SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 17:31:53 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Netbird behind haproxy #296

New Issue
Closed
opened 2025-11-20 05:09:16 -05:00 by saavagebueno · 6 comments
saavagebueno commented 2025-11-20 05:09:16 -05:00
Owner
Copy Link

Originally created by @ashish1099 on GitHub (Mar 20, 2023).

here is my compose file

version: "3"
services:
  #UI dashboard
  dashboard:
    image: wiretrustee/dashboard:latest
    restart: unless-stopped
    ports:
      - 127.0.0.1:8089:80
    environment:
      - AUTH_AUDIENCE=netbird
      - AUTH_CLIENT_ID=netbird
      - AUTH_AUTHORITY=https://keycloak.example.com/auth/realms/example
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access netbird_api
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:33073
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:33073
    volumes:
      - /vol0/data/netbird/signal:/var/lib/netbird
  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - /vol0/data/netbird/signal:/var/lib/netbird
    ports:
      - 127.0.0.1:10000:80
  # Management
  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - /vol0/data/netbird/mgmt/data/:/var/lib/netbird/
      - /vol0/data/netbird/mgmt/conf/:/etc/netbird/
    ports:
      - 127.0.0.1:33073:33073 #API port
      - 127.0.0.1:33080:443 #API port
    command: ["--port", "443", "--log-file", "console", "--disable-anonymous-metrics=true", "--single-account-mode-domain=netbird.obmondo.com", "--dns-domain=netbird.selfhosted"]
  # Coturn
  coturn:
    image: coturn/coturn
    restart: unless-stopped
    domainname: netbird.example.com
    volumes:
      - /vol0/data/netbird/coturn:/etc/turnserver.conf:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

here is my haproxy config snippet

frontend netbird 
  bind 0.0.0.0:33073 ssl crt /etc/ssl/private/letsencrypt proto h2
  mode http
  option http-use-htx
  default_backend netbird_mgmt_api

backend netbird_mgmt_ui_api
  mode http
  server netbird_mgmt_api_0 127.0.0.1:33080 check

backend netbird_mgmt
  mode http
  server netbird_mgmt_0 127.0.0.1:8089 check

backend netbird_mgmt_api
  mode http
  server netbird_mgmt_api_0 127.0.0.1:33080 ssl  verify none proto h2

I can get the UI working perfectly fine, its when, when I try to fire up the agent it just fails, I have tried whatever I can think off.

netbird up --management-url https://netbird.example.com:33073
2023-03-20T18:53:41+05:30 WARN client/cmd/root.go:185: retrying Login to the Management service in 1.104660288s due to error rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html"
2023-03-20T18:53:49+05:30 WARN client/cmd/root.go:185: retrying Login to the Management service in 2.160763633s due to error rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html"
2023-03-20T18:53:58+05:30 WARN client/cmd/root.go:185: retrying Login to the Management service in 2.62026012s due to error rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html"
Error: login backoff cycle failed: rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html"
Originally created by @ashish1099 on GitHub (Mar 20, 2023). here is my compose file ``` version: "3" services: #UI dashboard dashboard: image: wiretrustee/dashboard:latest restart: unless-stopped ports: - 127.0.0.1:8089:80 environment: - AUTH_AUDIENCE=netbird - AUTH_CLIENT_ID=netbird - AUTH_AUTHORITY=https://keycloak.example.com/auth/realms/example - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access netbird_api - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:33073 volumes: - /vol0/data/netbird/signal:/var/lib/netbird # Signal signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - /vol0/data/netbird/signal:/var/lib/netbird ports: - 127.0.0.1:10000:80 # Management management: image: netbirdio/management:latest restart: unless-stopped depends_on: - dashboard volumes: - /vol0/data/netbird/mgmt/data/:/var/lib/netbird/ - /vol0/data/netbird/mgmt/conf/:/etc/netbird/ ports: - 127.0.0.1:33073:33073 #API port - 127.0.0.1:33080:443 #API port command: ["--port", "443", "--log-file", "console", "--disable-anonymous-metrics=true", "--single-account-mode-domain=netbird.obmondo.com", "--dns-domain=netbird.selfhosted"] # Coturn coturn: image: coturn/coturn restart: unless-stopped domainname: netbird.example.com volumes: - /vol0/data/netbird/coturn:/etc/turnserver.conf:ro network_mode: host command: - -c /etc/turnserver.conf ``` here is my haproxy config snippet ``` frontend netbird bind 0.0.0.0:33073 ssl crt /etc/ssl/private/letsencrypt proto h2 mode http option http-use-htx default_backend netbird_mgmt_api backend netbird_mgmt_ui_api mode http server netbird_mgmt_api_0 127.0.0.1:33080 check backend netbird_mgmt mode http server netbird_mgmt_0 127.0.0.1:8089 check backend netbird_mgmt_api mode http server netbird_mgmt_api_0 127.0.0.1:33080 ssl verify none proto h2 ``` I can get the UI working perfectly fine, its when, when I try to fire up the agent it just fails, I have tried whatever I can think off. ``` netbird up --management-url https://netbird.example.com:33073 2023-03-20T18:53:41+05:30 WARN client/cmd/root.go:185: retrying Login to the Management service in 1.104660288s due to error rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html" 2023-03-20T18:53:49+05:30 WARN client/cmd/root.go:185: retrying Login to the Management service in 2.160763633s due to error rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html" 2023-03-20T18:53:58+05:30 WARN client/cmd/root.go:185: retrying Login to the Management service in 2.62026012s due to error rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html" Error: login backoff cycle failed: rpc error: code = Unavailable desc = unexpected HTTP status code received from server: 503 (Service Unavailable); transport: received unexpected content-type "text/html" ```
saavagebueno commented 2025-11-20 05:09:17 -05:00
Author
Owner
Copy Link

