DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #1684] Self Hosted Netbird + Authentik - Error: failed retrieving a new idp manager with err: authentik IdP configuration is incomplete, TokenEndpoint is missing - Error: failed creating JWT validator: Get ... EOF #2828

New Issue
Open
opened 2026-08-05 00:49:08 -04:00 by saavagebueno · 0 comments
saavagebueno commented 2026-08-05 00:49:08 -04:00
Owner
Copy Link

Originally created by @luckylinux on GitHub (Mar 9, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/1684

Describe the problem

I am facing lots of different issues during the setup of Netbird and Authentik (self hosted).

Following the tutorial is quite straightforward and most of the things seem to work.

I am stuck in the part that relates to the "netbird-management" container.

I use Cloudflare Proxy DNS and I had "Your SSL/TLS encryption mode" set to "Off". Now I turned it to "Full (Strict)" based on some guidelines on Cloudflare.

I also added 127.0.0.1 auth.MYDOMAIN.TLD to /etc/hosts (on the Podman Host) but that did not really solve the issues.

There are just too many redirects / connection refused / sometimes invalid X509 certificate (the latter probably when using the /etc/hosts entry line) going on here.

2024-03-09T19:39:09Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration
Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration Get "https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration": stopped after 10 redirects
2024-03-09T19:41:37Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration
2024-03-09T19:41:38Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration
2024-03-09T19:41:38Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/, previously configured value: 
2024-03-09T19:41:38Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/jwks/, previously configured value: 
2024-03-09T19:41:38Z INFO management/cmd/management.go:463: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 
2024-03-09T19:41:38Z INFO management/cmd/management.go:466: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/device/, previously configured value: 
2024-03-09T19:41:38Z INFO management/cmd/management.go:474: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.MYDOMAIN.TLD, previously configured value: 
2024-03-09T19:41:38Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 
2024-03-09T19:41:38Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/authorize/, previously configured value: 
2024-03-09T19:41:38Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081
2024-03-09T19:41:38Z INFO management/server/store.go:94: using SQLite store engine
Error: failed retrieving a new idp manager with err: authentik IdP configuration is incomplete, TokenEndpoint is missing
2024-03-09T19:45:00Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration
2024-03-09T19:45:01Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration
2024-03-09T19:45:01Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/, previously configured value: 
2024-03-09T19:45:01Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/jwks/, previously configured value: 
2024-03-09T19:45:01Z INFO management/cmd/management.go:463: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 
2024-03-09T19:45:01Z INFO management/cmd/management.go:466: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/device/, previously configured value: 
2024-03-09T19:45:01Z INFO management/cmd/management.go:474: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.MYDOMAIN.TLD, previously configured value: 
2024-03-09T19:45:01Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 
2024-03-09T19:45:01Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/authorize/, previously configured value: 
2024-03-09T19:45:01Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081
2024-03-09T19:45:01Z INFO management/server/store.go:94: using SQLite store engine
Error: failed retrieving a new idp manager with err: authentik IdP configuration is incomplete, TokenEndpoint is missing

To Reproduce

Steps to reproduce the behavior:

  1. compose.yml file
version: "3"
services:
  #UI dashboard
  dashboard:
    image: wiretrustee/dashboard:latest
    restart: unless-stopped
    container_name: netbird-dashboard
    #ports:
    #  - 80:80
    #  - 443:443
    networks:
      - traefik
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.MYDOMAIN.TLD:33073
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.MYDOMAIN.TLD:33073
      # OIDC
      - AUTH_AUDIENCE=<CLIENT_ID>
      - AUTH_CLIENT_ID=<CLIENT_ID>
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      #- NGINX_SSL_PORT=443
      # Letsencrypt
      #- LETSENCRYPT_DOMAIN=
      #- LETSENCRYPT_EMAIL=myemail@DOMAIN.TLD
#    volumes:
#      - netbird-letsencrypt:/etc/letsencrypt/
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-dashboard.rule=Host(`netbird.MYDOMAIN.TLD`)
    - traefik.http.services.netbird-dashboard.loadbalancer.server.port=80

