SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-18 06:02:14 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Unable to add Peers to self hosted server, Getting Error: ontext: GRPC] management/server/grpcserver.go:471: failed logging in peer d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=: no peer auth method provided, please use a setup key or interactive SSO login #1537

New Issue
Closed
opened 2025-11-20 05:32:26 -05:00 by saavagebueno · 1 comment
saavagebueno commented 2025-11-20 05:32:26 -05:00
Owner
Copy Link

Originally created by @farewarr on GitHub (Dec 31, 2024).

Describe the problem

I have followed the advanced guide to setup netbird on a vps in Linode. I also created a separate vps and spun up nginx proxy manager for this setup. I use keycloak as well, which is internally hosted.

Current flow:

Client => GET netbird.nonooculusnas.com => NPM server => netbird server => GET keyclaok.nonooculusnas.com => Synology NAS box => Synology Reverse Proxy = ubuntu host that hosts keycloak => Synology Reverse Proxy => NPM => Netbird

What I am seeing in packet capture (i ran a pcap on the NPM host, the Keycloak host, Netbird sever, and my mac pc and merged them in the same file) is that the packet sent from NPM to netbird /api/users (as a GET requet) contains the authorizatio header with the token, however, when it makes a POST to the management serivce that header is not there any more.

In the client logs and the management service container logs i get the following error:

2025-01-01T00:42:30Z WARN [requestID: 32ef6bce-1c31-429a-b94a-0df3721d9625, accountID: UNKNOWN, peerID: d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=, context: GRPC] management/server/grpcserver.go:471: failed logging in peer d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=: no peer auth method provided, please use a setup key or interactive SSO login

2025-01-01T00:42:31Z WARN [context: GRPC, requestID: 8cff8192-08b0-4758-8bde-34b5483ba533, accountID: UNKNOWN, peerID: d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=] management/server/grpcserver.go:471: failed logging in peer d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=: no peer auth method provided, please use a setup key or interactive SSO login

Everything else works. I can login to the dashboard just fine.

###Docker Compose file:

services:
  #UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.nonooculusnas.com:443
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.nonooculusnas.com:443
      # OIDC
      - AUTH_AUDIENCE=netbird-client
      - AUTH_CLIENT_ID=netbird-client
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://keycloak.nonooculusnas.com/realms/NonoOculus
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      #- AUTH_REDIRECT_URI=https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth
      #- AUTH_SILENT_REDIRECT_URI=https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=support@nonooculus.com
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    ports:
      - 10000:80
        # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=netbird-relay.nonooculusnas.com:33080
    # todo: change to a secure secret
    - NB_AUTH_SECRET=dEI7PWH4IuwtFrp8mOgnY8pJ+ORYYWht+umr5Y8MZbg
    ports:
      - 33080:33080
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"


  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    ports:
      - 33073:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.nonooculusnas.com",
      "--dns-domain=netbird.nonooculusnas.com"
      ]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    environment:
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      

  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    #domainname: netbird.nonooculusnas.com # only needed when TLS is enabled
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:`

###management.json file: 
`{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.nonooculusnas.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.nonooculusnas.com:3478",
                "Username": "self",
                "Password": "password"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rel://netbird-relay.nonooculusnas.com:33080"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "secret"
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird-signal.nonooculusnas.com:10000",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "key",
    "HttpConfig": {
        "Address": "139.177.206.158:$NETBIRD_MGMT_API_PORT",
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "netbird-client",
        "AuthIssuer": "https://keycloak.nonooculusnas.com/realms/NonoOculus",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/certs",
        "OIDCConfigEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "keycloak",
        "ClientConfig": {
            "Issuer": "https://keycloak.nonooculusnas.com/realms/NonoOculus",
            "TokenEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token",
            "ClientID": "netbird-backend",
            "ClientSecret": "secret,
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "AdminEndpoint": "https://keycloak.nonooculusnas.com/admin/realms/NonoOculus"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
            "ClientID": "netbird-client",
            "ClientSecret": "",
            "Domain": "keycloak.nonooculusnas.com",
            "Audience": "netbird-client",
            "TokenEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token",
            "DeviceAuthEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth/device",
            "AuthorizationEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth",
            "Scope": "openid",
            "UseIDToken": true,
            "RedirectURLs": null
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "netbird-client",
            "ClientSecret": "",
            "Domain": "keycloak.nonooculusnas.com",
            "Audience": "netbird-client",
            "TokenEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token",
            "DeviceAuthEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth/device",
            "AuthorizationEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth",
            "Scope": "openid profile email offline_access api",
            "UseIDToken": true,
            "RedirectURLs": [
                "http://localhost:53000"
            ]
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}

