DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #3723] Netbird with Keycloak and Caddy #7909

New Issue
Closed
opened 2026-08-05 01:15:11 -04:00 by saavagebueno · 4 comments
saavagebueno commented 2026-08-05 01:15:11 -04:00
Owner
Copy Link

Originally created by @quantumryuu on GitHub (Apr 23, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3723

Hello all! I'm trying to install Netbird with the Advanced Guide as found here, but I hit a wall.
There is an error somewhere since Caddy can't communicate properly with the management.
Here's the Caddy log

{
  "level": "error",
  "ts": 1745404354.979611,
  "logger": "http.log.error",
  "msg": "write tcp 172.20.0.3:35810->172.20.0.9:80: write: broken pipe",
  "request": {
    "remote_ip": "10.10.30.1",
    "remote_port": "45118",
    "client_ip": "10.10.30.1",
    "proto": "HTTP/2.0",
    "method": "POST",
    "host": "netbird.domain.tld:443",
    "uri": "/management.ManagementService/GetServerKey",
    "headers": {
      "Content-Type": ["application/grpc"],
      "User-Agent": ["grpc-go/1.64.1"],
      "Te": ["trailers"],
      "Grpc-Timeout": ["4999865u"]
    },
    "tls": {
      "resumed": false,
      "version": 772,
      "cipher_suite": 4865,
      "proto": "h2",
      "server_name": "netbird.domain.tld"
    }
  },
  "duration": 0.001369862,
  "status": 502,
  "err_id": "dstks7c9q",
  "err_trace": "reverseproxy.statusError (reverseproxy.go:1373)"
}

For reference here's my configuration:
docker-compose.yml

services:
  # UI dashboard
  dashboard:
    container_name: netbird-dashboard
    networks:
      - caddy
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.domain.tld
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.domain.tld
      # OIDC
      - AUTH_AUDIENCE=netbird-client
      - AUTH_CLIENT_ID=netbird-client
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://keycloak.domain.tld/realms/master
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=none
      - LETSENCRYPT_EMAIL=

  # Signal
  signal:
    container_name: netbird-signal
    networks:
      - caddy
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird

  # Relay
  relay:
    container_name: netbird-relay
    networks:
      - caddy
    image: netbirdio/relay:latest
    restart: unless-stopped
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=netbird.domain.tld:33080
    # todo: change to a secure secret
    - NB_AUTH_SECRET=feZsIETBa0fliKURn/KUGyzM+fFET5Ag8K4pfwlpV4k

  # Management
  management:
    container_name: netbird-management
    networks:
      - caddy
    image: netbirdio/management:latest
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - ./management.json:/etc/netbird/management.json
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.domain.tld",
      "--dns-domain=netbird.selfhosted"
      ]

  # Coturn
  coturn:
    container_name: netbird-coturn
    image: coturn/coturn:latest
    restart: unless-stopped
    #domainname: netbird.domain.tld # only needed when TLS is enabled
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

volumes:
  netbird-mgmt:
  netbird-signal:

networks:
  caddy:
    external: true

management.json

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.domain.tld:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.domain.tld:3478",
                "Username": "self",
                "Password": "rM2vumPbCnCXJ3wTZUKy9NOUtL6oW1wtTIWUEC2KLnA"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rels://netbird.domain.tld:443"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "feZsIETBa0fliKURn/KUGyzM+fFET5Ag8K4pfwlpV4k"
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.domain.tld:443",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "BPT+zjhZ7KcJnrm3v3cA3RjtgWpTa/goI28Zu3LwTKE=",
    "HttpConfig": {
        "LetsEncryptDomain": "none",
        "AuthAudience": "netbird-client",
        "AuthIssuer": "https://keycloak.domain.tld/realms/master",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/certs",
        "OIDCConfigEndpoint": "https://keycloak.domain.tld/realms/master/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "keycloak",
        "ClientConfig": {
            "Issuer": "https://keycloak.domain.tld/realms/master",
            "TokenEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token",
            "ClientID": "netbird-backend",
            "ClientSecret": "7aLq7axngwIaXEec7IRc0nqFlRmWlwu2",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "AdminEndpoint": "https://keycloak.domain.tld/admin/realms/master"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
            "ClientID": "netbird-client",
            "ClientSecret": "",
            "Domain": "keycloak.domain.tld",
            "Audience": "netbird-client",
            "TokenEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token",
            "DeviceAuthEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth/device",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null,
            "DisablePromptLogin": false
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "netbird-client",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "netbird-client",
            "TokenEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth",
            "Scope": "openid profile email offline_access api",
            "UseIDToken": false,
            "RedirectURLs": [
                "http://localhost:53000"
            ],
            "DisablePromptLogin": false
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}

