates. In order to netbird-proxy service get the certificates i pull the acme.json and extract both tls.cert and tls.key. so the proxy.env will be something like: NB_PROXY_ACME_CERTIFICATES=false NB_PROXY_CERTIFICATE_FILE=tls.crt NB_PROXY_CERTIFICATE_KEY_FILE=tls.key NB_PROXY_CERTIFICATE_DIRECTORY=/certs/your-proxy-domain.tld i've also migrated my old netbird deploy with caddy to traefik, so i've added these cmd lines to traefik section in docker-compose.yml: ``` volumes: [...] - traefik_letsencrypt:/letsencrypt command: [...] # Let's Encrypt via DNS-01 Cloudflare - "--certificatesresolvers.letsencrypt.acme.email=your-user@your-domain.tld" - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true" - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare" - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53" environment: - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN} ``` also add a cert-dumper to docker-compose.yml, this guy will use traefik volume and then he will run a script too dump the cert and key from the acme.json (stored in traefik's volume). ``` certs-dumper: image: python:3-alpine container_name: certs-dumper restart: unless-stopped entrypoint: sh -c 'python3 /scripts/dump.py' volumes: - traefik_letsencrypt:/letsencrypt:ro - netbird_proxy_certs:/output - ./certs-dump.py:/scripts/dump.py:ro networks: [netbird] logging: driver: "json-file" options: max-size: "500m" max-file: "2" ``` ```python # certs-dump.py import json, base64, os, time, hashlib ACME = "/letsencrypt/acme.json" DOMAIN = "your-proxy-domain.tld" OUT = f"/output/{DOMAIN}" last_hash = None os.makedirs(OUT, exist_ok=True) while True: try: with open(ACME) as f: raw = f.read() h = hashlib.md5(raw.encode()).hexdigest() if h != last_hash: data = json.loads(raw) for cert in data.get("letsencrypt", {}).get("Certificates", []): if cert["domain"]["main"] == DOMAIN: crt = base64.b64decode(cert["certificate"]) key = base64.b64decode(cert["key"]) if len(crt) > 100 and len(key) > 100: open(f"{OUT}/tls.crt", "wb").write(crt) open(f"{OUT}/tls.key", "wb").write(key) print(f"[OK] Cert: {len(crt)}B crt, {len(key)}B key", flush=True) last_hash = h except Exception as e: print(f"[ERR] {e}", flush=True) time.sleep(60) ```

saavagebueno commented

2026-08-05 01:29:00 -04:00

@renne commented on GitHub (Mar 12, 2026):

LEGO can be integrated into the Netbird reverse-proxy for the ACME DNS01-challenge.

@renne commented on GitHub (Mar 12, 2026): [LEGO](https://github.com/go-acme/lego) can be integrated into the Netbird reverse-proxy for the ACME DNS01-challenge.

saavagebueno commented

2026-08-05 01:29:00 -04:00

@GEAR-IT-UP commented on GitHub (Mar 12, 2026):

was hoping this would be added as the DNS-01 challenge as the OP says, means all instances and records can be proxied fully behind the provider, thus not exposing the origin IP address (in this case a home lab). Hopefully this is something that is added soon/when the reverse proxy intergration is considered stable

@GEAR-IT-UP commented on GitHub (Mar 12, 2026): was hoping this would be added as the DNS-01 challenge as the OP says, means all instances and records can be proxied fully behind the provider, thus not exposing the origin IP address (in this case a home lab). Hopefully this is something that is added soon/when the reverse proxy intergration is considered stable

saavagebueno commented

2026-08-05 01:29:00 -04:00

@wolfnacht44 commented on GitHub (Mar 22, 2026):

+1 on DNS-01 Challenges as well.
Bonus points for allowing it to be done with in the dashboard.

