mirror of
https://github.com/netbirdio/netbird.git
synced 2026-05-16 21:22:12 -04:00
can't use the standard ports 80 and 443 on my network #493
Closed
opened 2025-11-20 05:12:18 -05:00 by saavagebueno
·
80 comments
No Branch/Tag Specified
main
embedded-vnc
readme-cleanup
client/capture-dns-forwarder-port
fix-ssh-authorized-users-multi-rule
fix/wireguard-port-zero
windows-dns-firewall
ui-refactor
fix/wgport-config
feature/refactor-clusters
fix/rosenpass
drop-candidateviaroutes-filter
e2e-windows-dns-combined
refactor-combined
wasm-websocket-dial
feature/affected-peers
dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1
debug-logs
reduce-embed-wg-pool
dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2
fix/login-cmd-root-flags
feat/reseller-openapi-spec
github-issue-resolver
add-steamos-support
fix-darwin-uninstaller
flutter-test
dependabot/npm_and_yarn/proxy/web/postcss-8.5.12
ci/freebsd-pkg-bootstrap
cached-serial-check-on-sync
fix-mgmt-cache-bypass-overlay
revert-easyjson-5938
revert-ice-5820
revert-firewalld-5928
refactor/permissions-manager
wasm-js-func-release
revert-dns-5935-systemd-resolved
revert-dns-5935-5945
revert-dns-5945-mgmt-cache
feature/log-most-busy-peers
prototype/ui-wails
coderabbitai/utg/8ae8f20
feature/use-peer-fqdn-on-https
dependabot/go_modules/golang.org/x/image-0.38.0
feature/metrics-push-management-control
release/0.68.3
dependabot/go_modules/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream-1.7.8
dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.97.3
add-slack-channel
claude/rdp-token-passthrough-eNcqW
transparent-proxy
fix/macos-stale-route-eexist
crowdsec-selfhosted
fix/remove-otel-units
entire/checkpoints/v1
dependabot/go_modules/github.com/go-jose/go-jose/v4-4.1.4
fix/getting-started
feat/static-connectors-combined-server
feature/use-local-keys-embedded
feature/fleetdm
set-env-only-if-not-fork
feature/expose-has-channel
fix/connection-status-race
fix/filter-cgnat-cni-ice-candidates
feature/check-cert-locker-before-acme
test/proxy-fixes
test/proxy-mtu
prototype/ui-tauri
test/proxy-speed
fix-reused-ports
feat/migrate-to-embedded-idp
feature/add-serial-to-proxy-merged
deploy/proxy-serial
test/connection
feature/disable-legacy-port
feature/flag-to-disable-legacy-port
test/perftest
dependabot/go_modules/github.com/pion/dtls/v3-3.0.11
fix/http-redirect
poc-token-command
dn-reverse-proxy
prototype/reverse-proxy-rename
prototype/reverse-proxy-logs-pagination
feature/client-metrics
prototype/reverse-proxy-clusters
debug-dns-route
fix/win-dns-batch
add-extra-route-logs
job-stream-notify-disconnection-eof
deploy/secrets-manager
trigger-proxy-update
bug/update-ios-client-code-build-tags
sync-client-netmap-serial
log/conn-disconn
nmap/compaction-deploy
ci-win-test
feature/disk-encryption-check
wasm-debug
swap-dns-prio
fix/dex-config
feature/migrate-auto-groups-to-table
dependabot/go_modules/github.com/quic-go/quic-go-0.57.0
nmap/compaction
dex-nocgo-stub
feature/exclude-terraform-from-rate-limiting
test-freebsd
retries-refactor
coderabbitai/docstrings/b7e98ac
feat/integrate-zitadel
bug/ios-hanging-reconection
zitadel-idp
feat/network-map-serial
refactor/get-account-no-users
feat/auto-upgrade
feature/report-high-pat-id
feature/temporary-access-for-resource
fix/nmap-fwrules
dont-restart-dns
prototype/ui
update-gomobile
go-dns-for-ice
wasm-ldflags