  # Signal
  signal:
    image: netbirdio/signal:latest
    container_name: netbird-signal
    restart: unless-stopped
    volumes:
      #- netbird-signal:/var/lib/netbird
      - ~/containers/data/netbird/signal:/var/lib/netbird
    networks:
      - traefik
    #ports:
    #  - 10000:80
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-signal.rule=Host(`netbird.MYDOMAIN.TLD`) && PathPrefix(`/signalexchange.SignalExchange/`)
    - traefik.http.services.netbird-signal.loadbalancer.server.port=80
    - traefik.http.services.netbird-signal.loadbalancer.server.scheme=h2c

  # Management
  management:
    image: netbirdio/management:latest
#    restart: unless-stopped
#    restart: no
    container_name: netbird-management
    depends_on:
      - dashboard
    volumes:
#      - netbird-mgmt:/var/lib/netbird
      - ~/containers/data/netbird/management:/var/lib/netbird
#      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ~/containers/config/netbird/management.json:/etc/netbird/management.json
    networks:
      - traefik
    #ports:
    #  - 33073:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    command: [
      "--port", "80",
      "--log-file", "console",
      "--disable-anonymous-metrics=true",
      "--single-account-mode-domain=netbird.MYDOMAIN.TLD",
      "--dns-domain=MYDOMAIN.TLD"
      ]
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-api.rule=Host(`netbird.MYDOMAIN.TLD`) && PathPrefix(`/api`)
    - traefik.http.routers.netbird-api.service=netbird-api
    - traefik.http.services.netbird-api.loadbalancer.server.port=80

    - traefik.http.routers.netbird-management.rule=Host(`netbird.MYDOMAIN.TLD`) && PathPrefix(`/management.ManagementService/`)
    - traefik.http.routers.netbird-management.service=netbird-management
    - traefik.http.services.netbird-management.loadbalancer.server.port=80
    - traefik.http.services.netbird-management.loadbalancer.server.scheme=h2c

  # Coturn
  coturn:
    image: coturn/coturn:latest
    container_name: netbird-coturn
    restart: unless-stopped
    domainname: netbird.MYDOMAIN.TLD
    volumes:
      - ~/containers/config/netbird/turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    networks:
      - traefik
    network_mode: host
    command:
      - -c /etc/turnserver.conf

#volumes:
#  netbird-mgmt:
#  netbird-signal:
#  netbird-letsencrypt:

networks:
  traefik:
    external: true
  1. Run podman compose up -d
  2. See that netbird-management is not running when issueing podman ps'
  3. Run podman logs netbird-management

Expected behavior

The container netbird-management to start successfully. Not being stuck in a redirect / too many redirects loops causing the netbird-management container to automatically restart, traefik attemping a certificate renewal and ending up banned from Letsencrypt for a few hours.

Are you using NetBird Cloud?

Self-Hosted Control Panel.

NetBird version

Cannot enter management console since it keeps crashing / restarting ...
Was installed & pulled from Docker Hub today.

NetBird status -d output:

Cannot enter management console since it keeps crashing / restarting ...
Was installed & pulled from Docker Hub today.

Screenshots

N/A

Additional context

Running podman instead of docker.

Installed on Debian AMD64 12 Bookworm with APT Pinning of Podman (and conmon, podman-compose, ...) from Trixie/Testing.