@wolfnacht44 commented on GitHub (Mar 22, 2026): +1 on DNS-01 Challenges as well. Bonus points for allowing it to be done with in the dashboard.

saavagebueno commented

2026-08-05 01:29:00 -04:00

@SamB-GB commented on GitHub (Apr 1, 2026):

+1 for DNS-01 challenge

@SamB-GB commented on GitHub (Apr 1, 2026): +1 for DNS-01 challenge

saavagebueno commented

2026-08-05 01:29:00 -04:00

@kejar31 commented on GitHub (Apr 5, 2026):

Yes, please… I would love to be able to geo block everything other than my country but you can’t do that with TLS-ALPN-01 as letsencrypt doesn’t and shouldn’t list their ip address or regions.. using DNS-01 solves this

@kejar31 commented on GitHub (Apr 5, 2026): Yes, please… I would love to be able to geo block everything other than my country but you can’t do that with TLS-ALPN-01 as letsencrypt doesn’t and shouldn’t list their ip address or regions.. using DNS-01 solves this

saavagebueno commented

2026-08-05 01:29:00 -04:00

@kejar31 commented on GitHub (Apr 5, 2026):

While native DNS-01 support in the proxy would be ideal, there's a working workaround today using the wildcard certificate feature merged in #5583 (NB_PROXY_WILDCARD_CERT_DIR).

The approach: Use Traefik (already in the NetBird Docker stack) to issue a wildcard cert via DNS-01, extract it to PEM files, and point netbird-proxy at the directory. The proxy serves the wildcard cert for all matching domains and skips ACME entirely.

Step 1 — Enable DNS-01 in Traefik

As the original poster noted, enabling DNS-01 in Traefik is straightforward. In docker-compose.yml:

# Comment out tls challenge
# - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"

# Add DNS challenge
- "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"

Add your DNS provider credentials to the environment:

environment:
  - CF_DNS_API_TOKEN=your-token

Traefik supports many DNS providers — see the [Traefik DNS provider docs](https://doc.traefik.io/traefik/https/acme/#providers) for your provider's required environment variables.

Step 2 — Request the wildcard cert via Traefik

Add to traefik-dynamic.yaml:

http:
  routers:
    wildcard-cert:
      rule: "Host(`yourdomain.com`)"
      entryPoints:
        - websecure
      service: noop
      tls:
        certResolver: letsencrypt
        domains:
          - main: "yourdomain.com"
            sans:
              - "*.yourdomain.com"

  services:
    noop:
      loadBalancer:
        servers:
          - url: "http://localhost"

Traefik will issue the wildcard cert via DNS-01 and store it in acme.json. Verify it was issued:

docker exec netbird-traefik cat /letsencrypt/acme.json | jq -r '.letsencrypt.Certificates[] | .domain'

Step 3 — Extract cert to PEM files

Create an extraction script:

#!/bin/bash
DEST=/path/to/netbird/wildcard-certs/

docker exec netbird-traefik cat /letsencrypt/acme.json | \
    jq -r '.letsencrypt.Certificates[] | select(.domain.main=="yourdomain.com") | .certificate' | \
    base64 -d > ${DEST}yourdomain.com.crt

docker exec netbird-traefik cat /letsencrypt/acme.json | \
    jq -r '.letsencrypt.Certificates[] | select(.domain.main=="yourdomain.com") | .key' | \
    base64 -d > ${DEST}yourdomain.com.key

echo "Cert extracted $(date)"

Run once manually to verify it works, then add a daily cron job so renewals are picked up automatically:

0 3 * * * /path/to/extract-cert.sh >> /var/log/cert-extract.log 2>&1

Step 4 — Configure netbird-proxy to use the wildcard cert

Create the cert directory and mount it in docker-compose.yml under the proxy service:

volumes:
  - /path/to/netbird/wildcard-certs:/wildcard-certs:ro

Add to and comment out proxy.env:

# NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01
NB_PROXY_WILDCARD_CERT_DIR=/wildcard-certs

Restart the stack:

docker compose restart

Result

On startup you should see:

wildcard certificate loaded: *.yourdomain.com (from yourdomain.com.crt)
watching certificate files in /wildcard-certs

The proxy loads the wildcard cert, serves it for all *.yourdomain.com services, and never attempts ACME for those domains. The proxy watches the directory and hot-reloads automatically when the cert files are updated — so the daily cron job combined with Traefik's automatic DNS-01 renewal handles everything.