test-ldflags
wasmbuild-test
feature/networks-s2s
vk/compare-nmaps
dbg/bothmaps
feature/changeset
reorder-dns-shutdown
fix/relay-reconnection-race
fix/nmap-exitnodes
vk/debug/nmap-both
move-licensed-code
feat/better-daemon-connection-lost-message
feat/auto-update-2
test/timings
refactor/getaccount-raw
tests/nmap-getaccount
refactor/nmap
refactor/nmap-limit-buffer
feature/detect-mac-wakeup
feature/extract-modules
quick-setings
feat/sync-limiter
feature/store-cache-impl
fix-install-version
feature/store-metrics
feature/metrics-on-store
feature/use-gorm-cache
loadtest-signal
unsymmetrical-squash
refactor/reducate-signaling
test/update-reduce
feature/store-cache
feature/remote-debug
cli-ws-proxy-backend-addr
feat/mgmt-map-serial
snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2
snyk-fix-7415cea5a11acd66753540ca2c598c63
job-yml-update
feature/android-allow-selecting-routes
fix/up-sequence
fix/dns-hash-update
snyk-fix-967adae9863f17f108ce8948d9117b8d
log/getaccount-by-peer
signal-suppressor
dns-exit-node
feature/auto-updates
feature/cache-srv-key
merged-fixes
fix/missed-offers-and-debug
debug-and-fixes
poc-wasm-clean-backend-s2s
test/remote-debug
debug-api
dependabot/go_modules/github.com/docker/docker-28.0.0incompatible
fix/remove-gpo-if-empty
fix/test-freebsd
fix/mysql-setup
fix/remove-logout-btn
handle-existing-domain-user
chore/unify-domain-validation
snyk-fix-c5fafc8a50ce1f29046e25a1fc346185
feat/profile-edit-btn
snyk-fix-a54966211e18d4cf67e5a2757cc006d1
log-short-id
feat/logout-ephemeral
log-checks
batch-wg-ops
nb-interface-default
feat/aws-integration
add/race-test
feature/relay-feature-versioning
fix/systemd-service-logs
poc/preprocessed-map
add-account-onboarding
bind-ipv6
fix/merge-main
logs/peerlogs-addpeer
feature/net-297-network-migration
feature/support-skip-auto-apply-exit-node-routes
set-cmd
set-command-with-cursor
feature/limit-update-channel
stop-using-locking-share
feature/poc-lazy-detection
feature/net-248-removal-of-sync-mutex-locks
test/multiple-peer-logging
preresolve
add-ns-punnycode-support
apply-routes-early
windows-search-domains
fix/connecting-route-filter
feature/management/rest-client/impersonate
debug-local-records
resource-fields-snake-case
test/grpc-rate-limit
traffic-correlation-policy
feature/rest-client-options
feat/events-metrics
feature/buf-cli
test/add-ratelimiter
test/remove-write-lock-on-add-peer
fix/add-peer-semaphore
feature/users-roles-endpoint
mlsmaycon-patch-1
debug-user-role
chore/primary-key-on-networks
feature/update-account-peers-buffer-startup
remove-ubuntu2004-runners
refactor/permissions-no-pat-allowed
ref/logrus-factory
use-conntrack-zone
deploy/permissions-account
feature/lazy-connection-idle
ref/improve-test-cov
restore-pr-3440
test/increase-grpc-timeouts
feat/buffer-account-peers-update
test/networkmapgeneration-changes
feature/base-manager
feature/flow-receiver
chore/benchmark-with-large-runner
refactor/handshake-initiator
client/ui-update-systray-icons
userspace-router
wgwatcher-test
output-if-key-already-exists
fix/relay-reconnection
feature/port-forwarding-client-codecleaning
detached2
test/callbacks-nil-iceconninfo
refactor/optimize-peer-expiration
enable-udp-port-for-docker-template
fix/relay-update
feature/apply-posture-netmap
fix/group-update-existing-resource
conntrack-stats
upgrade-okta-sdk
multi-price
test/conn-stat
