[GH-ISSUE #3662] [management] failed warming up cache due to error: Post #7695

Open
opened 2026-08-05 01:14:06 -04:00 by saavagebueno · 3 comments
Owner

Originally created by @YapWC on GitHub (Apr 11, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3662

Hi guys I am trying to deploy Netbird with Authentik on the same server without my own reverse-proxy. I am facing an error from Netbird Management.

management-1 | 2025-04-11T09:39:47Z WARN [context: SYSTEM] management/server/account.go:219: failed warming up cache due to error: Post "http://net.xxx.io:9000/application/o/token/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

I have created a docker network that is used for Netbird (management) and Authentik (server) to communicate internally with each other. The docker-compose.yaml for both it is as follow.

Netbird
services:
dashboard:
image: netbirdio/dashboard:latest
restart: unless-stopped
ports:
- 80:80
- 443:443
environment:
- NETBIRD_MGMT_API_ENDPOINT=https://net.xxx.io:33073
- NETBIRD_MGMT_GRPC_API_ENDPOINT=https://net.xxx.io:33073
- AUTH_AUDIENCE=r9MZUfxpbRdFfDamoIiNUNnJFPBsjpoZ5w3iOc3m
- AUTH_CLIENT_ID=r9MZUfxpbRdFfDamoIiNUNnJFPBsjpoZ5w3iOc3m
- AUTH_CLIENT_SECRET=
- AUTH_AUTHORITY=http://net.xxx.io:9000/application/o/netbird/
- USE_AUTH0=false
- AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
- AUTH_REDIRECT_URI=
- AUTH_SILENT_REDIRECT_URI=
- NETBIRD_TOKEN_SOURCE=accessToken
- NGINX_SSL_PORT=443
- LETSENCRYPT_DOMAIN=net.xxx.io
- LETSENCRYPT_EMAIL=
volumes:
- netbird-letsencrypt:/etc/letsencrypt/
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"
networks:
- netbird

signal:
image: netbirdio/signal:latest
restart: unless-stopped
volumes:
- netbird-signal:/var/lib/netbird
ports:
- 10000:80
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"
networks:
- netbird

relay:
image: netbirdio/relay:latest
restart: unless-stopped
environment:
- NB_LOG_LEVEL=info
- NB_LISTEN_ADDRESS=:33080
- NB_EXPOSED_ADDRESS=net.xxx.io:33080
- NB_AUTH_SECRET=xxx
ports:
- 33080:33080
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"
networks:
- netbird

management:
image: netbirdio/management:latest
restart: unless-stopped
depends_on:
- dashboard
volumes:
- netbird-mgmt:/var/lib/netbird
- netbird-letsencrypt:/etc/letsencrypt:ro
- ./management.json:/etc/netbird/management.json
ports:
- 33073:443 #API port
command: [
"--port", "443",
"--log-file", "console",
"--log-level", "info",
"--disable-anonymous-metrics=false",
"--single-account-mode-domain=net.xxx.io",
"--dns-domain=netbird.selfhosted"
]
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"
environment:
- NETBIRD_STORE_ENGINE_POSTGRES_DSN=
- NETBIRD_STORE_ENGINE_MYSQL_DSN=
networks:
- netbird
- netbird-authentik

coturn:
image: coturn/coturn:latest
restart: unless-stopped
volumes:
- ./turnserver.conf:/etc/turnserver.conf:ro
network_mode: host
command:
- -c /etc/turnserver.conf
logging:
driver: "json-file"
options:
max-size: "500m"
max-file: "2"

volumes:
netbird-mgmt:
netbird-signal:
netbird-letsencrypt:
networks:
netbird:
external: true
netbird-authentik:
external: true

Authentik
services:
postgresql:
image: docker.io/library/postgres:16-alpine
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
start_period: 20s
interval: 30s
retries: 5
timeout: 5s
volumes:
- database:/var/lib/postgresql/data
environment:
POSTGRES_PASSWORD: ${PG_PASS:?database password required}
POSTGRES_USER: ${PG_USER:-authentik}
POSTGRES_DB: ${PG_DB:-authentik}
env_file:
- .env
networks:
- authentik
redis:
image: docker.io/library/redis:alpine
command: --save 60 1 --loglevel warning
restart: unless-stopped
healthcheck:
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
start_period: 20s
interval: 30s
retries: 5
timeout: 3s
volumes:
- redis:/data
networks:
- authentik
server:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.4}
restart: unless-stopped
command: server
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
volumes:
- ./media:/media
- ./custom-templates:/templates
env_file:
- .env
ports:
- "${COMPOSE_PORT_HTTP:-9000}:9000"
- "${COMPOSE_PORT_HTTPS:-9443}:9443"
depends_on:
postgresql:
condition: service_healthy
redis:
condition: service_healthy
networks:
- netbird-authentik
- authentik
worker:
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.4}
restart: unless-stopped
command: worker
environment:
AUTHENTIK_REDIS__HOST: redis
AUTHENTIK_POSTGRESQL__HOST: postgresql
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
user: root
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./media:/media
- ./certs:/certs
- ./custom-templates:/templates
env_file:
- .env
depends_on:
postgresql:
condition: service_healthy
redis:
condition: service_healthy
networks:
- authentik

volumes:
database:
driver: local
redis:
driver: local

networks:
authentik:
external: true
netbird-authentik:
external: true

I am not sure what is stopping management to Post a request to the Authentik. Could be firewall but that would not make sense because there should be no restriction for outgoing traffic. Hope someone could give a few hints here and there what could be the potential issue.