This is a workable bridge until native DNS-01 support lands in the proxy. When it does, you simply remove the extraction script and point the provider credentials directly at the proxy.

@kejar31 commented on GitHub (Apr 5, 2026): While native DNS-01 support in the proxy would be ideal, there's a working workaround today using the wildcard certificate feature merged in #5583 (`NB_PROXY_WILDCARD_CERT_DIR`). **The approach:** Use Traefik (already in the NetBird Docker stack) to issue a wildcard cert via DNS-01, extract it to PEM files, and point netbird-proxy at the directory. The proxy serves the wildcard cert for all matching domains and skips ACME entirely. ## Step 1 — Enable DNS-01 in Traefik As the original poster noted, enabling DNS-01 in Traefik is straightforward. In `docker-compose.yml`: ```yaml # Comment out tls challenge # - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true" # Add DNS challenge - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true" - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare" - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53" ``` Add your DNS provider credentials to the environment: ```yaml environment: - CF_DNS_API_TOKEN=your-token ``` Traefik supports many DNS providers — see the [[Traefik DNS provider docs](https://doc.traefik.io/traefik/https/acme/#providers)](https://doc.traefik.io/traefik/https/acme/#providers) for your provider's required environment variables. ## Step 2 — Request the wildcard cert via Traefik Add to `traefik-dynamic.yaml`: ```yaml http: routers: wildcard-cert: rule: "Host(`yourdomain.com`)" entryPoints: - websecure service: noop tls: certResolver: letsencrypt domains: - main: "yourdomain.com" sans: - "*.yourdomain.com" services: noop: loadBalancer: servers: - url: "http://localhost" ``` Traefik will issue the wildcard cert via DNS-01 and store it in `acme.json`. Verify it was issued: ```bash docker exec netbird-traefik cat /letsencrypt/acme.json | jq -r '.letsencrypt.Certificates[] | .domain' ``` ## Step 3 — Extract cert to PEM files Create an extraction script: ```bash #!/bin/bash DEST=/path/to/netbird/wildcard-certs/ docker exec netbird-traefik cat /letsencrypt/acme.json | \ jq -r '.letsencrypt.Certificates[] | select(.domain.main=="yourdomain.com") | .certificate' | \ base64 -d > ${DEST}yourdomain.com.crt docker exec netbird-traefik cat /letsencrypt/acme.json | \ jq -r '.letsencrypt.Certificates[] | select(.domain.main=="yourdomain.com") | .key' | \ base64 -d > ${DEST}yourdomain.com.key echo "Cert extracted $(date)" ``` Run once manually to verify it works, then add a daily cron job so renewals are picked up automatically: ``` 0 3 * * * /path/to/extract-cert.sh >> /var/log/cert-extract.log 2>&1 ``` ## Step 4 — Configure netbird-proxy to use the wildcard cert Create the cert directory and mount it in `docker-compose.yml` under the proxy service: ```yaml volumes: - /path/to/netbird/wildcard-certs:/wildcard-certs:ro ``` Add to and comment out `proxy.env`: ``` # NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 NB_PROXY_WILDCARD_CERT_DIR=/wildcard-certs ``` Restart the stack: ```bash docker compose restart ``` ## Result On startup you should see: ``` wildcard certificate loaded: *.yourdomain.com (from yourdomain.com.crt) watching certificate files in /wildcard-certs ``` The proxy loads the wildcard cert, serves it for all `*.yourdomain.com` services, and never attempts ACME for those domains. The proxy watches the directory and hot-reloads automatically when the cert files are updated — so the daily cron job combined with Traefik's automatic DNS-01 renewal handles everything. This is a workable bridge until native DNS-01 support lands in the proxy. When it does, you simply remove the extraction script and point the provider credentials directly at the proxy.

saavagebueno commented

2026-08-05 01:29:00 -04:00

@hektyc commented on GitHub (Apr 18, 2026):

1 for DNS-01 challenge. I made my first attempt at installing Netbird on my unRAID servers using the installer script. That has not gone well and I have wasted too much time trying to get Netbird working.