openid-configuration.json

{
  "issuer": "https://keycloak.domain.tld/realms/master",
  "authorization_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth",
  "token_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token",
  "introspection_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token/introspect",
  "userinfo_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/userinfo",
  "end_session_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/logout",
  "frontchannel_logout_session_supported": true,
  "frontchannel_logout_supported": true,
  "jwks_uri": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/certs",
  "check_session_iframe": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/login-status-iframe.html",
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "implicit",
    "password",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code",
    "urn:ietf:params:oauth:grant-type:token-exchange",
    "urn:ietf:params:oauth:grant-type:uma-ticket",
    "urn:openid:params:grant-type:ciba"
  ],
  "acr_values_supported": ["0", "1"],
  "response_types_supported": [
    "code",
    "none",
    "id_token",
    "token",
    "id_token token",
    "code id_token",
    "code token",
    "code id_token token"
  ],
  "subject_types_supported": ["public", "pairwise"],
  "prompt_values_supported": ["none", "login", "consent"],
  "id_token_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512"
  ],
  "id_token_encryption_alg_values_supported": [
    "ECDH-ES+A256KW",
    "ECDH-ES+A192KW",
    "ECDH-ES+A128KW",
    "RSA-OAEP",
    "RSA-OAEP-256",
    "RSA1_5",
    "ECDH-ES"
  ],
  "id_token_encryption_enc_values_supported": [
    "A256GCM",
    "A192GCM",
    "A128GCM",
    "A128CBC-HS256",
    "A192CBC-HS384",
    "A256CBC-HS512"
  ],
  "userinfo_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512",
    "none"
  ],
  "userinfo_encryption_alg_values_supported": [
    "ECDH-ES+A256KW",
    "ECDH-ES+A192KW",
    "ECDH-ES+A128KW",
    "RSA-OAEP",
    "RSA-OAEP-256",
    "RSA1_5",
    "ECDH-ES"
  ],
  "userinfo_encryption_enc_values_supported": [
    "A256GCM",
    "A192GCM",
    "A128GCM",
    "A128CBC-HS256",
    "A192CBC-HS384",
    "A256CBC-HS512"
  ],
  "request_object_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512",
    "none"
  ],
  "request_object_encryption_alg_values_supported": [
    "ECDH-ES+A256KW",
    "ECDH-ES+A192KW",
    "ECDH-ES+A128KW",
    "RSA-OAEP",
    "RSA-OAEP-256",
    "RSA1_5",
    "ECDH-ES"
  ],
  "request_object_encryption_enc_values_supported": [
    "A256GCM",
    "A192GCM",
    "A128GCM",
    "A128CBC-HS256",
    "A192CBC-HS384",
    "A256CBC-HS512"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post",
    "query.jwt",
    "fragment.jwt",
    "form_post.jwt",
    "jwt"
  ],
  "registration_endpoint": "https://keycloak.domain.tld/realms/master/clients-registrations/openid-connect",
  "token_endpoint_auth_methods_supported": [
    "private_key_jwt",
    "client_secret_basic",
    "client_secret_post",
    "tls_client_auth",
    "client_secret_jwt"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512"
  ],
  "introspection_endpoint_auth_methods_supported": [
    "private_key_jwt",
    "client_secret_basic",
    "client_secret_post",
    "tls_client_auth",
    "client_secret_jwt"
  ],
  "introspection_endpoint_auth_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512"
  ],
  "authorization_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512"
  ],
  "authorization_encryption_alg_values_supported": [
    "ECDH-ES+A256KW",
    "ECDH-ES+A192KW",
    "ECDH-ES+A128KW",
    "RSA-OAEP",
    "RSA-OAEP-256",
    "RSA1_5",
    "ECDH-ES"
  ],
  "authorization_encryption_enc_values_supported": [
    "A256GCM",
    "A192GCM",
    "A128GCM",
    "A128CBC-HS256",
    "A192CBC-HS384",
    "A256CBC-HS512"
  ],
  "claims_supported": [
    "aud",
    "sub",
    "iss",
    "auth_time",
    "name",
    "given_name",
    "family_name",
    "preferred_username",
    "email",
    "acr"
  ],
  "claim_types_supported": ["normal"],
  "claims_parameter_supported": true,
  "scopes_supported": [
    "address",
    "acr",
    "web-origins",
    "microprofile-jwt",
    "service_account",
    "roles",
    "offline_access",
    "email",
    "basic",
    "organization",
    "openid",
    "api",
    "profile",
    "phone"
  ],
  "request_parameter_supported": true,
  "request_uri_parameter_supported": true,
  "require_request_uri_registration": true,
  "code_challenge_methods_supported": ["plain", "S256"],
  "tls_client_certificate_bound_access_tokens": true,
  "revocation_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/revoke",
  "revocation_endpoint_auth_methods_supported": [
    "private_key_jwt",
    "client_secret_basic",
    "client_secret_post",
    "tls_client_auth",
    "client_secret_jwt"
  ],
  "revocation_endpoint_auth_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "HS256",
    "HS512",
    "ES256",
    "RS256",
    "HS384",
    "ES512",
    "PS256",
    "PS512",
    "RS512"
  ],
  "backchannel_logout_supported": true,
  "backchannel_logout_session_supported": true,
  "device_authorization_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth/device",
  "backchannel_token_delivery_modes_supported": ["poll", "ping"],
  "backchannel_authentication_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/ciba/auth",
  "backchannel_authentication_request_signing_alg_values_supported": [
    "PS384",
    "RS384",
    "EdDSA",
    "ES384",
    "ES256",
    "RS256",
    "ES512",
    "PS256",
    "PS512",
    "RS512"
  ],
  "require_pushed_authorization_requests": false,
  "pushed_authorization_request_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/par/request",
  "mtls_endpoint_aliases": {
    "token_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token",
    "revocation_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/revoke",
    "introspection_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token/introspect",
    "device_authorization_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth/device",
    "registration_endpoint": "https://keycloak.domain.tld/realms/master/clients-registrations/openid-connect",
    "userinfo_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/userinfo",
    "pushed_authorization_request_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/par/request",
    "backchannel_authentication_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/ciba/auth"
  },
  "authorization_response_iss_parameter_supported": true
}