@ashish1099 commented on GitHub (Mar 25, 2023):

ok, I got this working, it was haprpoxy issue, when connecting to backend with h2c

@ashish1099 commented on GitHub (Mar 25, 2023): ok, I got this working, it was haprpoxy issue, when connecting to backend with h2c
saavagebueno commented 2025-11-20 05:09:17 -05:00
Author
Owner
Copy Link

@guergabo commented on GitHub (Jun 5, 2023):

what was the issue @ashish1099 ? How did you fix it. Experiencing similar.

@guergabo commented on GitHub (Jun 5, 2023): what was the issue @ashish1099 ? How did you fix it. Experiencing similar.
saavagebueno commented 2025-11-20 05:09:17 -05:00
Author
Owner
Copy Link

@ashish1099 commented on GitHub (Jul 29, 2023):

@guergabo the issue was I had not setup the grpc on haproxy, let me know if you need more details

@ashish1099 commented on GitHub (Jul 29, 2023): @guergabo the issue was I had not setup the grpc on haproxy, let me know if you need more details
saavagebueno commented 2025-11-20 05:09:17 -05:00
Author
Owner
Copy Link

@vasquezmi commented on GitHub (Apr 8, 2024):

@ashish1099 - I am looking into this process as well for HAProxy. What did you have to do for gRPC to work?

@vasquezmi commented on GitHub (Apr 8, 2024): @ashish1099 - I am looking into this process as well for HAProxy. What did you have to do for gRPC to work?
saavagebueno commented 2025-11-20 05:09:17 -05:00
Author
Owner
Copy Link

@ashish1099 commented on GitHub (Apr 8, 2024):

@vasquezmi just enable the h2c for frontend and backend

frontend www
  bind 0.0.0.0:443 ssl crt /some/path alpn h2,http/1.1
  acl is_netbird_mgmt_api path_beg -i /api
  acl is_netbird_mgmt_grpc path_beg -i /management
  acl is_netbird_signal_grpc path_beg -i /signalexchange
  acl is_netbird_dashboard hdr(host) netbird.x.com
  use_backend netbird_signal_grpc if is_netbird_signal_grpc
  use_backend netbird_mgmt_api if is_netbird_dashboard is_netbird_mgmt_api
  use_backend netbird_mgmt_grpc if is_netbird_mgmt_grpc
  use_backend netbird_dashboard if is_netbird_dashboard

backend netbird_dashboard
  mode http
  server netbird_dashboard_0 127.0.0.1:8089 check

backend netbird_mgmt_api
  mode http
  server netbird_mgmt_api_0 127.0.0.1:33080 check

backend netbird_mgmt_grpc
  mode http
  server netbird_mgmt_api_0 127.0.0.1:33080 proto h2

backend netbird_signal_grpc
  mode http
  server netbird_signal_0 127.0.0.1:10000 check proto h2
@ashish1099 commented on GitHub (Apr 8, 2024): @vasquezmi just enable the h2c for frontend and backend ``` frontend www bind 0.0.0.0:443 ssl crt /some/path alpn h2,http/1.1 acl is_netbird_mgmt_api path_beg -i /api acl is_netbird_mgmt_grpc path_beg -i /management acl is_netbird_signal_grpc path_beg -i /signalexchange acl is_netbird_dashboard hdr(host) netbird.x.com use_backend netbird_signal_grpc if is_netbird_signal_grpc use_backend netbird_mgmt_api if is_netbird_dashboard is_netbird_mgmt_api use_backend netbird_mgmt_grpc if is_netbird_mgmt_grpc use_backend netbird_dashboard if is_netbird_dashboard backend netbird_dashboard mode http server netbird_dashboard_0 127.0.0.1:8089 check backend netbird_mgmt_api mode http server netbird_mgmt_api_0 127.0.0.1:33080 check backend netbird_mgmt_grpc mode http server netbird_mgmt_api_0 127.0.0.1:33080 proto h2 backend netbird_signal_grpc mode http server netbird_signal_0 127.0.0.1:10000 check proto h2 ```
saavagebueno commented 2025-11-20 05:09:17 -05:00
Author
Owner
Copy Link

@vasquezmi commented on GitHub (May 5, 2024):

@ashish1099 thank you for sharing your HAProxy config for these.
I am still working this out as my current setup has HAProxy as a pkg in a firewall and I am double NAT's (i know why)....still working to change that.