Netbird Proxy fails to start upon first install. Traefik fails to obtain an SSL certificate for my domain due to ports 80 and 443 not being opened on my firewall plus I am behind CGNAT so opening the ports wouldn't work in my case anyway.

I see that some people have managed to get DNS-01 working. However, I will just stick with my current setup instead of jumping through hoops to get DNS-01 working and give Netbird another try if/when DNS-01 is available.

I would like to add a suggestion if by chance the Netbird team is considering adding DNS-01 challenge support. When a user installs Netbird using the installer please provide them an option to choose which method they prefer to use as their DNS challenge option.

@hektyc commented on GitHub (Apr 18, 2026): + 1 for DNS-01 challenge. I made my first attempt at installing Netbird on my unRAID servers using the installer script. That has not gone well and I have wasted too much time trying to get Netbird working. Netbird Proxy fails to start upon first install. Traefik fails to obtain an SSL certificate for my domain due to ports 80 and 443 not being opened on my firewall plus I am behind CGNAT so opening the ports wouldn't work in my case anyway. I see that some people have managed to get DNS-01 working. However, I will just stick with my current setup instead of jumping through hoops to get DNS-01 working and give Netbird another try if/when DNS-01 is available. I would like to add a suggestion if by chance the Netbird team is considering adding DNS-01 challenge support. When a user installs Netbird using the installer please provide them an option to choose which method they prefer to use as their DNS challenge option.

saavagebueno commented

2026-08-05 01:29:00 -04:00

@nz2o commented on GitHub (Apr 27, 2026):

Thank you for the workaround. Some kind of UI would be amazing for this.

I'm finding myself having trouble with TLS and HTTP methods, seemingly all the time.

@nz2o commented on GitHub (Apr 27, 2026): Thank you for the workaround. Some kind of UI would be amazing for this. I'm finding myself having trouble with TLS and HTTP methods, seemingly all the time.

saavagebueno commented

2026-08-05 01:29:00 -04:00

@osos commented on GitHub (Apr 30, 2026):

Please ensure that an implementation of this is not Traefik only.

I am currently using nginx-proxy (which actually does support tls-passthrough) and, thus, would like to able to use other means of wildcard-certificate generating than Traefik.

Also: this PR seems to aim for a fix: https://github.com/netbirdio/netbird/pull/6009

@osos commented on GitHub (Apr 30, 2026): Please ensure that an implementation of this is not Traefik only. I am currently using nginx-proxy (which actually does support tls-passthrough) and, thus, would like to able to use other means of wildcard-certificate generating than Traefik. Also: this PR seems to aim for a fix: https://github.com/netbirdio/netbird/pull/6009

saavagebueno commented

2026-08-05 01:29:00 -04:00

@hektyc commented on GitHub (Apr 30, 2026):

@osos i have not seen any indication of their intent or planning to add DNS-01 support.

@hektyc commented on GitHub (Apr 30, 2026): @osos i have not seen any indication of their intent or planning to add DNS-01 support.

saavagebueno commented

2026-08-05 01:29:01 -04:00

@WolfspiritM commented on GitHub (Apr 30, 2026):

I'm hoping for a wildcard cert for exposed services aswell. The reason is security. When you expose a local service for a short moment to the internet with a random id you don't expect people to easily find it but as there are certs generated for each exposed service bots probably watch the transparency logs and start scans on every newly generated cert. I noticed that whenever I expose a local http server I end up getting scanned.

@WolfspiritM commented on GitHub (Apr 30, 2026): I'm hoping for a wildcard cert for exposed services aswell. The reason is security. When you expose a local service for a short moment to the internet with a random id you don't expect people to easily find it but as there are certs generated for each exposed service bots probably watch the transparency logs and start scans on every newly generated cert. I noticed that whenever I expose a local http server I end up getting scanned.

saavagebueno commented

2026-08-05 01:29:01 -04:00

@nz2o commented on GitHub (Apr 30, 2026):

Yeah um....I had to give up on the project... I had a rather weird up/down issue with the reverse proxy. Couldn't get it working from scratch either.

DNS-01 would have been a win. Looks like it's not especially easy in any reverse proxy.