set-min-parallel-tests-for-management
dns-interceptor
debug-dns
router-dns
add-static-system-info
debug-0.29.4
debug-0.33.0
account-refactoring
relay/2800_quic
route-get-account-refactoring
test/seed-random-routes
feature/get-account-refactoring
test/reconnect-race-condition
refactor/get-account-usage
feature/add-session-id-to-update-channel
improve-ipv4conn
fix/async-pion-event-handling
debug
add-offload
feature/validate-group-association-debug
fix/limit-conn-for-sqlite
test/engine-iface
test/transaction-for-jwt-sync
fix/engine-stop-in-foreground
feature/add-mysql-support
test-migration
refactor/header-size-values
relay/eliminate-gob
test/signal-dispatcher-with-relay
relay/debug
validate-icon
feature/ipv6-support
use-pre-expanded-peers-map
feature/use-signal-dispatcher
validate/peer-status
add-read-write-times
fix/sync-peer-race
feature/relay-status
netmap
evaluate/network-map-hash
fix/lower-dns-resolve-interval-on-fail
feature/relay
fix/go-mod-version
upgrade-nftables
synology-userspace-mode
fix/use-ip-for-default-routes-on-darwin
fix/proxy_close
enable-release-workflow-on-pr
deploy/peer-performance
feature/permanent-turn
feature/permanent-turn-proxy
deploy/posture-check-sqlite
feature/optimize_sqlite_save
debug-ios-behavior
fix/delete-route-only-after-adding
tshoot/windows-logger
remove-new-routing
refactor/eliminate-repo-dependency
add-arm-to-ci
refactor-demo-account-object
test/abc2
test/abc
send-ssh-rosenpass-config-meta
refactor-demo
ensure-schedule-never-runs-non-positive
feature/peer-validator-groupmgm
feature/peer-validator-fix
fix/include-active-dashboard-users
fix/handle-canceling-schedule
fix/geo-download
debug-google-workspace
yury/resolve-ip-to-location
feature/extend-sysinfo
sqlite-async-peer-status
yury/add-postgresql-store
fix/route
test-build
posture-checks-poc
debug-keycloak-idp
poc/netstack
for-pascal-tmp
peer-logout-management
manual-peer-logout
detached
chore/refactor-management
test/dns-bind
fix/enforce-acl-for-containers
yury/use-sync-map-in-updatechannel
fix/events-key-handling
filter-cache-on-load-account
fix/user-expiration
handle-user-context-cancellation
nb-client-k8s-statefulset
fake-addr
fix/iptables_in_docker
ebpf-debug
update-getting-started-flow-use-postgres
fix/peer_list_notification
feature/device-authentication-with-client-secret
feature/keep_alive
feat-groups-from-jwt
separate_proxy_from_wgconfig
fix/wg_conn
wg_conn_fix
wg_bind_parallel_processing
fix-rollback-get-acls
proxy_cfg_cleanup
performance-improvement-rego
update-lock-log-level
feat-client-side-acl
refactor/move_grpcserver_logic_to_account_manager
feature/event-storage
feature/update-idp-redeeming-invite
feature/api-peer-info
return-groupminimum-setupkey
feature/interface-bind
documentation_enhancement
fix-peer-registration
ssh
users_cache
pass-client-caller
client_caller_type
revert-283-feat-fix-windows-installer
periodic-peer-updates
ebpf
braginini/wasm
v0.71.2
v0.71.1
v0.71.0
v0.70.5
v0.70.4
v0.70.3
v0.70.2
v0.70.1
v0.70.0
v0.69.0
v0.68.3
v0.68.2
v0.68.1
v0.68.0
v0.67.4
v0.67.3
v0.67.2
v0.67.1
v0.67.0
v0.66.4
v0.66.3
v0.66.2
v0.66.1
v0.66.0
v0.65.3
v0.65.2
v0.65.1
v0.65.0
v0.64.6
v0.64.5
v0.64.4
v0.64.3
v0.64.2
v0.64.1
v0.64.0
v0.63.0
v0.62.3
v0.62.2
v0.62.1
v0.62.0
v0.61.2
v0.61.1
v0.61.0
v0.60.9
v0.60.8
v0.60.7
v0.60.6
v0.60.5
v0.60.4
v0.60.3
v0.60.2
v0.60.1
v0.60.0
v0.59.13
v0.59.12