###setup.env file:

## example file, you can copy this file to setup.env and update its values
##

# Image tags
# you can force specific tags for each component; will be set to latest if empty
NETBIRD_DASHBOARD_TAG=""
NETBIRD_SIGNAL_TAG=""
NETBIRD_MANAGEMENT_TAG=""
COTURN_TAG=""
NETBIRD_RELAY_TAG=""

# Dashboard domain. e.g. app.mydomain.com
NETBIRD_DOMAIN="netbird.nonooculusnas.com"
NETBIRD_DASHBOARD_ORIGIN="https://netbird.nonooculusnas.com"

# TURN server domain. e.g. turn.mydomain.com
# if not specified it will assume NETBIRD_DOMAIN
NETBIRD_TURN_DOMAIN=""

# TURN server public IP address
# required for a connection involving peers in
# the same network as the server and external peers
# usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN
NETBIRD_TURN_EXTERNAL_IP=""

# -------------------------------------------
# OIDC
#  e.g., https://example.eu.auth0.com/.well-known/openid-configuration
# -------------------------------------------
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://keycloak.nonooculusnas.com/realms/NonoOculus/.well-known/openid-configuration"
# The default setting is to transmit the audience to the IDP during authorization. However,
# if your IDP does not have this capability, you can turn this off by setting it to false.
#NETBIRD_DASH_AUTH_USE_AUDIENCE=false
NETBIRD_AUTH_AUDIENCE="netbird-client"
# e.g. netbird-client
NETBIRD_AUTH_CLIENT_ID="netbird-client"
# indicates the scopes that will be requested to the IDP
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
# NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace.
# NETBIRD_AUTH_CLIENT_SECRET=""
# if you want to use a custom claim for the user ID instead of 'sub', set it here
# NETBIRD_AUTH_USER_ID_CLAIM=""
# indicates whether to use Auth0 or not: true or false
NETBIRD_USE_AUTH0="false"
# if your IDP provider doesn't support fragmented URIs, configure custom
# redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain.
# NETBIRD_AUTH_REDIRECT_URI="/peers"
# NETBIRD_AUTH_SILENT_REDIRECT_URI="/add-peers"
# Updates the preference to use id tokens instead of access token on dashboard
# Okta and Gitlab IDPs can benefit from this
# NETBIRD_TOKEN_SOURCE="idToken"
# -------------------------------------------
# OIDC Device Authorization Flow
# -------------------------------------------
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="keycloak"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="netbird-client"
# Some IDPs requires different audience, scopes and to use id token for device authorization flow
# you can customize here:
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=true
# -------------------------------------------
# OIDC PKCE Authorization Flow
# -------------------------------------------
# Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative
# eg. 53000,54000
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"
# -------------------------------------------
# IDP Management
# -------------------------------------------
# eg. zitadel, auth0, azure, keycloak
NETBIRD_MGMT_IDP="keycloak"
# Some IDPs requires different client id and client secret for management api
NETBIRD_IDP_MGMT_CLIENT_ID=netbird-backend
NETBIRD_IDP_MGMT_CLIENT_SECRET="secret"
# Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird"
NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT="https://keycloak.nonooculusnas.com/admin/realms/NonoOculus"
# With some IDPs may be needed enabling automatic refresh of signing keys on expire
# NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=false
# NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice.
# -------------------------------------------
# Letsencrypt
# -------------------------------------------
# Disable letsencrypt
#  if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead
NETBIRD_DISABLE_LETSENCRYPT=true
# e.g. hello@mydomain.com
NETBIRD_LETSENCRYPT_EMAIL="support@nonooculus.com"
# -------------------------------------------
# Extra settings
# -------------------------------------------
# Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection
NETBIRD_DISABLE_ANONYMOUS_METRICS=false
# DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted
NETBIRD_MGMT_DNS_DOMAIN=netbird.nonooculusnas.com

# -------------------------------------------
# Relay settings
# -------------------------------------------
# Relay server domain. e.g. relay.mydomain.com
# if not specified it will assume NETBIRD_DOMAIN
NETBIRD_RELAY_DOMAIN="netbird-relay.nonooculusnas.com"

