[PR #4763] fix: correct Signal service port mapping for custom TLS certificates #24095

Open
opened 2026-08-05 06:08:14 -04:00 by saavagebueno · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/4763
Author: @krth1k
Created: 11/7/2025
Status: 🔄 Open

Base: mainHead: fix/signal-port-mapping


📝 Commits (5)

  • ebe07bc fix: correct Signal service port mapping from 80 to 10000
  • 591f571 docs: update infrastructure requirements for VM port accessibility
  • 7a2f71c Change signal port check from :80 to :10000
  • 690292b Update Signal port mapping to use 443 instead of 10000
  • 8e03f6c Update workflow to check Signal port 443 instead of 10000

📊 Changes

3 files changed (+3 additions, -3 deletions)

View changed files

📝 .github/workflows/test-infrastructure-files.yml (+1 -1)
📝 README.md (+1 -1)
📝 infrastructure_files/docker-compose.yml.tmpl (+1 -1)

📄 Description

Describe your changes

This PR fixes a critical port mapping issue in the Signal service configuration that prevents clients from connecting when using custom TLS certificates.

The Signal service with custom TLS certificates runs HTTPS/WebSocket on internal port 443, not port 80. The current docker-compose template incorrectly maps $NETBIRD_SIGNAL_PORT:80, causing connection failures.

Updated port mapping:

signal:
  ports:
    - $NETBIRD_SIGNAL_PORT:443  # Changed from :80 to :443

Impact:

  • Signal service connects successfully
  • Clients can establish full NetBird connectivity
  • Uses modern HTTPS/WebSocket approach (port 443)
  • ℹ️ Port 10000 is kept for backward compatibility only

Fixes #4762

Stack

Checklist

  • Is it a bug fix
  • Is a typo/documentation fix
  • Is a feature enhancement
  • It is a refactor
  • Created tests that fail without the change (if possible)

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:


Additional Details

Problem Analysis

When the Signal service runs with custom TLS certificates (via --cert-file and --cert-key flags), it starts the HTTPS/WebSocket server on internal port 443, not port 80.

Evidence from Signal service logs:

signal-1  | INFO signal/cmd/run.go:180: running HTTPS server with WebSocket proxy: [::]:443
signal-1  | INFO signal/cmd/run.go:161: running gRPC backward compatibility server: [::]:10000

This mismatch causes:

  • Signal service shows as "Disconnected" in netbird status
  • Connection refused errors when clients attempt to connect
  • Client timeout errors: "daemon up failed: rpc error: code = DeadlineExceeded"
  • Management service connects successfully (only Signal fails)

Testing Results

Before the fix:

$ nc -zv netbird.example.com 10000
nc: connect to netbird.example.com port 10000 (tcp) failed: Connection refused

$ netbird status
Management: Connected
Signal: Disconnected ❌

After the fix (port 443):

$ netbird status
Management: Connected
Signal: Connected ✅
Relays: 3/3 Available
NetBird IP: 100.65.165.148/16

Configuration Context

This issue specifically affects deployments using:

  • Custom TLS certificates (Let's Encrypt via dashboard container or similar)
  • Signal service command with --cert-file and --cert-key flags
  • Docker Compose setup from infrastructure_files

The configuration in question:

signal:
  command: [
    "--cert-file", "$NETBIRD_MGMT_API_CERT_FILE",
    "--cert-key", "$NETBIRD_MGMT_API_CERT_KEY_FILE",
    "--log-file", "console"
  ]
  ports:
    - $NETBIRD_SIGNAL_PORT:443  # Now correctly maps to HTTPS/WebSocket port

This PR also updates:

  • GitHub workflow tests to verify port 443 mapping
  • Infrastructure documentation to reflect correct port requirements

Summary by CodeRabbit

  • Chores

    • Updated signal service host-to-container port mapping to use port 443.
    • Test expectations adjusted to validate the signal port is 443.
  • Documentation