podman info shows

host:
  arch: amd64
  buildahVersion: 1.33.5
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.10+ds1-1_amd64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: unknown'
  cpuUtilization:
    idlePercent: 91.15
    systemPercent: 2.63
    userPercent: 6.22
  cpus: 1
  databaseBackend: sqlite
  distribution:
    codename: bookworm
    distribution: debian
    version: "12"
  eventLogger: journald
  freeLocks: 2034
  hostname: ra
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
  kernel: 6.1.0-18-amd64
  linkmode: dynamic
  logDriver: journald
  memFree: 112033792
  memTotal: 2012446720
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.4.0-5_amd64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.4.0
    package: netavark_1.4.0-3_amd64
    path: /usr/lib/podman/netavark
    version: netavark 1.4.0
  ociRuntime:
    name: crun
    package: crun_1.14.1-1_amd64
    path: /usr/bin/crun
    version: |-
      crun version 1.14.1
      commit: de537a7965bfbe9992e2cfae0baeb56a08128171
      rundir: /run/user/1001/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_0.0~git20230309.7c7625d-1_amd64
    version: |
      pasta unknown version
      Copyright Red Hat
      GNU Affero GPL version 3 or later <https://www.gnu.org/licenses/agpl-3.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1001/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.0-1_amd64
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.4
  swapFree: 604762112
  swapTotal: 1023406080
  uptime: 320h 15m 8.00s (Approximately 13.33 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /home/podman/.config/containers/storage.conf
  containerStore:
    number: 9
    paused: 0
    running: 8
    stopped: 1
  graphDriverName: overlay
  graphOptions:
    overlay.mount_program:
      Executable: /usr/bin/fuse-overlayfs
      Package: fuse-overlayfs_1.13-1_amd64
      Version: |-
        fusermount3 version: 3.14.0
        fuse-overlayfs: version 1.13-dev
        FUSE library version 3.14.0
        using FUSE kernel interface version 7.31
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /home/podman/containers/storage
  graphRootAllocated: 18969468928
  graphRootUsed: 7787802624
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 12
  runRoot: /run/user/1001
  transientStore: false
  volumePath: /home/podman/containers/storage/volumes
version:
  APIVersion: 4.9.3
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.21.6
  Os: linux
  OsArch: linux/amd64
  Version: 4.9.3
Originally created by @luckylinux on GitHub (Mar 9, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/1684 **Describe the problem** I am facing lots of different issues during the setup of Netbird and Authentik (self hosted). Following the tutorial is quite straightforward and most of the things seem to work. I am stuck in the part that relates to the "netbird-management" container. I use Cloudflare Proxy DNS and I had "Your SSL/TLS encryption mode" set to "Off". Now I turned it to "Full (Strict)" based on some guidelines on Cloudflare. I also added 127.0.0.1 auth.MYDOMAIN.TLD to /etc/hosts (on the Podman Host) but that did not really solve the issues. There are just too many redirects / connection refused / sometimes invalid X509 certificate (the latter probably when using the /etc/hosts entry line) going on here. ``` 2024-03-09T19:39:09Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration Get "https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration": stopped after 10 redirects 2024-03-09T19:41:37Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration 2024-03-09T19:41:38Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration 2024-03-09T19:41:38Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/, previously configured value: 2024-03-09T19:41:38Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/jwks/, previously configured value: 2024-03-09T19:41:38Z INFO management/cmd/management.go:463: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 2024-03-09T19:41:38Z INFO management/cmd/management.go:466: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/device/, previously configured value: 2024-03-09T19:41:38Z INFO management/cmd/management.go:474: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.MYDOMAIN.TLD, previously configured value: 2024-03-09T19:41:38Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 2024-03-09T19:41:38Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/authorize/, previously configured value: 2024-03-09T19:41:38Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 2024-03-09T19:41:38Z INFO management/server/store.go:94: using SQLite store engine Error: failed retrieving a new idp manager with err: authentik IdP configuration is incomplete, TokenEndpoint is missing 2024-03-09T19:45:00Z INFO management/cmd/management.go:447: loading OIDC configuration from the provided IDP configuration endpoint https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration 2024-03-09T19:45:01Z INFO management/cmd/management.go:452: loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.MYDOMAIN.TLD/application/o/netbird/.well-known/openid-configuration 2024-03-09T19:45:01Z INFO management/cmd/management.go:454: overriding HttpConfig.AuthIssuer with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/, previously configured value: 2024-03-09T19:45:01Z INFO management/cmd/management.go:458: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.MYDOMAIN.TLD/application/o/netbird/jwks/, previously configured value: 2024-03-09T19:45:01Z INFO management/cmd/management.go:463: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 2024-03-09T19:45:01Z INFO management/cmd/management.go:466: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/device/, previously configured value: 2024-03-09T19:45:01Z INFO management/cmd/management.go:474: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.MYDOMAIN.TLD, previously configured value: 2024-03-09T19:45:01Z INFO management/cmd/management.go:484: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/token/, previously configured value: 2024-03-09T19:45:01Z INFO management/cmd/management.go:487: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://auth.MYDOMAIN.TLD/application/o/authorize/, previously configured value: 2024-03-09T19:45:01Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 2024-03-09T19:45:01Z INFO management/server/store.go:94: using SQLite store engine Error: failed retrieving a new idp manager with err: authentik IdP configuration is incomplete, TokenEndpoint is missing ``` **To Reproduce** Steps to reproduce the behavior: 1. `compose.yml` file ``` version: "3" services: #UI dashboard dashboard: image: wiretrustee/dashboard:latest restart: unless-stopped container_name: netbird-dashboard #ports: # - 80:80 # - 443:443 networks: - traefik environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.MYDOMAIN.TLD:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.MYDOMAIN.TLD:33073 # OIDC - AUTH_AUDIENCE=<CLIENT_ID> - AUTH_CLIENT_ID=<CLIENT_ID> - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY= - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken # SSL #- NGINX_SSL_PORT=443 # Letsencrypt #- LETSENCRYPT_DOMAIN= #- LETSENCRYPT_EMAIL=myemail@DOMAIN.TLD # volumes: # - netbird-letsencrypt:/etc/letsencrypt/ labels: - traefik.enable=true - traefik.http.routers.netbird-dashboard.rule=Host(`netbird.MYDOMAIN.TLD`) - traefik.http.services.netbird-dashboard.loadbalancer.server.port=80 # Signal signal: image: netbirdio/signal:latest container_name: netbird-signal restart: unless-stopped volumes: #- netbird-signal:/var/lib/netbird - ~/containers/data/netbird/signal:/var/lib/netbird networks: - traefik #ports: # - 10000:80 # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "", "--log-file", "console"] labels: - traefik.enable=true - traefik.http.routers.netbird-signal.rule=Host(`netbird.MYDOMAIN.TLD`) && PathPrefix(`/signalexchange.SignalExchange/`) - traefik.http.services.netbird-signal.loadbalancer.server.port=80 - traefik.http.services.netbird-signal.loadbalancer.server.scheme=h2c # Management management: image: netbirdio/management:latest # restart: unless-stopped # restart: no container_name: netbird-management depends_on: - dashboard volumes: # - netbird-mgmt:/var/lib/netbird - ~/containers/data/netbird/management:/var/lib/netbird # - netbird-letsencrypt:/etc/letsencrypt:ro - ~/containers/config/netbird/management.json:/etc/netbird/management.json networks: - traefik #ports: # - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "", "--log-file", "console"] command: [ "--port", "80", "--log-file", "console", "--disable-anonymous-metrics=true", "--single-account-mode-domain=netbird.MYDOMAIN.TLD", "--dns-domain=MYDOMAIN.TLD" ] labels: - traefik.enable=true - traefik.http.routers.netbird-api.rule=Host(`netbird.MYDOMAIN.TLD`) && PathPrefix(`/api`) - traefik.http.routers.netbird-api.service=netbird-api - traefik.http.services.netbird-api.loadbalancer.server.port=80 - traefik.http.routers.netbird-management.rule=Host(`netbird.MYDOMAIN.TLD`) && PathPrefix(`/management.ManagementService/`) - traefik.http.routers.netbird-management.service=netbird-management - traefik.http.services.netbird-management.loadbalancer.server.port=80 - traefik.http.services.netbird-management.loadbalancer.server.scheme=h2c # Coturn coturn: image: coturn/coturn:latest container_name: netbird-coturn restart: unless-stopped domainname: netbird.MYDOMAIN.TLD volumes: - ~/containers/config/netbird/turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro networks: - traefik network_mode: host command: - -c /etc/turnserver.conf #volumes: # netbird-mgmt: # netbird-signal: # netbird-letsencrypt: networks: traefik: external: true ``` 3. Run `podman compose up -d` 4. See that `netbird-management` is not running when issueing `podman ps`' 5. Run `podman logs netbird-management` **Expected behavior** The container `netbird-management` to start successfully. Not being stuck in a redirect / too many redirects loops causing the `netbird-management` container to automatically restart, `traefik` attemping a certificate renewal and ending up banned from Letsencrypt for a few hours. **Are you using NetBird Cloud?