SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-29 03:22:10 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Can't start management service behind traefik reverse proxy #942

New Issue
Closed
opened 2025-11-20 05:20:21 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 05:20:21 -05:00
Owner
Copy Link

Originally created by @vincent-lg18 on GitHub (May 31, 2024).

Describe the problem

Management service can't start behind a traefik reverse proxy.

Are you using NetBird Cloud?

I'm using the self hosted version of netbird.

Additional context

I have followed all steps from https://docs.netbird.io/selfhosted/selfhosted-guide#configuration-for-net-bird to set-up netbird behind traefik.

From my docker-compose.yml, here is my dashboard and management services configuration:

version: "3"
services:
  dashboard:
    image: netbirdio/dashboard:v2.3.0
    restart: unless-stopped
    #ports:
    #  - 80:80
    #  - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=$API_ENDPOINT
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=$API_ENDPOINT
      # OIDC
      - ...
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=
      - NETBIRD_DISABLE_LETSENCRYPT=true
#    volumes:
#      - netbird-letsencrypt:/etc/letsencrypt/
    networks:
      - interne
      - public
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-dashboard.rule=Host(`vpn.company.sh`)
    - traefik.http.services.netbird-dashboard.loadbalancer.server.port=80

  management:
    image: netbirdio/management:0.27.9
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - ./management.json:/etc/netbird/management.json
      #- netbird-letsencrypt:/etc/letsencrypt:ro
    #ports:
    #  - 33073:443
    command: [
      "--port", "443",
      "--log-file", "console",
      "--disable-anonymous-metrics=true",
      "--single-account-mode-domain=vpn.company.sh",
      "--dns-domain=company.vpn"
      ]
    networks:
      - interne
      - public
    labels:
    - traefik.enable=true
    - traefik.http.routers.netbird-api.rule=Host(`vpn.company.sh`) && PathPrefix(`/api`)
    - traefik.http.routers.netbird-api.service=netbird-api
    - traefik.http.services.netbird-api.loadbalancer.server.port=443

    - traefik.http.routers.netbird-management.rule=Host(`vpn.company.sh`) && PathPrefix(`/management.ManagementService/`)
    - traefik.http.routers.netbird-management.service=netbird-management
    - traefik.http.services.netbird-management.loadbalancer.server.port=443
    - traefik.http.services.netbird-management.loadbalancer.server.scheme=h2c

The only lines related to TLS from management.json file are the following ones:

    "HttpConfig": {
        "Address": "0.0.0.0:443",
        "CertFile": "",
        "CertKey": "",
    },

My dashboard is up and running :

$ docker logs -f netbird-dashboard-1
+ LETSENCRYPT_DOMAIN=none
+ LETSENCRYPT_EMAIL=example@local
+ NGINX_SSL_PORT=443
+ '[' none-x == none-x ']'
+ exit 0
NetBird latest version:
+ LETSENCRYPT_DOMAIN=none
+ LETSENCRYPT_EMAIL=example@local
+ NGINX_SSL_PORT=443
+ '[' none-x == none-x ']'
+ exit 0
NetBird latest version:

But the management service is restarting again and again, looking for TLS credentials:

2024-05-31T08:13:28Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://auth.company.sh/application/o/netbird/.well-known/openid-configuration
2024-05-31T08:13:29Z INFO management/cmd/management.go:460: loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.company.sh/application/o/netbird/.well-known/openid-configuration
2024-05-31T08:13:29Z INFO management/cmd/management.go:462: overriding HttpConfig.AuthIssuer with a new value https://auth.company.sh/application/o/netbird/, previously configured value: https://auth.company.sh/application/o/netbird/
2024-05-31T08:13:29Z INFO management/cmd/management.go:466: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.company.sh/application/o/netbird/jwks/, previously configured value: https://auth.company.sh/application/o/netbird/jwks/
2024-05-31T08:13:29Z INFO management/cmd/management.go:471: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.company.sh/application/o/token/, previously configured value: https://auth.company.sh/application/o/token/
2024-05-31T08:13:29Z INFO management/cmd/management.go:474: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.company.sh/application/o/device/, previously configured value: https://auth.company.sh/application/o/device/
2024-05-31T08:13:29Z INFO management/cmd/management.go:482: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.company.sh, previously configured value: auth.company.sh
2024-05-31T08:13:29Z INFO management/cmd/management.go:492: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://auth.company.sh/application/o/token/, previously configured value: https://auth.company.sh/application/o/token/
2024-05-31T08:13:29Z INFO management/cmd/management.go:495: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://auth.company.sh/application/o/authorize/, previously configured value: https://auth.company.sh/application/o/authorize/
2024-05-31T08:13:29Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081
2024-05-31T08:13:29Z INFO management/server/store.go:109: using Postgres store engine
2024-05-31T08:13:29Z INFO management/server/migration/migration.go:128: No records in table peers, no migration needed
2024-05-31T08:13:29Z INFO management/server/migration/migration.go:128: No records in table peers, no migration needed
2024-05-31T08:13:29Z INFO management/cmd/management.go:173: geo location service has been initialized from /var/lib/netbird/
2024-05-31T08:13:29Z INFO management/server/account.go:889: single account mode enabled, accounts number 0
2024-05-31T08:13:29Z ERRO management/cmd/management.go:227: cannot load TLS credentials: open /etc/letsencrypt/live/vpn.company.sh/fullchain.pem: no such file or directory
Error: open /etc/letsencrypt/live/vpn.company.sh/fullchain.pem: no such file or directory

How the management service can stop looking for TLS credentials, and then starting & waiting for traefik connections?