Originally created by @YapWC on GitHub (Apr 11, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3662 Hi guys I am trying to deploy Netbird with Authentik on the same server without my own reverse-proxy. I am facing an error from Netbird Management. ` management-1 | 2025-04-11T09:39:47Z WARN [context: SYSTEM] management/server/account.go:219: failed warming up cache due to error: Post "http://net.xxx.io:9000/application/o/token/": context deadline exceeded (Client.Timeout exceeded while awaiting headers) ` I have created a docker network that is used for Netbird (management) and Authentik (server) to communicate internally with each other. The docker-compose.yaml for both it is as follow. **Netbird** services: dashboard: image: netbirdio/dashboard:latest restart: unless-stopped ports: - 80:80 - 443:443 environment: - NETBIRD_MGMT_API_ENDPOINT=https://net.xxx.io:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://net.xxx.io:33073 - AUTH_AUDIENCE=r9MZUfxpbRdFfDamoIiNUNnJFPBsjpoZ5w3iOc3m - AUTH_CLIENT_ID=r9MZUfxpbRdFfDamoIiNUNnJFPBsjpoZ5w3iOc3m - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=http://net.xxx.io:9000/application/o/netbird/ - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken - NGINX_SSL_PORT=443 - LETSENCRYPT_DOMAIN=net.xxx.io - LETSENCRYPT_EMAIL= volumes: - netbird-letsencrypt:/etc/letsencrypt/ logging: driver: "json-file" options: max-size: "500m" max-file: "2" networks: - netbird signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 logging: driver: "json-file" options: max-size: "500m" max-file: "2" networks: - netbird relay: image: netbirdio/relay:latest restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=net.xxx.io:33080 - NB_AUTH_SECRET=xxx ports: - 33080:33080 logging: driver: "json-file" options: max-size: "500m" max-file: "2" networks: - netbird management: image: netbirdio/management:latest restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 33073:443 #API port command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=net.xxx.io", "--dns-domain=netbird.selfhosted" ] logging: driver: "json-file" options: max-size: "500m" max-file: "2" environment: - NETBIRD_STORE_ENGINE_POSTGRES_DSN= - NETBIRD_STORE_ENGINE_MYSQL_DSN= networks: - netbird - netbird-authentik coturn: image: coturn/coturn:latest restart: unless-stopped volumes: - ./turnserver.conf:/etc/turnserver.conf:ro network_mode: host command: - -c /etc/turnserver.conf logging: driver: "json-file" options: max-size: "500m" max-file: "2" volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: networks: netbird: external: true netbird-authentik: external: true **Authentik** services: postgresql: image: docker.io/library/postgres:16-alpine restart: unless-stopped healthcheck: test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] start_period: 20s interval: 30s retries: 5 timeout: 5s volumes: - database:/var/lib/postgresql/data environment: POSTGRES_PASSWORD: ${PG_PASS:?database password required} POSTGRES_USER: ${PG_USER:-authentik} POSTGRES_DB: ${PG_DB:-authentik} env_file: - .env networks: - authentik redis: image: docker.io/library/redis:alpine command: --save 60 1 --loglevel warning restart: unless-stopped healthcheck: test: ["CMD-SHELL", "redis-cli ping | grep PONG"] start_period: 20s interval: 30s retries: 5 timeout: 3s volumes: - redis:/data networks: - authentik server: image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.4} restart: unless-stopped command: server environment: AUTHENTIK_REDIS__HOST: redis AUTHENTIK_POSTGRESQL__HOST: postgresql AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} volumes: - ./media:/media - ./custom-templates:/templates env_file: - .env ports: - "${COMPOSE_PORT_HTTP:-9000}:9000" - "${COMPOSE_PORT_HTTPS:-9443}:9443" depends_on: postgresql: condition: service_healthy redis: condition: service_healthy networks: - netbird-authentik - authentik worker: image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.2.4} restart: unless-stopped command: worker environment: AUTHENTIK_REDIS__HOST: redis AUTHENTIK_POSTGRESQL__HOST: postgresql AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik} AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik} AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS} user: root volumes: - /var/run/docker.sock:/var/run/docker.sock - ./media:/media - ./certs:/certs - ./custom-templates:/templates env_file: - .env depends_on: postgresql: condition: service_healthy redis: condition: service_healthy networks: - authentik volumes: database: driver: local redis: driver: local networks: authentik: external: true netbird-authentik: external: true I am not sure what is stopping management to Post a request to the Authentik. Could be firewall but that would not make sense because there should be no restriction for outgoing traffic. Hope someone could give a few hints here and there what could be the potential issue.
Author
Owner

@mrtemu2 commented on GitHub (Apr 24, 2025):

Did you find the isseu?

<!-- gh-comment-id:2826385233 --> @mrtemu2 commented on GitHub (Apr 24, 2025): Did you find the isseu?
Author
Owner

@YapWC commented on GitHub (Apr 24, 2025):

Did you find the isseu?

I found out that my issue was something to do with the Provider Scope. Under Authentik Applications -> Providers -> Edit Netbird -> Scope.

Image

Make sure all the 5 scope is added. Not sure if this would solve your issue.

<!-- gh-comment-id:2829234805 --> @YapWC commented on GitHub (Apr 24, 2025): > Did you find the isseu? I found out that my issue was something to do with the Provider Scope. Under Authentik Applications -> Providers -> Edit Netbird -> Scope. <img width="1063" alt="Image" src="https://github.com/user-attachments/assets/8890c44f-0e9c-4a6e-bb51-f4ff300faf28" /> Make sure all the 5 scope is added. Not sure if this would solve your issue.
Author
Owner

@USHER-PB commented on GitHub (Sep 28, 2025):

HI what about if i am using keycloak as IDP ??

<!-- gh-comment-id:3342670810 --> @USHER-PB commented on GitHub (Sep 28, 2025): HI what about if i am using keycloak as IDP ??
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7695