Sent from my Verizon, Samsung Galaxy smartphone
Get Outlook for Androidhttps://aka.ms/AAb9ysg

From: Adrian @.>
Sent: Thursday, April 30, 2026 5:06:43 PM
To: netbirdio/netbird @.>
Cc: Casey Benefield, NZ2O @.>; Comment @.>
Subject: Re: [netbirdio/netbird] Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container. (Issue #5450)

[https://avatars.githubusercontent.com/u/5904171?s=20&v=4]WolfspiritM left a comment (netbirdio/netbird#5450)https://github.com/netbirdio/netbird/issues/5450#issuecomment-4356486135

I'm hoping for a wildcard cert for exposed services aswell. The reason is security. When you expose a local service for a short moment to the internet with a random id you don't expect people to easily find it but as there are certs generated for each exposed service bots probably watch the transparency logs and start scans on every newly generated cert. I noticed that whenever I expose a local http server I end up getting scanned.

—
Reply to this email directly, view it on GitHubhttps://github.com/netbirdio/netbird/issues/5450#issuecomment-4356486135, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMI4ZVTIEDWGUSGVOIVTDFD4YPE7HAVCNFSM6AAAAACV7SBAS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNJWGQ4DMMJTGU.
Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.
You are receiving this because you commented.Message ID: @.***>

@nz2o commented on GitHub (Apr 30, 2026): Yeah um....I had to give up on the project... I had a rather weird up/down issue with the reverse proxy. Couldn't get it working from scratch either. DNS-01 would have been a win. Looks like it's not especially easy in any reverse proxy. Sent from my Verizon, Samsung Galaxy smartphone Get Outlook for Android<https://aka.ms/AAb9ysg> ________________________________ From: Adrian ***@***.***> Sent: Thursday, April 30, 2026 5:06:43 PM To: netbirdio/netbird ***@***.***> Cc: Casey Benefield, NZ2O ***@***.***>; Comment ***@***.***> Subject: Re: [netbirdio/netbird] Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container. (Issue #5450) [https://avatars.githubusercontent.com/u/5904171?s=20&v=4]WolfspiritM left a comment (netbirdio/netbird#5450)<https://github.com/netbirdio/netbird/issues/5450#issuecomment-4356486135> I'm hoping for a wildcard cert for exposed services aswell. The reason is security. When you expose a local service for a short moment to the internet with a random id you don't expect people to easily find it but as there are certs generated for each exposed service bots probably watch the transparency logs and start scans on every newly generated cert. I noticed that whenever I expose a local http server I end up getting scanned. — Reply to this email directly, view it on GitHub<https://github.com/netbirdio/netbird/issues/5450#issuecomment-4356486135>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AMI4ZVTIEDWGUSGVOIVTDFD4YPE7HAVCNFSM6AAAAACV7SBAS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNJWGQ4DMMJTGU>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you commented.Message ID: ***@***.***>

saavagebueno commented

2026-08-05 01:29:01 -04:00

@GEAR-IT-UP commented on GitHub (Apr 30, 2026):

What i got working (at least) is proxed cloudflare instances (orange cloud). I just downloaded the cert, added it and no issues or timeouts with the wireguard network etc etc..

But of course yeah the simple challenge is easier for sure. Now to hope the other reverse proxies on different sites improve and il be set!

@GEAR-IT-UP commented on GitHub (Apr 30, 2026): What i got working (at least) is proxed cloudflare instances (orange cloud). I just downloaded the cert, added it and no issues or timeouts with the wireguard network etc etc.. But of course yeah the simple challenge is easier for sure. Now to hope the other reverse proxies on different sites improve and il be set!

saavagebueno commented

2026-08-05 01:29:01 -04:00

@nz2o commented on GitHub (Apr 30, 2026):

What I liked about netbird was the prospect of tunnels or server groups, policy based management.