For some reason my config does not match yours even though I put in the same areas.

For example, path_beg comes up as -m beg (weird).

`frontend vnetBird
bind :6443 name :6443 ssl crt-list /var/etc/haproxy/vnetBird.crt_list alpn h2,http/1.1
mode http
log global
option socket-stats
option http-keep-alive
option forwardfor
acl https ssl_fc
http-request set-header X-Forwarded-Proto http if !https
http-request set-header X-Forwarded-Proto https if https
timeout client 30000
acl is_netbird_mgmt_api var(txn.txnpath) -m str -i /api
acl is_netbird_mgmt_grpc var(txn.txnpath) -m beg -i /management
acl is_netbird_signal_grpc var(txn.txnpath) -m beg -i /signalexchange
acl is_netbird_dashboard var(txn.txnhost) -m sub -i sub.mydomain.net
acl aclcrt_vnetBird var(txn.txnhost) -m reg -i ^([^.]*).mydomain.net(:([0-9]){1,5})?$
acl aclcrt_vnetBird var(txn.txnhost) -m reg -i ^mydomain.net(:([0-9]){1,5})?$
http-request set-var(txn.txnpath) path
http-request set-var(txn.txnhost) hdr(host)
use_backend netbird_mgmt_api_prd_ipvANY if is_netbird_mgmt_api aclcrt_vnetBird
use_backend netbird_mgmt_grpc_prd_ipvANY if is_netbird_mgmt_grpc aclcrt_vnetBird
use_backend netbird_signal_grpc_prd_ipvANY if is_netbird_signal_grpc aclcrt_vnetBird
use_backend netbird_dashboard_prd_ipvANY if is_netbird_dashboard aclcrt_vnetBird

backend netbird_mgmt_api_prd_ipvANY
mode http
server netbird_mgmt_api_prd 192.168.1.84:33073 check

backend netbird_mgmt_grpc_prd_ipvANY
mode http
server netbird_mgmt_grpc_prd 192.168.1.84:6443 check proto h2

backend netbird_signal_grpc_prd_ipvANY
mode http
server netbird_signal_grpc_prd 192.168.1.84:10000 check proto h2

backend netbird_dashboard_prd_ipvANY
mode http
server netbird_dashboard_prd 192.168.1.84:8089 check`

@vasquezmi commented on GitHub (May 5, 2024): @ashish1099 thank you for sharing your HAProxy config for these. I am still working this out as my current setup has HAProxy as a pkg in a firewall and I am double NAT's (i know why)....still working to change that. For some reason my config does not match yours even though I put in the same areas. For example, path_beg comes up as -m beg (weird). `frontend vnetBird bind <proxy listener>:6443 name <proxy listener>:6443 ssl crt-list /var/etc/haproxy/vnetBird.crt_list alpn h2,http/1.1 mode http log global option socket-stats option http-keep-alive option forwardfor acl https ssl_fc http-request set-header X-Forwarded-Proto http if !https http-request set-header X-Forwarded-Proto https if https timeout client 30000 acl is_netbird_mgmt_api var(txn.txnpath) -m str -i /api acl is_netbird_mgmt_grpc var(txn.txnpath) -m beg -i /management acl is_netbird_signal_grpc var(txn.txnpath) -m beg -i /signalexchange acl is_netbird_dashboard var(txn.txnhost) -m sub -i sub.mydomain.net acl aclcrt_vnetBird var(txn.txnhost) -m reg -i ^([^\.]*)\.mydomain\.net(:([0-9]){1,5})?$ acl aclcrt_vnetBird var(txn.txnhost) -m reg -i ^mydomain\.net(:([0-9]){1,5})?$ http-request set-var(txn.txnpath) path http-request set-var(txn.txnhost) hdr(host) use_backend netbird_mgmt_api_prd_ipvANY if is_netbird_mgmt_api aclcrt_vnetBird use_backend netbird_mgmt_grpc_prd_ipvANY if is_netbird_mgmt_grpc aclcrt_vnetBird use_backend netbird_signal_grpc_prd_ipvANY if is_netbird_signal_grpc aclcrt_vnetBird use_backend netbird_dashboard_prd_ipvANY if is_netbird_dashboard aclcrt_vnetBird backend netbird_mgmt_api_prd_ipvANY mode http server netbird_mgmt_api_prd 192.168.1.84:33073 check backend netbird_mgmt_grpc_prd_ipvANY mode http server netbird_mgmt_grpc_prd 192.168.1.84:6443 check proto h2 backend netbird_signal_grpc_prd_ipvANY mode http server netbird_signal_grpc_prd 192.168.1.84:10000 check proto h2 backend netbird_dashboard_prd_ipvANY mode http server netbird_dashboard_prd 192.168.1.84:8089 check`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#296
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?