Caddyfile

(security_headers) {
    header * {
        # enable HSTS
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#s>
        # NOTE: Read carefully how this header works before using it.
        # If the HSTS header is misconfigured or if there is a problem with
        # the SSL/TLS certificate being used, legitimate users might be unable
        # to access the website. For example, if the HSTS header is set to a
        # very long duration and the SSL/TLS certificate expires or is revoked,
        # legitimate users might be unable to access the website until
        # the HSTS header duration has expired.
        # The recommended value for the max-age is 2 year (63072000 seconds).
        # But we are using 1 hour (3600 seconds) for testing purposes
        # and ensure that the website is working properly before setting
        # to two years.

        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"

        # disable clients from sniffing the media type
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x>
        X-Content-Type-Options "nosniff"

        # clickjacking protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x>
        X-Frame-Options "SAMEORIGIN"

        # xss protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x>
        X-XSS-Protection "1; mode=block"

        # Remove -Server header, which is an information leak
        # Remove Caddy from Headers
        -Server

        # keep referrer data off of HTTP connections
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#r>
        Referrer-Policy strict-origin-when-cross-origin
    }
}

netbird.domain.tld:80, netbird.domain.tld:443 {
    import security_headers
    # relay
    reverse_proxy /relay* netbird-relay:80
    # Signal
    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:80
    # Management
    reverse_proxy /api/* netbird-management:80
    reverse_proxy /management.ManagementService/* h2c://netbird-management:80
    # Dashboard
    reverse_proxy /* netbird-dashboard:80
}
Originally created by @quantumryuu on GitHub (Apr 23, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3723 Hello all! I'm trying to install Netbird with the Advanced Guide as found [here](https://docs.netbird.io/selfhosted/selfhosted-guide), but I hit a wall. There is an error somewhere since Caddy can't communicate properly with the management. Here's the Caddy log ``` { "level": "error", "ts": 1745404354.979611, "logger": "http.log.error", "msg": "write tcp 172.20.0.3:35810->172.20.0.9:80: write: broken pipe", "request": { "remote_ip": "10.10.30.1", "remote_port": "45118", "client_ip": "10.10.30.1", "proto": "HTTP/2.0", "method": "POST", "host": "netbird.domain.tld:443", "uri": "/management.ManagementService/GetServerKey", "headers": { "Content-Type": ["application/grpc"], "User-Agent": ["grpc-go/1.64.1"], "Te": ["trailers"], "Grpc-Timeout": ["4999865u"] }, "tls": { "resumed": false, "version": 772, "cipher_suite": 4865, "proto": "h2", "server_name": "netbird.domain.tld" } }, "duration": 0.001369862, "status": 502, "err_id": "dstks7c9q", "err_trace": "reverseproxy.statusError (reverseproxy.go:1373)" } ``` For reference here's my configuration: **docker-compose.yml** ``` services: # UI dashboard dashboard: container_name: netbird-dashboard networks: - caddy image: netbirdio/dashboard:latest restart: unless-stopped environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.domain.tld - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.domain.tld # OIDC - AUTH_AUDIENCE=netbird-client - AUTH_CLIENT_ID=netbird-client - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://keycloak.domain.tld/realms/master - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN=none - LETSENCRYPT_EMAIL= # Signal signal: container_name: netbird-signal networks: - caddy image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird # Relay relay: container_name: netbird-relay networks: - caddy image: netbirdio/relay:latest restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=netbird.domain.tld:33080 # todo: change to a secure secret - NB_AUTH_SECRET=feZsIETBa0fliKURn/KUGyzM+fFET5Ag8K4pfwlpV4k # Management management: container_name: netbird-management networks: - caddy image: netbirdio/management:latest restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - ./management.json:/etc/netbird/management.json command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.domain.tld", "--dns-domain=netbird.selfhosted" ] # Coturn coturn: container_name: netbird-coturn image: coturn/coturn:latest restart: unless-stopped #domainname: netbird.domain.tld # only needed when TLS is enabled volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: networks: caddy: external: true ``` **management.json** ``` { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.domain.tld:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.domain.tld:3478", "Username": "self", "Password": "rM2vumPbCnCXJ3wTZUKy9NOUtL6oW1wtTIWUEC2KLnA" } ] }, "Relay": { "Addresses": [ "rels://netbird.domain.tld:443" ], "CredentialsTTL": "24h0m0s", "Secret": "feZsIETBa0fliKURn/KUGyzM+fFET5Ag8K4pfwlpV4k" }, "Signal": { "Proto": "https", "URI": "netbird.domain.tld:443", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "BPT+zjhZ7KcJnrm3v3cA3RjtgWpTa/goI28Zu3LwTKE=", "HttpConfig": { "LetsEncryptDomain": "none", "AuthAudience": "netbird-client", "AuthIssuer": "https://keycloak.domain.tld/realms/master", "AuthUserIDClaim": "", "AuthKeysLocation": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/certs", "OIDCConfigEndpoint": "https://keycloak.domain.tld/realms/master/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "keycloak", "ClientConfig": { "Issuer": "https://keycloak.domain.tld/realms/master", "TokenEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token", "ClientID": "netbird-backend", "ClientSecret": "7aLq7axngwIaXEec7IRc0nqFlRmWlwu2", "GrantType": "client_credentials" }, "ExtraConfig": { "AdminEndpoint": "https://keycloak.domain.tld/admin/realms/master" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "keycloak.domain.tld", "Audience": "netbird-client", "TokenEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token", "DeviceAuthEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth/device", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null, "DisablePromptLogin": false } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "", "Audience": "netbird-client", "TokenEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ], "DisablePromptLogin": false } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } ``` **openid-configuration.json** ``` { "issuer": "https://keycloak.domain.tld/realms/master", "authorization_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth", "token_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token", "introspection_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token/introspect", "userinfo_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/userinfo", "end_session_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/logout", "frontchannel_logout_session_supported": true, "frontchannel_logout_supported": true, "jwks_uri": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/certs", "check_session_iframe": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/login-status-iframe.html", "grant_types_supported": [ "authorization_code", "client_credentials", "implicit", "password", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code", "urn:ietf:params:oauth:grant-type:token-exchange", "urn:ietf:params:oauth:grant-type:uma-ticket", "urn:openid:params:grant-type:ciba" ], "acr_values_supported": ["0", "1"], "response_types_supported": [ "code", "none", "id_token", "token", "id_token token", "code id_token", "code token", "code id_token token" ], "subject_types_supported": ["public", "pairwise"], "prompt_values_supported": ["none", "login", "consent"], "id_token_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "id_token_encryption_alg_values_supported": [ "ECDH-ES+A256KW", "ECDH-ES+A192KW", "ECDH-ES+A128KW", "RSA-OAEP", "RSA-OAEP-256", "RSA1_5", "ECDH-ES" ], "id_token_encryption_enc_values_supported": [ "A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512" ], "userinfo_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512", "none" ], "userinfo_encryption_alg_values_supported": [ "ECDH-ES+A256KW", "ECDH-ES+A192KW", "ECDH-ES+A128KW", "RSA-OAEP", "RSA-OAEP-256", "RSA1_5", "ECDH-ES" ], "userinfo_encryption_enc_values_supported": [ "A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512" ], "request_object_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512", "none" ], "request_object_encryption_alg_values_supported": [ "ECDH-ES+A256KW", "ECDH-ES+A192KW", "ECDH-ES+A128KW", "RSA-OAEP", "RSA-OAEP-256", "RSA1_5", "ECDH-ES" ], "request_object_encryption_enc_values_supported": [ "A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512" ], "response_modes_supported": [ "query", "fragment", "form_post", "query.jwt", "fragment.jwt", "form_post.jwt", "jwt" ], "registration_endpoint": "https://keycloak.domain.tld/realms/master/clients-registrations/openid-connect", "token_endpoint_auth_methods_supported": [ "private_key_jwt", "client_secret_basic", "client_secret_post", "tls_client_auth", "client_secret_jwt" ], "token_endpoint_auth_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "introspection_endpoint_auth_methods_supported": [ "private_key_jwt", "client_secret_basic", "client_secret_post", "tls_client_auth", "client_secret_jwt" ], "introspection_endpoint_auth_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "authorization_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "authorization_encryption_alg_values_supported": [ "ECDH-ES+A256KW", "ECDH-ES+A192KW", "ECDH-ES+A128KW", "RSA-OAEP", "RSA-OAEP-256", "RSA1_5", "ECDH-ES" ], "authorization_encryption_enc_values_supported": [ "A256GCM", "A192GCM", "A128GCM", "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512" ], "claims_supported": [ "aud", "sub", "iss", "auth_time", "name", "given_name", "family_name", "preferred_username", "email", "acr" ], "claim_types_supported": ["normal"], "claims_parameter_supported": true, "scopes_supported": [ "address", "acr", "web-origins", "microprofile-jwt", "service_account", "roles", "offline_access", "email", "basic", "organization", "openid", "api", "profile", "phone" ], "request_parameter_supported": true, "request_uri_parameter_supported": true, "require_request_uri_registration": true, "code_challenge_methods_supported": ["plain", "S256"], "tls_client_certificate_bound_access_tokens": true, "revocation_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/revoke", "revocation_endpoint_auth_methods_supported": [ "private_key_jwt", "client_secret_basic", "client_secret_post", "tls_client_auth", "client_secret_jwt" ], "revocation_endpoint_auth_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "HS256", "HS512", "ES256", "RS256", "HS384", "ES512", "PS256", "PS512", "RS512" ], "backchannel_logout_supported": true, "backchannel_logout_session_supported": true, "device_authorization_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth/device", "backchannel_token_delivery_modes_supported": ["poll", "ping"], "backchannel_authentication_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/ciba/auth", "backchannel_authentication_request_signing_alg_values_supported": [ "PS384", "RS384", "EdDSA", "ES384", "ES256", "RS256", "ES512", "PS256", "PS512", "RS512" ], "require_pushed_authorization_requests": false, "pushed_authorization_request_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/par/request", "mtls_endpoint_aliases": { "token_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token", "revocation_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/revoke", "introspection_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/token/introspect", "device_authorization_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/auth/device", "registration_endpoint": "https://keycloak.domain.tld/realms/master/clients-registrations/openid-connect", "userinfo_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/userinfo", "pushed_authorization_request_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/par/request", "backchannel_authentication_endpoint": "https://keycloak.domain.tld/realms/master/protocol/openid-connect/ext/ciba/auth" }, "authorization_response_iss_parameter_supported": true } ``` **Caddyfile** ``` (security_headers) { header * { # enable HSTS # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#s> # NOTE: Read carefully how this header works before using it. # If the HSTS header is misconfigured or if there is a problem with # the SSL/TLS certificate being used, legitimate users might be unable # to access the website. For example, if the HSTS header is set to a # very long duration and the SSL/TLS certificate expires or is revoked, # legitimate users might be unable to access the website until # the HSTS header duration has expired. # The recommended value for the max-age is 2 year (63072000 seconds). # But we are using 1 hour (3600 seconds) for testing purposes # and ensure that the website is working properly before setting # to two years. Strict-Transport-Security "max-age=3600; includeSubDomains; preload" # disable clients from sniffing the media type # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x> X-Content-Type-Options "nosniff" # clickjacking protection # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x> X-Frame-Options "SAMEORIGIN" # xss protection # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x> X-XSS-Protection "1; mode=block" # Remove -Server header, which is an information leak # Remove Caddy from Headers -Server # keep referrer data off of HTTP connections # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#r> Referrer-Policy strict-origin-when-cross-origin } } netbird.domain.tld:80, netbird.domain.tld:443 { import security_headers # relay reverse_proxy /relay* netbird-relay:80 # Signal reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:80 # Management reverse_proxy /api/* netbird-management:80 reverse_proxy /management.ManagementService/* h2c://netbird-management:80 # Dashboard reverse_proxy /* netbird-dashboard:80 } ```
saavagebueno commented 2026-08-05 01:15:11 -04:00
Author
Owner
Copy Link