v0.59.11
v0.59.10
v0.59.9
v0.59.8
v0.59.7
v0.59.6
v0.59.5
v0.59.4
v0.59.3
v0.59.2
v0.59.1
v0.59.0
v0.58.2
v0.58.1
v0.58.0
v0.57.1
v0.57.0
v0.56.1
v0.56.0
v0.55.1
v0.55.0
v0.54.2
v0.54.1
v0.54.0
v0.53.0
v0.52.2
v0.52.1
v0.52.0
v0.51.2
v0.51.1
v0.51.0
v0.50.3
v0.50.2
v0.50.1
v0.50.0
v0.49.0
v0.48.0-dev2
v0.48.0
v0.47.2
v0.47.1
v0.47.0
v0.46.0
v0.45.3
v0.45.2
v0.45.1
v0.45.0
v0.44.0
v0.43.3
v0.43.2
v0.43.1
v0.43.0
v0.42.0
v0.41.3
v0.41.2
v0.41.1
v0.41.0
v0.40.1
v0.40.0
v0.39.2
v0.39.1
v0.39.0
v0.38.2
v0.38.1
v0.38.0
v0.37.2
v0.37.1
v0.37.0
v0.36.7
v0.36.6
v0.36.5
v0.36.4
v0.36.3
v0.36.2
v0.36.1
v0.36.0
v0.35.2
v0.35.1
v0.35.0
v0.34.1
v0.34.0
v0.33.0
v0.32.0
v0.31.1
v0.31.0
v0.30.3
v0.30.2
v0.30.1
v0.30.0
v0.29.4
v0.29.3
0.29.3
v0.29.2
v0.29.1
v0.29.0
v0.28.9
v0.28.8
v0.28.7
v0.28.6
v0.28.5
v0.28.4
v0.28.3
v0.28.2
v0.28.1
v0.28.0
v0.27.10
v0.27.9
v0.27.8
v0.27.7
v0.27.6
v0.27.5
v0.27.4
v0.27.3
v0.27.2
v0.27.1
v0.27.0
v0.26.7
v0.26.6
v0.26.5
v0.26.4
v0.26.3
v0.26.2
v0.26.1
v0.26.0
v0.25.9
v0.25.8
v0.25.7
v0.25.6
v0.25.5
v0.25.4
v0.25.3
v0.25.2
v0.25.1
v0.25.0
v0.24.4
v0.24.3
v0.24.2
v0.24.1
v0.24.0
v0.23.9
v0.23.8
v0.23.7
v0.23.6
v0.23.5
v0.23.4
v0.23.3
v0.23.2
v0.23.1
v0.23.0
v0.22.7
v0.22.6
v0.22.5
v0.22.4
v0.22.3
v0.22.2
v0.22.1
v0.22.0
v0.21.11
v0.21.10
v0.21.9
v0.21.8
v0.21.7
v0.21.6
v0.21.5
v0.21.4
v0.21.3
v0.21.2
v0.21.1
v0.21.0
v0.20.8
v0.20.7
v0.20.6
v0.20.5
v0.20.4
v0.20.3
v0.20.2
v0.20.1
v0.20.0
v0.19.0
v0.18.1
v0.18.0
v0.17.0
v0.16.0
v0.15.3
v0.15.2
v0.15.1
v0.15.0
v0.14.6
v0.14.5
v0.14.4
v0.14.3
v0.14.2
v0.14.1
v0.14.0
v0.13.0
v0.12.0
v0.11.6
v0.11.5
v0.11.4
v0.11.3
v0.11.2
v0.11.1
v0.11.0
v0.10.10
v0.10.9
v0.10.8
v0.10.7
v0.10.6
v0.10.5
v0.10.4
v0.10.3
v0.10.2
v0.10.1
v0.10.0
v0.9.8
v0.9.7
v0.9.6
v0.9.5
v0.9.4
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.12
v0.8.11
v0.8.10
v0.8.9
v0.8.8
v0.8.7
v0.8.6
v0.8.5
v0.8.4
v0.8.3
v0.8.2
v0.8.1
v0.8.0
v0.7.1
v0.7.0
v0.6.4
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.11
v0.5.10
v0.5.1
v0.5.0
v0.4.0
v0.3.5
v0.3.4
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.3
v0.2.2-beta.1
v0.2.1-beta.5
v0.2.0-beta.5
v0.2.0-beta.4
v0.2.0-beta.3
v0.2.0-beta.2
v0.2.0-beta.1
v0.1.0-beta.3
v0.1.0-beta.2
v0.1.0-beta.1
v0.1.0-rc.2
v0.1.0-rc-1
v0.0.8-hotfix-1
v0.0.8
v0.0.7
v0.0.6
v0.0.5
v0.0.4
v0.0.3
v0.0.2
v0.0.1
v0.0.0
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
saavagebueno
Clear assignees
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: SVI/netbird#493
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @xcstatus on GitHub (Oct 30, 2023).
hi all,
I can't use the standard ports 80 and 443 on my network. How do I change the configuration for deployment? Since standard ports are not available, the reverse proxy cannot be deployed either.
@mlsmaycon commented on GitHub (Oct 30, 2023):
Hey @xcstatus are you able to deploy the reverse proxy without the public access in these two ports? If so, there is a way to deploy it, but you will need to manage the SSL certificates.
@xcstatus commented on GitHub (Oct 30, 2023):
Thank you for your reply.
All but the standard ports on my network are accessible via the Internet. SSL certificates can also be obtained in other ways.
Please tell me how I should operate.
@MrChenhtlss commented on GitHub (Nov 11, 2023):
I have the same problem. Did you solve it? If so, can you help me?