Then the ISP handoff was nice. I was combining netbird with authentik for RDP access proxying....like what Teleport or StrongDM might do

Sent from my Verizon, Samsung Galaxy smartphone
Get Outlook for Androidhttps://aka.ms/AAb9ysg

From: Andrew Moore @.>
Sent: Thursday, April 30, 2026 5:56:39 PM
To: netbirdio/netbird @.>
Cc: Casey Benefield, NZ2O @.>; Comment @.>
Subject: Re: [netbirdio/netbird] Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container. (Issue #5450)

[https://avatars.githubusercontent.com/u/29341253?s=20&v=4]GEAR-IT-UP left a comment (netbirdio/netbird#5450)https://github.com/netbirdio/netbird/issues/5450#issuecomment-4356719718

What i got working (at least) is proxed cloudflare instances (orange cloud). I just downloaded the cert, added it and no issues or timeouts with the wireguard network etc etc..

But of course yeah the simple challenge is easier for sure. Now to hope the other reverse proxies on different sites improve and il be set!

—
Reply to this email directly, view it on GitHubhttps://github.com/netbirdio/netbird/issues/5450#issuecomment-4356719718, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AMI4ZVTUTCDDBZBYL25YSVT4YPK2PAVCNFSM6AAAAACV7SBAS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNJWG4YTSNZRHA.
Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.
You are receiving this because you commented.Message ID: @.***>

@nz2o commented on GitHub (Apr 30, 2026): What I liked about netbird was the prospect of tunnels or server groups, policy based management. Then the ISP handoff was nice. I was combining netbird with authentik for RDP access proxying....like what Teleport or StrongDM might do Sent from my Verizon, Samsung Galaxy smartphone Get Outlook for Android<https://aka.ms/AAb9ysg> ________________________________ From: Andrew Moore ***@***.***> Sent: Thursday, April 30, 2026 5:56:39 PM To: netbirdio/netbird ***@***.***> Cc: Casey Benefield, NZ2O ***@***.***>; Comment ***@***.***> Subject: Re: [netbirdio/netbird] Feature Request: Add Let's Encrypt / ACME DNS challenge (DNS-01) support to the Proxy container. (Issue #5450) [https://avatars.githubusercontent.com/u/29341253?s=20&v=4]GEAR-IT-UP left a comment (netbirdio/netbird#5450)<https://github.com/netbirdio/netbird/issues/5450#issuecomment-4356719718> What i got working (at least) is proxed cloudflare instances (orange cloud). I just downloaded the cert, added it and no issues or timeouts with the wireguard network etc etc.. But of course yeah the simple challenge is easier for sure. Now to hope the other reverse proxies on different sites improve and il be set! — Reply to this email directly, view it on GitHub<https://github.com/netbirdio/netbird/issues/5450#issuecomment-4356719718>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AMI4ZVTUTCDDBZBYL25YSVT4YPK2PAVCNFSM6AAAAACV7SBAS6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGNJWG4YTSNZRHA>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you commented.Message ID: ***@***.***>

saavagebueno commented

2026-08-05 01:29:01 -04:00

@speedbirdone commented on GitHub (May 16, 2026):

Is there like any update if that's being worked on officially? I don't need an ETA, just some kind of confirmation that it's on the list as I'm still evaluating netbird and a solution for this would be absolutely pro netbird.

@speedbirdone commented on GitHub (May 16, 2026): Is there like any update if that's being worked on officially? I don't need an ETA, just some kind of confirmation that it's on the list as I'm still evaluating netbird and a solution for this would be absolutely pro netbird.

saavagebueno commented

2026-08-05 01:29:01 -04:00

@GEAR-IT-UP commented on GitHub (May 16, 2026):

Is there like any update if that's being worked on officially? I don't need an ETA, just some kind of confirmation that it's on the list as I'm still evaluating netbird and a solution for this would be absolutely pro netbird.

Sort of...

The latest update has a "bring your own proxy" (just the building blocks though). So not a full feature yet. Though my understanding is Netbird, will "control" your external proxy with Netbird via dashboard, as if it was an internal one. No idea what is supported but give the internal proxy used, I would suggest that in the first instance.

As if its an external proxy (aka normal Traefik), then it will support DNS-01 requests. So roundabout way but I think will work well as you can then just plug Netbird into your setup, then go from there.