@quantumryuu commented on GitHub (Apr 23, 2025):

Also, something I found in the netbird-management container logs is this

TLS handshake error from 172.20.0.3:58970: client sent an HTTP request to an HTTPS server
<!-- gh-comment-id:2823879352 --> @quantumryuu commented on GitHub (Apr 23, 2025): Also, something I found in the netbird-management container logs is this ``` TLS handshake error from 172.20.0.3:58970: client sent an HTTP request to an HTTPS server ```
saavagebueno commented 2026-08-05 01:15:11 -04:00
Author
Owner
Copy Link

@TurtleDevil1 commented on GitHub (Apr 23, 2025):

Hey, I am beginner but I try to help :D

Could you provide the information what device is "172.20.0.3" sending the request?
I assume its the caddy trying to esablish the connection but on the wrong port.
Its not in the documentation but could you try to change the http port to https in your caddyfile?
reverse_proxy /* netbird-dashboard:80 -> reverse_proxy /* netbird-dashboard:443

<!-- gh-comment-id:2824026069 --> @TurtleDevil1 commented on GitHub (Apr 23, 2025): Hey, I am beginner but I try to help :D Could you provide the information what device is "172.20.0.3" sending the request? I assume its the caddy trying to esablish the connection but on the wrong port. Its not in the documentation but could you try to change the http port to https in your caddyfile? reverse_proxy /* netbird-dashboard:80 -> reverse_proxy /* netbird-dashboard:443
saavagebueno commented 2026-08-05 01:15:11 -04:00
Author
Owner
Copy Link

@dmdhrumilmistry commented on GitHub (Oct 28, 2025):

Also, something I found in the netbird-management container logs is this

TLS handshake error from 172.20.0.3:58970: client sent an HTTP request to an HTTPS server

were you able to resolve this issue? even I'm facing this same error while trying to deploy it with k8s.

<!-- gh-comment-id:3458087782 --> @dmdhrumilmistry commented on GitHub (Oct 28, 2025): > Also, something I found in the netbird-management container logs is this > > ``` > TLS handshake error from 172.20.0.3:58970: client sent an HTTP request to an HTTPS server > ``` were you able to resolve this issue? even I'm facing this same error while trying to deploy it with k8s.
saavagebueno commented 2026-08-05 01:15:11 -04:00
Author
Owner
Copy Link

@Jagoum commented on GitHub (Jan 22, 2026):

@quantumryuu, Please is this working

<!-- gh-comment-id:3783683538 --> @Jagoum commented on GitHub (Jan 22, 2026): @quantumryuu, Please is this working
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7909
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?