@xcstatus commented on GitHub (Nov 13, 2023):
Not solved yet, no way to deal with this problem, can only wait for the solution given by the @mlsmaycon
@MrChenhtlss commented on GitHub (Nov 13, 2023):
xcstatus @.***>于2023年11月13日 周一13:00写道:
If you have a solution please let me know thank you very much
@mlsmaycon commented on GitHub (Nov 14, 2023):
Hello folks, we have a guide for running NetBird that you can use to configure NetBird to run behind a reverse-proxy like Nginx, Traefik or Caddyserver. See this link for more details. It covers the advanced guide setup, then you need to configure your reverse proxy.
For traefik and nginx you have some example templates:
Nginx.conf
docker-compose.yml.tmpl.traefik
For Caddyserver you can use the following example:
You need to replace the references to the internal services according to your local environment. e.g., if your management is running on IP 192.168.0.100, replace h2c://management:80 with h2c://192.168.0.100:80
@MrChenhtlss commented on GitHub (Nov 14, 2023):
Besides the docker-compose file, what else do I need to modify?
Maycon Santos @.***>于2023年11月14日 周二16:34写道:
@mlsmaycon commented on GitHub (Nov 14, 2023):
It depends on the scenario you are building. Can you share more about it @MrChenhtlss?
@MrChenhtlss commented on GitHub (Nov 14, 2023):
Sorry I'm not a professional IT worker
Maycon Santos @.***>于2023年11月14日 周二16:43写道:
@MrChenhtlss commented on GitHub (Nov 14, 2023):
Or I would just use express install. Doc provides an advanced installation
method, but I can't understand it.
T oy @.***>于2023年11月14日 周二16:49写道:
@mlsmaycon commented on GitHub (Nov 14, 2023):
@MrChenhtlss Maybe you can share more about your current server setup, like what is running on ports 80 and 443, do you have a proxy like nginx or others?
@MrChenhtlss commented on GitHub (Nov 14, 2023):
80,443 running nginx
Maycon Santos @.***>于2023年11月14日 周二16:58写道:
@MrChenhtlss commented on GitHub (Nov 14, 2023):
I have another server but my service provider disabled my ports 80 and 443
other ports are accessible from the internet
T oy @.***>于2023年11月14日 周二16:59写道:
@xcstatus commented on GitHub (Nov 19, 2023):
Any progress so far?
@xcstatus commented on GitHub (Dec 18, 2023):
@MrChenhtlss
The deployment script was modified and the deployment was successful over a non-standard port. But you will need to get your own domain certificate.
Change the port number in the script.
Add the domain certificate configuration to the caddy configuration file.
3. Change the redirect Settings in zitdel.
4. Modify the address of the HttpConfig node in the renderManagementJson method, and add the port.
修改了部署脚本,通过非标准端口部署成功了。 但是需要自己申请域名证书。
@MrChenhtlss commented on GitHub (Dec 18, 2023):
非常感谢,方便给我更详细的操作方法么
xcstatus @.***>于2023年12月18日 周一14:45写道:
@xcstatus commented on GitHub (Dec 18, 2023):
晚点我整理下, 现在发现了一个问题 通过pre-shard key 无法在客户端登录
@MrChenhtlss commented on GitHub (Dec 18, 2023):
好的,非常感谢,但是官方似乎有通过nginx的部署方法,但是由于能力有限,无法完全理解官方doc的内容
status @.***>于2023年12月18日 周一15:34写道:
@xcstatus commented on GitHub (Dec 18, 2023):
Netbird安装.md
getting-started-with-zitadel-xc.zip
@MrChenhtlss 这是我修改后的脚本和修改、安装说明。
@mlsmaycon Problem solved. I closed the problem. Thank you very much
@MrChenhtlss commented on GitHub (Dec 18, 2023):
OK,这真的太棒了
xcstatus @.***>于2023年12月18日 周一23:30写道:
@jiangslee commented on GitHub (Dec 18, 2023):
真香!
我迭代下,端口号改成交互输入,域名证书改成自动匹配。


操作步骤:
mkdir certscerts目录放好与域名一致的证书文件,如netbird.my-domain.com.pem,netbird.my-domain.com.keyexport NETBIRD_DOMAIN=netbird.my-domain.combash getting-started-with-zitadel-xc.sh域名解释和及安全组端口放行:你自定义的端口号,比如我上图的TCP:8088,8443; UDP ports:3478,49152-65535)getting-started-with-zitadel-xc-prompt.sh.zip
目前证书需要手动维护,要是有大佬能改成自动获取及更新证书就更好了。
@xcstatus commented on GitHub (Dec 19, 2023):
👍。我一直想要这样做,但是我不太懂shell语法,所以不敢对脚本做太大的修改。这个对脚本的修改是否有必要提个pr给官方? 但是需要兼容下不需要修改端口号的情况。
@MrChenhtlss commented on GitHub (Dec 19, 2023):
这个真的非常棒,ssl可以申请腾讯云各大云厂商为期一年的free证书
@xcstatus commented on GitHub (Dec 20, 2023):
证书自动维护可以考虑下caddy的dns质询组件。https://caddy.community/t/how-to-use-dns-provider-modules-in-caddy-2/8148
@jiangslee commented on GitHub (Dec 20, 2023):
官方的脚本默认就是caddy自动获取证书的,不过你改的手动证书方案更适合我 😋
@MrChenhtlss commented on GitHub (Dec 21, 2023):
据说“acme.sh” 基于acme可以自动续签SSL证书,但是由于我不是从事IT运维的能提供的参考非常有限,希望您可以参考下是否可行
It is said that "acme.sh" can automatically update acme-based SSL certificates. Since I have no ability to engage in IT operation and maintenance, the reference provided is very limited. I hope everyone can refer to it to see if it is feasible.