# Relay server connection port. If none is supplied
# it will default to 33080
NETBIRD_RELAY_PORT="33080"


# Reverse Proxy Config
NETBIRD_MGMT_API_PORT=33073
NETBIRD_SIGNAL_PORT=10000
NETBIRD_SIGNAL_DOMAIN="netbird-signal.nonooculusnas.com"
#NETBIRD_MGMT_DASHBOARD_PORT=80

###NGINX Host Config:

# ------------------------------------------------------------
# netbird.nonooculusnas.com
# ------------------------------------------------------------



map $scheme $hsts_header {
    https   "max-age=63072000;includeSubDomains; preload";
}

server {
  set $forward_scheme http;
  set $server         "139.177.206.158";
  set $port           80;

  listen 80;
listen [::]:80;

listen 443 ssl http2;
listen [::]:443 ssl http2;


  server_name netbird.nonooculusnas.com;


  # Custom SSL
  ssl_certificate /data/custom_ssl/npm-4/fullchain.pem;
  ssl_certificate_key /data/custom_ssl/npm-4/privkey.pem;








  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;





    # Force SSL
    include conf.d/include/force-ssl.conf;




proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;


  access_log /data/logs/proxy-host-1_access.log proxy;
  error_log /data/logs/proxy-host-1_error.log warn;

    # This is necessary so that grpc connections do not get closed early
    # see https://stackoverflow.com/a/67805465
    client_header_timeout 1d;
    client_body_timeout 1d;

    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Scheme $scheme;
    proxy_set_header        X-Forwarded-Proto https;
    proxy_set_header        X-Forwarded-Host $host;
    grpc_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header       Authorization $http_authorization;
    grpc_set_header         Authorization $http_authorization;

    # Proxy dashboard
    location / {
        proxy_pass http://139.177.206.158:80;
    }
    # Proxy Signal
    location /signalexchange.SignalExchange/ {
        grpc_pass grpc://139.177.206.158:10000;
        #grpc_ssl_verify off;
        grpc_read_timeout 1d;
        grpc_send_timeout 1d;
        grpc_socket_keepalive on;
    }
    # Proxy Management http endpoint
    location /api {
        proxy_pass http://139.177.206.158:33073;
    }
    # Proxy Management grpc endpoint
    location /management.ManagementService/ {
        grpc_pass grpc://139.177.206.158:33073;
        #grpc_ssl_verify off;
        grpc_read_timeout 1d;
        grpc_send_timeout 1d;
        grpc_socket_keepalive on;
    }





  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

To Reproduce

Steps to reproduce the behavior:

  1. install the netbird client
  2. Update that management and admin urls appropriately
  3. click connect or run netbird up
  4. The peer DOES get added to the peers list in the dashboard, but it has a gray circle and not a green circle.
  5. See error in Client logs and Management container logs

Expected behavior

Expect to see the peer added to the peers with a green circle showing that the peer is connected

Are you using NetBird Cloud?

No. I am using the self hosted option

NetBird version

Using the latest tag by default.

NetBird status -dA output:

❯ NetBird status -dA
Error: status failed: failed connecting to Signal Service : context deadline exceeded

I am also seeing that error in the client logs, however I thought that was due to the peer auth issue.

Do you face any (non-mobile) client issues?

This happens on all my macs and my android and iphone

❯ netbird up --management-url https://netbird.nonooculusnas.com:443 --admin-url https://netbird.nonooculusnas.com
Error: unable to get daemon status: rpc error: code = FailedPrecondition desc = failed connecting to Signal Service : context deadline exceeded

adding client logs here too
client.log

If any more information is needed just let me know and I'll post it ASAP. I appreciate any and all help.

