SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 01:12:51 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

502 Bad Gateway when after login in netbird #2141

New Issue
Closed
opened 2025-11-20 07:04:40 -05:00 by saavagebueno · 1 comment
saavagebueno commented 2025-11-20 07:04:40 -05:00
Owner
Copy Link

Originally created by @holy5 on GitHub (Jul 31, 2025).

Describe the problem

Login to netbird dashboard with Authentik.
Successfully login but got 502 error.
The dashboard try to get user at netbird.mydomain.com/api/users

Image

And netbird mangament logs have this:

WARN [context: SYSTEM] management/server/account.go:246: failed warming up cache due to error: 403 Forbidden

I'm using Caddy as reverse proxy.

Caddyfile

*.<mydomain> { 
 @netbird host netbird.<mydomain>
    tls {
	dns duckdns {env.DUCKDNS_API_TOKEN}
        propagation_delay 2m
        resolvers 1.1.1.1
    }

    handle @netbird {
        reverse_proxy /* netbird-dashboard
        reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal
        reverse_proxy /api/* netbird-management
        reverse_proxy /management.ManagementService/* h2c://netbird-management
	}
}

docker-compose.yaml

x-default: &default
  restart: "unless-stopped"
  networks:
    - caddy-network
  logging:
    driver: "json-file"
    options:
      max-size: "500m"
      max-file: "2"

services:
  # UI dashboard
  dashboard:
    <<: *default
    image: netbirdio/dashboard:latest
    container_name: netbird-dashboard
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.<mydomain>:443
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.<mydomain>:443
      # OIDC
      - AUTH_AUDIENCE=<auth_client_key>
      - AUTH_CLIENT_ID=<auth_client_key>
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://auth.<mydomain>/application/o/netbird/
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/

  # Signal
  signal:
    <<: *default
    image: netbirdio/signal:latest
    container_name: netbird-signal
    volumes:
      - netbird-signal:/var/lib/netbird

  # Relay
  relay:
    <<: *default
    image: netbirdio/relay:latest
    container_name: netbird-relay
    environment:
      - NB_LOG_LEVEL=info
      - NB_LISTEN_ADDRESS=:33080
      - NB_EXPOSED_ADDRESS=rels://netbird.<mydomain>:33080/relay
      # todo: change to a secure secret
      - NB_AUTH_SECRET=<auth_key>

  # Management
  management:
    <<: *default
    image: netbirdio/management:latest
    container_name: netbird-management
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    command:
      [
        "--port",
        "443",
        "--log-file",
        "console",
        "--log-level",
        "info",
        "--disable-anonymous-metrics=false",
        "--single-account-mode-domain=netbird.<mydomain>",
        "--dns-domain=<mydomain>,
        "--disable-single-account-mode=true",
      ]
    environment:
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      - NETBIRD_STORE_ENGINE_MYSQL_DSN=

  # Coturn
  coturn:
    restart: "unless-stopped"
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    image: coturn/coturn:latest
    container_name: netbird-coturn
    domainname: netbird.<mydomain> # only needed when TLS is enabled
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:

networks:
  caddy-network:
    external: true
Originally created by @holy5 on GitHub (Jul 31, 2025). **Describe the problem** Login to netbird dashboard with Authentik. Successfully login but got 502 error. The dashboard try to get user at `netbird.mydomain.com/api/users` <img width="551" height="53" alt="Image" src="https://github.com/user-attachments/assets/1af4274f-efe1-4026-8d0e-b661b13be13a" /> And netbird mangament logs have this: `WARN [context: SYSTEM] management/server/account.go:246: failed warming up cache due to error: 403 Forbidden` I'm using Caddy as reverse proxy. ### Caddyfile ``` *.<mydomain> { @netbird host netbird.<mydomain> tls { dns duckdns {env.DUCKDNS_API_TOKEN} propagation_delay 2m resolvers 1.1.1.1 } handle @netbird { reverse_proxy /* netbird-dashboard reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal reverse_proxy /api/* netbird-management reverse_proxy /management.ManagementService/* h2c://netbird-management } } ``` ### docker-compose.yaml ```yaml x-default: &default restart: "unless-stopped" networks: - caddy-network logging: driver: "json-file" options: max-size: "500m" max-file: "2" services: # UI dashboard dashboard: <<: *default image: netbirdio/dashboard:latest container_name: netbird-dashboard environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.<mydomain>:443 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.<mydomain>:443 # OIDC - AUTH_AUDIENCE=<auth_client_key> - AUTH_CLIENT_ID=<auth_client_key> - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://auth.<mydomain>/application/o/netbird/ - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN= - LETSENCRYPT_EMAIL= volumes: - netbird-letsencrypt:/etc/letsencrypt/ # Signal signal: <<: *default image: netbirdio/signal:latest container_name: netbird-signal volumes: - netbird-signal:/var/lib/netbird # Relay relay: <<: *default image: netbirdio/relay:latest container_name: netbird-relay environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=rels://netbird.<mydomain>:33080/relay # todo: change to a secure secret - NB_AUTH_SECRET=<auth_key> # Management management: <<: *default image: netbirdio/management:latest container_name: netbird-management depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.<mydomain>", "--dns-domain=<mydomain>, "--disable-single-account-mode=true", ] environment: - NETBIRD_STORE_ENGINE_POSTGRES_DSN= - NETBIRD_STORE_ENGINE_MYSQL_DSN= # Coturn coturn: restart: "unless-stopped" logging: driver: "json-file" options: max-size: "500m" max-file: "2" image: coturn/coturn:latest container_name: netbird-coturn domainname: netbird.<mydomain> # only needed when TLS is enabled volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: networks: caddy-network: external: true ```
saavagebueno added the triage-needed label 2025-11-20 07:04:40 -05:00
saavagebueno commented 2025-11-20 07:04:41 -05:00
Author
Owner
Copy Link

@holy5 commented on GitHub (Aug 2, 2025):

Nvm, fixed by adding port 443 to reverse proxy:

*.<mydomain> { 
 @netbird host netbird.<mydomain>
    tls {
	dns duckdns {env.DUCKDNS_API_TOKEN}
        propagation_delay 2m
        resolvers 1.1.1.1
    }

    handle @netbird {
        reverse_proxy /* netbird-dashboard
        reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal
        reverse_proxy /api/* netbird-management:443
        reverse_proxy /management.ManagementService/* h2c://netbird-management
	}
}
@holy5 commented on GitHub (Aug 2, 2025): Nvm, fixed by adding port 443 to reverse proxy: ``` *.<mydomain> { @netbird host netbird.<mydomain> tls { dns duckdns {env.DUCKDNS_API_TOKEN} propagation_delay 2m resolvers 1.1.1.1 } handle @netbird { reverse_proxy /* netbird-dashboard reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal reverse_proxy /api/* netbird-management:443 reverse_proxy /management.ManagementService/* h2c://netbird-management } } ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2141
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?