@MrChenhtlss commented on GitHub (Dec 21, 2023):
请问是否将8080端口写入到脚本可以支持交互式输入,因为我的8080端口已经被其他进程占用,可以的话那就太棒了!!!!
@jiangslee commented on GitHub (Dec 21, 2023):
好像那个8080没有实际用途,等会给你改一个交互输入修改8080的脚本
@jiangslee commented on GitHub (Dec 21, 2023):
getting-started-with-zitadel-xc.sh.zip
@MrChenhtlss 你试试看。
@MrChenhtlss commented on GitHub (Dec 21, 2023):
我的老天爷 爱死你了!!!
@jiangslee commented on GitHub (Dec 21, 2023):
前面脚本有问题,稍等1分钟
@jiangslee commented on GitHub (Dec 21, 2023):
getting-started-with-zitadel-xc.sh.zip
可以跑了
@MrChenhtlss commented on GitHub (Dec 21, 2023):
完美!!!
Perfect!!!
@xcstatus commented on GitHub (Dec 21, 2023):
现在阿里云提供的免费证书,有效期已经改为90天,不知道其他的云服务厂商是否会跟进这项改动。90天的有效期下,手动去维护证书过于繁琐。
caddy签发证书的验证ACME challenges共有三种方式,当前使用的是第二种方式TLS-ALPN challenge,它必须使用443端口. 第一种方式必须使用80端口。而第三种方式就没有端口的要求。而且第三种方式dns质询,我们其实是经常使用,云服务商中申请免费证书使用的就是这种方式
caddy修改为第三种方式也是很便捷的,只需要修改一下caddy的镜像即可。当前dockerhub中带有dns质询的caddy镜像都太老了,不太想去使用,需要重新构建一个.
修改的步骤分为以下
1.根据你域名解析所使用的服务商选择对应的dns质询插件去构建一个docker镜像
2.替换脚本中的caddy镜像
3.到云服务商申请api调用token
4.在启动脚本中增加dns质询配置
这样就可以使用caddy来自动签发、迭代域名证书了
@MrChenhtlss commented on GitHub (Dec 21, 2023):
在没有更好的解决方法前,我决定使用手动更新证书,您可以尝试腾讯云free证书有效期为一年,需要注意的是谨防滥用,阿里云先前有效期同为一年不知道因何故变成三个月这可能和滥用有关

@xcstatus commented on GitHub (Dec 21, 2023):
阿里云发布的公告是证书厂商做的变更,所以大概率其余云服务商也会变更有效期。
@MrChenhtlss commented on GitHub (Dec 21, 2023):
其他厂商跟着实行的话那真的非常遗憾,到时应该会有其他的处理方法!!!
@xcstatus commented on GitHub (Dec 21, 2023):
@jiangslee 请问有兴趣做下dns质询的适配吗? 我对运维相关技术了解的不太多,看一些镜像构建脚本比较头疼。
@jiangslee commented on GitHub (Dec 22, 2023):
DNS质询是不是要配置云厂商的ak/sk?
@jiangslee commented on GitHub (Dec 22, 2023):
http://www.taodudu.cc/news/show-4300117.html
https://blog.51cto.com/u_11908275/6953390
貌似用定时任务能解决证书问题
@xcstatus commented on GitHub (Dec 22, 2023):
在构建caddy镜像时引入对应厂商的插件即可
可以参考https://github.com/fjc0k/docker-caddy-dnspod
腾讯 DnsPod 插件
https://github.com/caddy-dns/dnspod
@MrChenhtlss commented on GitHub (Dec 23, 2023):
如果可以将caddy替换为nginx证书问题就迎刃而解
xcstatus @.***>于2023年12月22日 周五18:06写道:
@xcstatus commented on GitHub (Dec 24, 2023):
手动部署的方式搞定了, 但是自动化部署脚本不知道怎么编写
@Beatirce commented on GitHub (Dec 25, 2023):
脚本提示找不到文件或目录,但对应的目录和pem都创建过了。$NETBIRD_DOMAIN {下的tls也更改了。能麻烦分析一下是什么问题么?