Originally created by @vincent-lg18 on GitHub (May 31, 2024). **Describe the problem** Management service can't start behind a traefik reverse proxy. **Are you using NetBird Cloud?** I'm using the self hosted version of netbird. **Additional context** I have followed all steps from https://docs.netbird.io/selfhosted/selfhosted-guide#configuration-for-net-bird to set-up netbird behind traefik. From my docker-compose.yml, here is my dashboard and management services configuration: ```yml version: "3" services: dashboard: image: netbirdio/dashboard:v2.3.0 restart: unless-stopped #ports: # - 80:80 # - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=$API_ENDPOINT - NETBIRD_MGMT_GRPC_API_ENDPOINT=$API_ENDPOINT # OIDC - ... # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN= - LETSENCRYPT_EMAIL= - NETBIRD_DISABLE_LETSENCRYPT=true # volumes: # - netbird-letsencrypt:/etc/letsencrypt/ networks: - interne - public labels: - traefik.enable=true - traefik.http.routers.netbird-dashboard.rule=Host(`vpn.company.sh`) - traefik.http.services.netbird-dashboard.loadbalancer.server.port=80 management: image: netbirdio/management:0.27.9 restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - ./management.json:/etc/netbird/management.json #- netbird-letsencrypt:/etc/letsencrypt:ro #ports: # - 33073:443 command: [ "--port", "443", "--log-file", "console", "--disable-anonymous-metrics=true", "--single-account-mode-domain=vpn.company.sh", "--dns-domain=company.vpn" ] networks: - interne - public labels: - traefik.enable=true - traefik.http.routers.netbird-api.rule=Host(`vpn.company.sh`) && PathPrefix(`/api`) - traefik.http.routers.netbird-api.service=netbird-api - traefik.http.services.netbird-api.loadbalancer.server.port=443 - traefik.http.routers.netbird-management.rule=Host(`vpn.company.sh`) && PathPrefix(`/management.ManagementService/`) - traefik.http.routers.netbird-management.service=netbird-management - traefik.http.services.netbird-management.loadbalancer.server.port=443 - traefik.http.services.netbird-management.loadbalancer.server.scheme=h2c ``` The only lines related to TLS from management.json file are the following ones: ```json "HttpConfig": { "Address": "0.0.0.0:443", "CertFile": "", "CertKey": "", }, ``` My dashboard is up and running : ``` $ docker logs -f netbird-dashboard-1 + LETSENCRYPT_DOMAIN=none + LETSENCRYPT_EMAIL=example@local + NGINX_SSL_PORT=443 + '[' none-x == none-x ']' + exit 0 NetBird latest version: + LETSENCRYPT_DOMAIN=none + LETSENCRYPT_EMAIL=example@local + NGINX_SSL_PORT=443 + '[' none-x == none-x ']' + exit 0 NetBird latest version: ``` But the management service is restarting again and again, looking for TLS credentials: ``` 2024-05-31T08:13:28Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://auth.company.sh/application/o/netbird/.well-known/openid-configuration 2024-05-31T08:13:29Z INFO management/cmd/management.go:460: loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.company.sh/application/o/netbird/.well-known/openid-configuration 2024-05-31T08:13:29Z INFO management/cmd/management.go:462: overriding HttpConfig.AuthIssuer with a new value https://auth.company.sh/application/o/netbird/, previously configured value: https://auth.company.sh/application/o/netbird/ 2024-05-31T08:13:29Z INFO management/cmd/management.go:466: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.company.sh/application/o/netbird/jwks/, previously configured value: https://auth.company.sh/application/o/netbird/jwks/ 2024-05-31T08:13:29Z INFO management/cmd/management.go:471: overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.company.sh/application/o/token/, previously configured value: https://auth.company.sh/application/o/token/ 2024-05-31T08:13:29Z INFO management/cmd/management.go:474: overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.company.sh/application/o/device/, previously configured value: https://auth.company.sh/application/o/device/ 2024-05-31T08:13:29Z INFO management/cmd/management.go:482: overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.company.sh, previously configured value: auth.company.sh 2024-05-31T08:13:29Z INFO management/cmd/management.go:492: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://auth.company.sh/application/o/token/, previously configured value: https://auth.company.sh/application/o/token/ 2024-05-31T08:13:29Z INFO management/cmd/management.go:495: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://auth.company.sh/application/o/authorize/, previously configured value: https://auth.company.sh/application/o/authorize/ 2024-05-31T08:13:29Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 2024-05-31T08:13:29Z INFO management/server/store.go:109: using Postgres store engine 2024-05-31T08:13:29Z INFO management/server/migration/migration.go:128: No records in table peers, no migration needed 2024-05-31T08:13:29Z INFO management/server/migration/migration.go:128: No records in table peers, no migration needed 2024-05-31T08:13:29Z INFO management/cmd/management.go:173: geo location service has been initialized from /var/lib/netbird/ 2024-05-31T08:13:29Z INFO management/server/account.go:889: single account mode enabled, accounts number 0 2024-05-31T08:13:29Z ERRO management/cmd/management.go:227: cannot load TLS credentials: open /etc/letsencrypt/live/vpn.company.sh/fullchain.pem: no such file or directory Error: open /etc/letsencrypt/live/vpn.company.sh/fullchain.pem: no such file or directory ``` How the management service can stop looking for TLS credentials, and then starting & waiting for traefik connections?
saavagebueno added the triage-needed label 2025-11-20 05:20:21 -05:00
saavagebueno commented 2025-11-20 05:20:22 -05:00
Author
Owner
Copy Link

@bibius commented on GitHub (Jun 19, 2024):

Hi, I have the same issue. How can I solve?

@bibius commented on GitHub (Jun 19, 2024): Hi, I have the same issue. How can I solve?
saavagebueno commented 2025-11-20 05:20:22 -05:00
Author
Owner
Copy Link

@vincent-lg18 commented on GitHub (Jun 24, 2024):

Don't forget to build your docker image, it was my problem.

@vincent-lg18 commented on GitHub (Jun 24, 2024): Don't forget to build your docker image, it was my problem.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#942
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?