Originally created by @farewarr on GitHub (Dec 31, 2024). **Describe the problem** I have followed the advanced guide to setup netbird on a vps in Linode. I also created a separate vps and spun up nginx proxy manager for this setup. I use keycloak as well, which is internally hosted. Current flow: Client => GET netbird.nonooculusnas.com => NPM server => netbird server => GET keyclaok.nonooculusnas.com => Synology NAS box => Synology Reverse Proxy = ubuntu host that hosts keycloak => Synology Reverse Proxy => NPM => Netbird What I am seeing in packet capture (i ran a pcap on the NPM host, the Keycloak host, Netbird sever, and my mac pc and merged them in the same file) is that the packet sent from NPM to netbird /api/users (as a GET requet) contains the authorizatio header with the token, however, when it makes a POST to the management serivce that header is not there any more. In the client logs and the management service container logs i get the following error: > 2025-01-01T00:42:30Z WARN [requestID: 32ef6bce-1c31-429a-b94a-0df3721d9625, accountID: UNKNOWN, peerID: d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=, context: GRPC] management/server/grpcserver.go:471: failed logging in peer d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=: no peer auth method provided, please use a setup key or interactive SSO login > 2025-01-01T00:42:31Z WARN [context: GRPC, requestID: 8cff8192-08b0-4758-8bde-34b5483ba533, accountID: UNKNOWN, peerID: d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=] management/server/grpcserver.go:471: failed logging in peer d1qCOFGHSdYiWd0RmgZ6fmXEx1RuCigyojwMfxCgJFM=: no peer auth method provided, please use a setup key or interactive SSO login Everything else works. I can login to the dashboard just fine. ###Docker Compose file: ``` services: #UI dashboard dashboard: image: netbirdio/dashboard:latest restart: unless-stopped ports: - 80:80 - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.nonooculusnas.com:443 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.nonooculusnas.com:443 # OIDC - AUTH_AUDIENCE=netbird-client - AUTH_CLIENT_ID=netbird-client - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://keycloak.nonooculusnas.com/realms/NonoOculus - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api #- AUTH_REDIRECT_URI=https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth #- AUTH_SILENT_REDIRECT_URI=https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token - NETBIRD_TOKEN_SOURCE=accessToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN= - LETSENCRYPT_EMAIL=support@nonooculus.com volumes: - netbird-letsencrypt:/etc/letsencrypt/ logging: driver: "json-file" options: max-size: "500m" max-file: "2" signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "", "--log-file", "console"] logging: driver: "json-file" options: max-size: "500m" max-file: "2" relay: image: netbirdio/relay:latest restart: unless-stopped environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=netbird-relay.nonooculusnas.com:33080 # todo: change to a secure secret - NB_AUTH_SECRET=dEI7PWH4IuwtFrp8mOgnY8pJ+ORYYWht+umr5Y8MZbg ports: - 33080:33080 logging: driver: "json-file" options: max-size: "500m" max-file: "2" management: image: netbirdio/management:latest restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "", "--log-file", "console"] command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.nonooculusnas.com", "--dns-domain=netbird.nonooculusnas.com" ] logging: driver: "json-file" options: max-size: "500m" max-file: "2" environment: - NETBIRD_STORE_ENGINE_POSTGRES_DSN= coturn: image: coturn/coturn:latest restart: unless-stopped #domainname: netbird.nonooculusnas.com # only needed when TLS is enabled volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf logging: driver: "json-file" options: max-size: "500m" max-file: "2" volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt:` ###management.json file: `{ "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.nonooculusnas.com:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.nonooculusnas.com:3478", "Username": "self", "Password": "password" } ] }, "Relay": { "Addresses": [ "rel://netbird-relay.nonooculusnas.com:33080" ], "CredentialsTTL": "24h0m0s", "Secret": "secret" }, "Signal": { "Proto": "https", "URI": "netbird-signal.nonooculusnas.com:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "key", "HttpConfig": { "Address": "139.177.206.158:$NETBIRD_MGMT_API_PORT", "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "netbird-client", "AuthIssuer": "https://keycloak.nonooculusnas.com/realms/NonoOculus", "AuthUserIDClaim": "", "AuthKeysLocation": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/certs", "OIDCConfigEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "keycloak", "ClientConfig": { "Issuer": "https://keycloak.nonooculusnas.com/realms/NonoOculus", "TokenEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token", "ClientID": "netbird-backend", "ClientSecret": "secret, "GrantType": "client_credentials" }, "ExtraConfig": { "AdminEndpoint": "