** Self-Hosted Control Panel. **NetBird version** Cannot enter management console since it keeps crashing / restarting ... Was installed & pulled from Docker Hub today. **NetBird status -d output:** Cannot enter management console since it keeps crashing / restarting ... Was installed & pulled from Docker Hub today. **Screenshots** N/A **Additional context** Running `podman` instead of `docker`. Installed on Debian AMD64 12 Bookworm with APT Pinning of Podman (and conmon, podman-compose, ...) from Trixie/Testing. `podman info` shows ``` host: arch: amd64 buildahVersion: 1.33.5 cgroupControllers: - cpu - memory - pids cgroupManager: systemd cgroupVersion: v2 conmon: package: conmon_2.1.10+ds1-1_amd64 path: /usr/bin/conmon version: 'conmon version 2.1.10, commit: unknown' cpuUtilization: idlePercent: 91.15 systemPercent: 2.63 userPercent: 6.22 cpus: 1 databaseBackend: sqlite distribution: codename: bookworm distribution: debian version: "12" eventLogger: journald freeLocks: 2034 hostname: ra idMappings: gidmap: - container_id: 0 host_id: 1001 size: 1 - container_id: 1 host_id: 165536 size: 65536 uidmap: - container_id: 0 host_id: 1001 size: 1 - container_id: 1 host_id: 165536 size: 65536 kernel: 6.1.0-18-amd64 linkmode: dynamic logDriver: journald memFree: 112033792 memTotal: 2012446720 networkBackend: netavark networkBackendInfo: backend: netavark dns: package: aardvark-dns_1.4.0-5_amd64 path: /usr/lib/podman/aardvark-dns version: aardvark-dns 1.4.0 package: netavark_1.4.0-3_amd64 path: /usr/lib/podman/netavark version: netavark 1.4.0 ociRuntime: name: crun package: crun_1.14.1-1_amd64 path: /usr/bin/crun version: |- crun version 1.14.1 commit: de537a7965bfbe9992e2cfae0baeb56a08128171 rundir: /run/user/1001/crun spec: 1.0.0 +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +WASM:wasmedge +YAJL os: linux pasta: executable: /usr/bin/pasta package: passt_0.0~git20230309.7c7625d-1_amd64 version: | pasta unknown version Copyright Red Hat GNU Affero GPL version 3 or later <https://www.gnu.org/licenses/agpl-3.0.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. remoteSocket: exists: true path: /run/user/1001/podman/podman.sock security: apparmorEnabled: false capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT rootless: true seccompEnabled: true seccompProfilePath: /usr/share/containers/seccomp.json selinuxEnabled: false serviceIsRemote: false slirp4netns: executable: /usr/bin/slirp4netns package: slirp4netns_1.2.0-1_amd64 version: |- slirp4netns version 1.2.0 commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383 libslirp: 4.7.0 SLIRP_CONFIG_VERSION_MAX: 4 libseccomp: 2.5.4 swapFree: 604762112 swapTotal: 1023406080 uptime: 320h 15m 8.00s (Approximately 13.33 days) variant: "" plugins: authorization: null log: - k8s-file - none - passthrough - journald network: - bridge - macvlan - ipvlan volume: - local registries: search: - registry.fedoraproject.org - registry.access.redhat.com - docker.io - quay.io store: configFile: /home/podman/.config/containers/storage.conf containerStore: number: 9 paused: 0 running: 8 stopped: 1 graphDriverName: overlay graphOptions: overlay.mount_program: Executable: /usr/bin/fuse-overlayfs Package: fuse-overlayfs_1.13-1_amd64 Version: |- fusermount3 version: 3.14.0 fuse-overlayfs: version 1.13-dev FUSE library version 3.14.0 using FUSE kernel interface version 7.31 overlay.mountopt: nodev,metacopy=on graphRoot: /home/podman/containers/storage graphRootAllocated: 18969468928 graphRootUsed: 7787802624 graphStatus: Backing Filesystem: extfs Native Overlay Diff: "false" Supports d_type: "true" Supports shifting: "true" Supports volatile: "true" Using metacopy: "false" imageCopyTmpDir: /var/tmp imageStore: number: 12 runRoot: /run/user/1001 transientStore: false volumePath: /home/podman/containers/storage/volumes version: APIVersion: 4.9.3 Built: 0 BuiltTime: Thu Jan 1 01:00:00 1970 GitCommit: "" GoVersion: go1.21.6 Os: linux OsArch: linux/amd64 Version: 4.9.3 ```
saavagebueno added the waiting-feedbackauthentikself-hostinggetting-started labels 2026-08-05 00:49:08 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label authentik getting-started self-hosting waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#2828
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?