@xcstatus commented on GitHub (Dec 25, 2023):
如果没有必要,不需要修改$NETBIRD_DOMAIN节点下的配置,修改配置的前提是你知道自己在做什么。
certs文件夹是需要在脚本执行的目录中创建的。
@Beatirce commented on GitHub (Dec 25, 2023):
改回来了,然后我按照md文件中说明修改后执行时提示的错误,麻烦帮忙看看是哪里的问题…
@xcstatus commented on GitHub (Dec 25, 2023):
看不出来有什么问题, 怀疑是 crdb这个服务没有启动起来。
@Beatirce commented on GitHub (Dec 25, 2023):
感谢,我看看这个服务。
@jiangslee commented on GitHub (Dec 25, 2023):
操作步骤:
按提示输入好端口号(请提前进行域名解释和及安全组端口放行:你自定义的端口号; UDP ports: 3478, 49152-65535)
@MrChenhtlss commented on GitHub (Dec 25, 2023):
如果在国内服务器上部署的话 需要注释掉脚本中的 h1 h2,另外 再把所需的docker镜像手动pull一下
jiangslee @.***>于2023年12月25日 周一17:54写道:
@jiangslee commented on GitHub (Dec 25, 2023):
@MrChenhtlss 我也是国内服务器部署,没有注释h1 h2也能跑,关键是需要提前解释好域名、提前放行端口。
@MrChenhtlss commented on GitHub (Dec 25, 2023):
前两天部署的时候 如果不注视掉 h1 h2 会卡在zitadel 无法进行下一步
jiangslee @.***>于2023年12月25日 周一17:58写道:
@xcstatus commented on GitHub (Dec 25, 2023):
caddy.zip

可以试试这个,构建caddy-dnspod,支持腾讯云dns质询。可以自动签名。
其余云服务上可以在Dockerfile中替换对应的插件就行
@jiangslee commented on GitHub (Dec 26, 2023):
这是要自己构建caddy的docker镜像吗?
@xcstatus commented on GitHub (Dec 26, 2023):
是的发自我的 iPhone在 2023年12月26日,17:03,jiangslee @.***> 写道:
caddy.zip 可以试试这个,构建caddy-dnspod,支持腾讯云dns质询。可以自动签名。 其余云服务上可以在Dockerfile中替换对应的插件就行
这是要自己构建caddy的docker镜像吗?
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you modified the open/close state.Message ID: @.***>
@xcstatus commented on GitHub (Dec 26, 2023):
使用构建的caddy-dnspod镜像可以正常运行。证书也可以自动获取。但是我不太清楚怎么把构建过程编写成脚本,通过脚本指定caddy版本、dns质询插件发自我的 iPhone在 2023年12月26日,17:03,jiangslee @.***> 写道:
caddy.zip 可以试试这个,构建caddy-dnspod,支持腾讯云dns质询。可以自动签名。 其余云服务上可以在Dockerfile中替换对应的插件就行
这是要自己构建caddy的docker镜像吗?
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you modified the open/close state.Message ID: @.***>
@MrChenhtlss commented on GitHub (Dec 27, 2023):
不知道为什么我无法打开这个issues
xcstatus @.***>于2023年12月26日 周二17:56写道:
@xhwwstudio commented on GitHub (Jan 14, 2024):
请问大佬,下载的这个文件和certs放在一个文件夹下边么?还是放里CERTS里边?
@xcstatus commented on GitHub (Jan 14, 2024):
docker-netbird
├── certs
└── getting-started-with-zitadel-xc-prompt.sh
同一个文件夹下
@liuyishengaaa commented on GitHub (Jan 17, 2024):
可以使用cloudflare申请的免费15年证书,上面您提到的自动续签能有个详细操作流程就完美了。
@xcstatus commented on GitHub (Jan 17, 2024):
这里有配置的方法。
https://github.com/netbirdio/netbird/pull/1464
这是我使用的构建caddy-dnspod的脚本,但是我不知道如何改造成一个通用的脚本。
caddy-builder.tar.gz
@shangkouyou commented on GitHub (Aug 3, 2024):
这个好棒啊 我也跑起来了 很完美 现在唯一不足的就是 我想改这个默认的100.xx.xx.xx这个网段 可以 自定义吗 大佬
@shangkouyou commented on GitHub (Aug 4, 2024):
有办法修改默认的网段嘛 100.91.0.0/24.这个
@jiangslee commented on GitHub (Aug 4, 2024):
@shangkouyou 默认给的好像是100.x.x.x/16网段,一般不会冲突,为什么要改为/24?