https://keycloak.nonooculusnas.com/admin/realms/NonoOculus" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "keycloak.nonooculusnas.com", "Audience": "netbird-client", "TokenEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token", "DeviceAuthEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth/device", "AuthorizationEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth", "Scope": "openid", "UseIDToken": true, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "keycloak.nonooculusnas.com", "Audience": "netbird-client", "TokenEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/token", "DeviceAuthEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth/device", "AuthorizationEndpoint": "https://keycloak.nonooculusnas.com/realms/NonoOculus/protocol/openid-connect/auth", "Scope": "openid profile email offline_access api", "UseIDToken": true, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } ``` ###setup.env file: ``` ## example file, you can copy this file to setup.env and update its values ## # Image tags # you can force specific tags for each component; will be set to latest if empty NETBIRD_DASHBOARD_TAG="" NETBIRD_SIGNAL_TAG="" NETBIRD_MANAGEMENT_TAG="" COTURN_TAG="" NETBIRD_RELAY_TAG="" # Dashboard domain. e.g. app.mydomain.com NETBIRD_DOMAIN="netbird.nonooculusnas.com" NETBIRD_DASHBOARD_ORIGIN="https://netbird.nonooculusnas.com" # TURN server domain. e.g. turn.mydomain.com # if not specified it will assume NETBIRD_DOMAIN NETBIRD_TURN_DOMAIN="" # TURN server public IP address # required for a connection involving peers in # the same network as the server and external peers # usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN NETBIRD_TURN_EXTERNAL_IP="" # ------------------------------------------- # OIDC # e.g., https://example.eu.auth0.com/.well-known/openid-configuration # ------------------------------------------- NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://keycloak.nonooculusnas.com/realms/NonoOculus/.well-known/openid-configuration" # The default setting is to transmit the audience to the IDP during authorization. However, # if your IDP does not have this capability, you can turn this off by setting it to false. #NETBIRD_DASH_AUTH_USE_AUDIENCE=false NETBIRD_AUTH_AUDIENCE="netbird-client" # e.g. netbird-client NETBIRD_AUTH_CLIENT_ID="netbird-client" # indicates the scopes that will be requested to the IDP NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api" # NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace. # NETBIRD_AUTH_CLIENT_SECRET="" # if you want to use a custom claim for the user ID instead of 'sub', set it here # NETBIRD_AUTH_USER_ID_CLAIM="" # indicates whether to use Auth0 or not: true or false NETBIRD_USE_AUTH0="false" # if your IDP provider doesn't support fragmented URIs, configure custom # redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain. # NETBIRD_AUTH_REDIRECT_URI="/peers" # NETBIRD_AUTH_SILENT_REDIRECT_URI="/add-peers" # Updates the preference to use id tokens instead of access token on dashboard # Okta and Gitlab IDPs can benefit from this # NETBIRD_TOKEN_SOURCE="idToken" # ------------------------------------------- # OIDC Device Authorization Flow # ------------------------------------------- NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="keycloak" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="netbird-client" # Some IDPs requires different audience, scopes and to use id token for device authorization flow # you can customize here: NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=true # ------------------------------------------- # OIDC PKCE Authorization Flow # ------------------------------------------- # Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative # eg. 53000,54000 NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" # ------------------------------------------- # IDP Management # ------------------------------------------- # eg. zitadel, auth0, azure, keycloak NETBIRD_MGMT_IDP="keycloak" # Some IDPs requires different client id and client secret for management api NETBIRD_IDP_MGMT_CLIENT_ID=netbird-backend NETBIRD_IDP_MGMT_CLIENT_SECRET="secret" # Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird" NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT="https://keycloak.nonooculusnas.com/admin/realms/NonoOculus" # With some IDPs may be needed enabling automatic refresh of signing keys on expire # NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=false # NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice. # ------------------------------------------- # Letsencrypt # ------------------------------------------- # Disable letsencrypt # if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead NETBIRD_DISABLE_LETSENCRYPT=true # e.g. hello@mydomain.com NETBIRD_LETSENCRYPT_EMAIL="support@nonooculus.com" # ------------------------------------------- # Extra settings # ------------------------------------------- # Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection NETBIRD_DISABLE_ANONYMOUS_METRICS=false # DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted NETBIRD_MGMT_DNS_DOMAIN=netbird.nonooculusnas.com # ------------------------------------------- # Relay settings # ------------------------------------------- # Relay server domain. e.g. relay.mydomain.com # if not specified it will assume NETBIRD_DOMAIN NETBIRD_RELAY_DOMAIN="netbird-relay.nonooculusnas.com" # Relay server connection port. If none is supplied # it will default to 33080 NETBIRD_RELAY_PORT="33080" # Reverse Proxy Config NETBIRD_MGMT_API_PORT=33073 NETBIRD_SIGNAL_PORT=10000 NETBIRD_SIGNAL_DOMAIN="netbird-signal.nonooculusnas.com" #NETBIRD_MGMT_DASHBOARD_PORT=80 ``` ###NGINX Host Config: ``` # ------------------------------------------------------------ # netbird.nonooculusnas.com # ------------------------------------------------------------ map $scheme $hsts_header { https "max-age=63072000;includeSubDomains; preload"; } server { set $forward_scheme http; set $server "139.177.206.158"; set $port 80; listen 80; listen [::]:80; listen 443 ssl http2; listen [::]:443 ssl http2; server_name netbird.nonooculusnas.com; # Custom SSL ssl_certificate /data/custom_ssl/npm-4/fullchain.pem; ssl_certificate_key /data/custom_ssl/npm-4/privkey.pem; # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years) add_header Strict-Transport-Security $hsts_header always; # Force SSL include conf.d/include/force-ssl.conf; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; access_log /data/logs/proxy-host-1_access.log proxy; error_log /data/logs/proxy-host-1_error.log warn; # This is necessary so that grpc connections do not get closed early # see https://stackoverflow.com/a/67805465 client_header_timeout 1d; client_body_timeout 1d; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Scheme $scheme; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Host $host; grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Authorization $http_authorization; grpc_set_header Authorization $http_authorization; # Proxy dashboard location / { proxy_pass http://139.177.206.158:80; } # Proxy Signal location /signalexchange.SignalExchange/ { grpc_pass grpc://139.177.206.158:10000; #grpc_ssl_verify off; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } # Proxy Management http endpoint location /api { proxy_pass http://139.177.206.158:33073; } # Proxy Management grpc endpoint location /management.ManagementService/ { grpc_pass grpc://139.177.206.158:33073; #grpc_ssl_verify off; grpc_read_timeout 1d; grpc_send_timeout 1d; grpc_socket_keepalive on; } # Custom include /data/nginx/custom/server_proxy[.]conf; } ``` **To Reproduce** Steps to reproduce the behavior: 1. install the netbird client 2. Update that management and admin urls appropriately 3. click connect or run netbird up 4. The peer DOES get added to the peers list in the dashboard, but it has a gray circle and not a green circle. 5. See error in Client logs and Management container logs **Expected behavior** Expect to see the peer added to the peers with a green circle showing that the peer is connected **Are you using NetBird Cloud?** No. I am using the self hosted option **NetBird version** Using the latest tag by default. **NetBird status -dA output:** > ❯ NetBird status -dA > Error: status failed: failed connecting to Signal Service : context deadline exceeded I am also seeing that error in the client logs, however I thought that was due to the peer auth issue. **Do you face any (non-mobile) client issues?** This happens on all my macs and my android and iphone > ❯ netbird up --management-url https://netbird.nonooculusnas.com:443 --admin-url https://netbird.nonooculusnas.com > Error: unable to get daemon status: rpc error: code = FailedPrecondition desc = failed connecting to Signal Service : context deadline exceeded adding client logs here too [client.log](https://github.com/user-attachments/files/18284109/client.log) If any more information is needed just let me know and I'll post it ASAP. I appreciate any and all help.
saavagebueno added the triage-needed label 2025-11-20 05:32:26 -05:00
saavagebueno commented 2025-11-20 05:32:27 -05:00
Author
Owner
Copy Link

@farewarr commented on GitHub (Jan 2, 2025):

Issue was resolved by adding the following in the setup.env file:

NETBIRD_MGMT_API_PORT to your reverse-proxy TLS-port (default: 443)
NETBIRD_SIGNAL_PORT to your reverse-proxy TLS-port

running ./configure.sh

then modifying docker-compose.yml to map ports 33073 for management to 443 and 10000 for signal to 443.

after running docker compose up -d I was able to add peers.

@farewarr commented on GitHub (Jan 2, 2025): Issue was resolved by adding the following in the setup.env file: NETBIRD_MGMT_API_PORT to your reverse-proxy TLS-port (default: 443) NETBIRD_SIGNAL_PORT to your reverse-proxy TLS-port running ./configure.sh then modifying docker-compose.yml to map ports 33073 for management to 443 and 10000 for signal to 443. after running docker compose up -d I was able to add peers.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1537
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?