@GEAR-IT-UP commented on GitHub (May 16, 2026): > Is there like any update if that's being worked on officially? I don't need an ETA, just some kind of confirmation that it's on the list as I'm still evaluating netbird and a solution for this would be absolutely pro netbird. Sort of... The latest update has a "bring your own proxy" (just the building blocks though). So not a full feature yet. Though my understanding is Netbird, will "control" your external proxy with Netbird via dashboard, as if it was an internal one. No idea what is supported but give the internal proxy used, I would suggest that in the first instance. As if its an external proxy (aka normal Traefik), then it will support DNS-01 requests. So roundabout way but I think will work well as you can then just plug Netbird into your setup, then go from there.

saavagebueno commented

2026-08-05 01:29:01 -04:00

@DaAwesomeP commented on GitHub (May 24, 2026):

@kejar31 I tried modifying getting-started.sh with your steps, and it looks like Netbird/Traefik is fetching a wildcard cert in addition to the non-wildcard one (but now using DNS-01). Is there a way to get it to only use the wildcard cert for everything? I don't want the non-wildcard cert in the Certificate Transparency public record.

Note that I also needed these:

      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.propagation.disableChecks=true"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.propagation.delayBeforeChecks=60"

This was my attempt to stop the non-wildcard cert (did not work):

      - "--entrypoints.websecure.http.tls.domains[0].main=example.com"
      - "--entrypoints.websecure.http.tls.domains[0].sans=*.example.com"

@DaAwesomeP commented on GitHub (May 24, 2026): @kejar31 I tried modifying `getting-started.sh` with [your steps](https://github.com/netbirdio/netbird/issues/5450#issuecomment-4189678895), and it looks like Netbird/Traefik is fetching a wildcard cert _in addition_ to the non-wildcard one (but now using DNS-01). Is there a way to get it to only use the wildcard cert for everything? I don't want the non-wildcard cert in the Certificate Transparency public record. Note that I also needed these: ```yaml - "--certificatesresolvers.letsencrypt.acme.dnschallenge.propagation.disableChecks=true" - "--certificatesresolvers.letsencrypt.acme.dnschallenge.propagation.delayBeforeChecks=60" ``` This was my attempt to stop the non-wildcard cert (did not work): ```yaml - "--entrypoints.websecure.http.tls.domains[0].main=example.com" - "--entrypoints.websecure.http.tls.domains[0].sans=*.example.com" ```

saavagebueno commented

2026-08-05 01:29:01 -04:00

@alanb2 commented on GitHub (Jun 5, 2026):

@DaAwesomeP Could you share the modified script?

@alanb2 commented on GitHub (Jun 5, 2026): @DaAwesomeP Could you share the modified script?

saavagebueno commented

2026-08-05 01:29:01 -04:00

@s-wighton commented on GitHub (Aug 1, 2026):

This fix needs to hurry up and be prioritised over the AI feature slop they've added recently.

I'm really annoyed Netbird reverse proxy is leaking my internal subdomain names, the access log is full of foreign countries probing each of them. (One for the SEO)

Moving back to NginxProxyManager is a very high probability if the next feature release doesn't include this bug fix.

Using https://www.certkit.io/tools/ct-logs is quite an eye opener to what has been exposed since moving across.

@s-wighton commented on GitHub (Aug 1, 2026): This fix needs to hurry up and be prioritised over the AI feature slop they've added recently. I'm really annoyed Netbird reverse proxy is leaking my internal subdomain names, the access log is full of foreign countries probing each of them. (One for the SEO) Moving back to NginxProxyManager is a very high probability if the next feature release doesn't include this bug fix. Using https://www.certkit.io/tools/ct-logs is quite an eye opener to what has been exposed since moving across.

Sign in to join this conversation.

Branches Tags

main

claude/agent-network-test-cases-p743vw

android/gui-integration

revert/component-types

feat-post_quantum_ml_kem

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/github_actions/actions-a940c7c866

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

fix/ui-gtk3-support

enterprise-traefik-and-migration-fixes

disambiguate_p2p_metrics

revert/component-types-hookup

embedded-vnc

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mdm_integration

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

add-atomic-cache-ops

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

refactor/peer-event-bus

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#11228