@shangkouyou commented on GitHub (Aug 4, 2024):
我主要是想改100.xxx.xxx.xxx 想改成自己喜欢的内网网段
@jiangslee commented on GitHub (Aug 4, 2024):
@shangkouyou https://github.com/netbirdio/netbird/issues/1633
真不建议你改。
@shangkouyou commented on GitHub (Aug 4, 2024):
好的吧 谢谢你
@shangkouyou commented on GitHub (Aug 8, 2024):
佬我还行问哦 你上面的脚本执行后安装的是老的版本 可以升级最新的吗
@1350962574 commented on GitHub (Sep 16, 2024):
@xcstatus @jiangslee

这是我认为最好的方式,以Cloudflare举例可以使用
iarekylew00t/caddy-cloudflare:latest镜像通过 CF 的 API 自动签发并续期,当然网上也有构建好并支持 dnspod,aliyun的docker镜像,配合上方大佬改进的安装脚本实现非 80,443完美SSL。@liuyishengaaa commented on GitHub (Oct 27, 2024):
你能提供详细的部署流程?
@MrChenhtlss commented on GitHub (Oct 27, 2024):
按照上方大佬提供的脚本部署完成后修改compose与Caddyfile文件即可
liuyishengaaa @.***>于2024年10月28日 周一10:43写道:
@fr58386612 commented on GitHub (Mar 13, 2025):
能否更新下,现在部署出来的版本事老的,能换成最新版本吗?
@jiangslee commented on GitHub (Mar 13, 2025):
这个分支的脚本比较新,能跑
https://raw.githubusercontent.com/jiangslee/netbird/refs/heads/main-jsl/infrastructure_files/getting-started-with-zitadel.sh
@fr58386612 commented on GitHub (Mar 13, 2025):
非常感谢
@hjchjchjc4352 commented on GitHub (May 8, 2025):
大佬,请问这个能改成host模式运行吗,脚本新建的netbird这个bridge,在openwrt里容器间无法互通,证书运行不下来
@674904341 commented on GitHub (May 11, 2025):
@jiangslee 大佬帮忙看看
{"level":"error","ts":1746974794.439305,"logger":"http.log.error","msg":"dial tcp 172.24.0.6:80: connect: connection refused","request":{"remote_ip":"10.10.10.1","remote_port":"8386","client_ip":"10.10.10.1","proto":"HTTP/2.0","method":"GET","host":"xxxx.xxxx.xxxx:9981","uri":"/api/users","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Authorization":["REDACTED"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"],"Content-Type":["application/json"],"Referer":["https://xxxx.xxxx.xxxx:9981/peers"],"Accept-Language":["zh-CN,zh;q=0.9"],"Priority":["u=1, i"],"Sec-Fetch-Mode":["cors"],"Sec-Ch-Ua-Platform":[""Windows""],"Sec-Ch-Ua-Mobile":["?0"],"Cookie":["REDACTED"],"Sec-Fetch-Dest":["empty"],"Accept":["application/json"],"Sec-Fetch-Site":["same-origin"],"Sec-Ch-Ua":[""Chromium";v="136", "Google Chrome";v="136", "Not.A/Brand";v="99""]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"xxxx.xxxx.xxxx"}},"duration":0.000739471,"status":502,"err_id":"tejdgypua","err_trace":"reverseproxy.statusError (reverseproxy.go:1390)"}
运行成功后管理后台一直加载中,caddy日志显示502
@jiangslee commented on GitHub (May 11, 2025):
@674904341 家宽环境部署?
@jiangslee commented on GitHub (May 11, 2025):
hjchjchjc4352 我改的这个脚本需要手动证书,你能否先手动生成好证书?
@jiangslee commented on GitHub (May 11, 2025):
@hjchjchjc4352 @674904341 参考下这个大佬的步骤 https://github.com/netbirdio/netbird/pull/1410#issuecomment-2670682790 用 cf+dns 方式自动申请证书
点击链接加入群聊 677407258 :https://qm.qq.com/q/hVfiDYHxks
@hjchjchjc4352 commented on GitHub (May 19, 2025):
手动证书没问题的,是openwrt的容器防火墙问题,我换成debian就可以了,谢谢大佬