    • Infrastructure README updated to list new TCP port requirements: 80, 443, 33073, 10000, 33080; UDP ports remain 3478 and 49152–65535.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/4763 **Author:** [@krth1k](https://github.com/krth1k) **Created:** 11/7/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/signal-port-mapping` --- ### 📝 Commits (5) - [`ebe07bc`](https://github.com/netbirdio/netbird/commit/ebe07bce7cbe38e4021fc39353ab11e34f947fcf) fix: correct Signal service port mapping from 80 to 10000 - [`591f571`](https://github.com/netbirdio/netbird/commit/591f571fe9882c54f2d91c9b4d35218aa9a6d4d3) docs: update infrastructure requirements for VM port accessibility - [`7a2f71c`](https://github.com/netbirdio/netbird/commit/7a2f71c0995bff51d0a6cc0fd93a0ad7fef8f804) Change signal port check from :80 to :10000 - [`690292b`](https://github.com/netbirdio/netbird/commit/690292bbea5d07da3bebccc2d57e5b1707acdbde) Update Signal port mapping to use 443 instead of 10000 - [`8e03f6c`](https://github.com/netbirdio/netbird/commit/8e03f6c2f056d01fd64576413ac7e08548c1e9bc) Update workflow to check Signal port 443 instead of 10000 ### 📊 Changes **3 files changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/test-infrastructure-files.yml` (+1 -1) 📝 `README.md` (+1 -1) 📝 `infrastructure_files/docker-compose.yml.tmpl` (+1 -1) </details> ### 📄 Description ## Describe your changes This PR fixes a critical port mapping issue in the Signal service configuration that prevents clients from connecting when using custom TLS certificates. The Signal service with custom TLS certificates runs HTTPS/WebSocket on **internal port 443**, not port 80. The current docker-compose template incorrectly maps `$NETBIRD_SIGNAL_PORT:80`, causing connection failures. **Updated port mapping:** ```yaml signal: ports: - $NETBIRD_SIGNAL_PORT:443 # Changed from :80 to :443 ``` **Impact:** - ✅ Signal service connects successfully - ✅ Clients can establish full NetBird connectivity - ✅ Uses modern HTTPS/WebSocket approach (port 443) - ℹ️ Port 10000 is kept for backward compatibility only ## Issue ticket number and link Fixes #4762 ## Stack <!-- branch-stack --> ### Checklist - [x] Is it a bug fix - [x] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [ ] Created tests that fail without the change (if possible) > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [x] I added/updated documentation for this change [ https://github.com/netbirdio/netbird/pull/4763 ] - [ ] Documentation is **not needed** for this change --- ## Additional Details ### Problem Analysis When the Signal service runs with custom TLS certificates (via `--cert-file` and `--cert-key` flags), it starts the HTTPS/WebSocket server on **internal port 443**, not port 80. **Evidence from Signal service logs:** ``` signal-1 | INFO signal/cmd/run.go:180: running HTTPS server with WebSocket proxy: [::]:443 signal-1 | INFO signal/cmd/run.go:161: running gRPC backward compatibility server: [::]:10000 ``` This mismatch causes: - ❌ Signal service shows as "Disconnected" in `netbird status` - ❌ Connection refused errors when clients attempt to connect - ❌ Client timeout errors: "daemon up failed: rpc error: code = DeadlineExceeded" - ✅ Management service connects successfully (only Signal fails) ### Testing Results **Before the fix:** ```bash $ nc -zv netbird.example.com 10000 nc: connect to netbird.example.com port 10000 (tcp) failed: Connection refused $ netbird status Management: Connected Signal: Disconnected ❌ ``` **After the fix (port 443):** ```bash $ netbird status Management: Connected Signal: Connected ✅ Relays: 3/3 Available NetBird IP: 100.65.165.148/16 ``` ### Configuration Context This issue specifically affects deployments using: - Custom TLS certificates (Let's Encrypt via dashboard container or similar) - Signal service command with `--cert-file` and `--cert-key` flags - Docker Compose setup from `infrastructure_files` The configuration in question: ```yaml signal: command: [ "--cert-file", "$NETBIRD_MGMT_API_CERT_FILE", "--cert-key", "$NETBIRD_MGMT_API_CERT_KEY_FILE", "--log-file", "console" ] ports: - $NETBIRD_SIGNAL_PORT:443 # Now correctly maps to HTTPS/WebSocket port ``` ### Related Changes This PR also updates: - GitHub workflow tests to verify port 443 mapping - Infrastructure documentation to reflect correct port requirements --- <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated signal service host-to-container port mapping to use port 443. * Test expectations adjusted to validate the signal port is 443. * **Documentation** * Infrastructure README updated to list new TCP port requirements: 80, 443, 33073, 10000, 33080; UDP ports remain 3478 and 49152–65535. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2026-08-05 06:08:14 -04:00
Sign in to join this conversation.
No Label pull-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#24095