mirror of
https://github.com/netbirdio/netbird.git
synced 2026-03-31 06:34:19 -04:00
125 lines
4.4 KiB
Plaintext
125 lines
4.4 KiB
Plaintext
# NetBird Combined Server Configuration
|
|
# Copy this file to config.yaml and customize for your deployment
|
|
#
|
|
# This is a Management server with optional embedded Signal, Relay, and STUN services.
|
|
# By default, all services run locally. You can use external services instead by
|
|
# setting the corresponding override fields.
|
|
#
|
|
# Architecture:
|
|
# - Management: Always runs locally (this IS the management server)
|
|
# - Signal: Local by default; set 'signalUri' to use external (disables local)
|
|
# - Relay: Local by default; set 'relays' to use external (disables local)
|
|
# - STUN: Local on port 3478 by default; set 'stuns' to use external instead
|
|
|
|
server:
|
|
# Main HTTP/gRPC port for all services (Management, Signal, Relay)
|
|
listenAddress: ":443"
|
|
|
|
# Public address that peers will use to connect to this server
|
|
# Used for relay connections and management DNS domain
|
|
# Format: protocol://hostname:port (e.g., https://server.mycompany.com:443)
|
|
exposedAddress: "https://server.mycompany.com:443"
|
|
|
|
# STUN server ports (defaults to [3478] if not specified; set 'stuns' to use external)
|
|
# stunPorts:
|
|
# - 3478
|
|
|
|
# Metrics endpoint port
|
|
metricsPort: 9090
|
|
|
|
# Healthcheck endpoint address
|
|
healthcheckAddress: ":9000"
|
|
|
|
# Logging configuration
|
|
logLevel: "info" # Default log level for all components: panic, fatal, error, warn, info, debug, trace
|
|
logFile: "console" # "console" or path to log file
|
|
|
|
# TLS configuration (optional)
|
|
tls:
|
|
certFile: ""
|
|
keyFile: ""
|
|
letsencrypt:
|
|
enabled: false
|
|
dataDir: ""
|
|
domains: []
|
|
email: ""
|
|
awsRoute53: false
|
|
|
|
# Shared secret for relay authentication (required when running local relay)
|
|
authSecret: "your-secret-key-here"
|
|
|
|
# Data directory for all services
|
|
dataDir: "/var/lib/netbird/"
|
|
|
|
# ============================================================================
|
|
# External Service Overrides (optional)
|
|
# Use these to point to external Signal, Relay, or STUN servers instead of
|
|
# running them locally. When set, the corresponding local service is disabled.
|
|
# ============================================================================
|
|
|
|
# External STUN servers - disables local STUN server
|
|
# stuns:
|
|
# - uri: "stun:stun.example.com:3478"
|
|
# - uri: "stun:stun.example.com:3479"
|
|
|
|
# External relay servers - disables local relay server
|
|
# relays:
|
|
# addresses:
|
|
# - "rels://relay.example.com:443"
|
|
# credentialsTTL: "12h"
|
|
# secret: "relay-shared-secret"
|
|
|
|
# External signal server - disables local signal server
|
|
# signalUri: "https://signal.example.com:443"
|
|
|
|
# ============================================================================
|
|
# Management Settings
|
|
# ============================================================================
|
|
|
|
# Metrics and updates
|
|
disableAnonymousMetrics: false
|
|
disableGeoliteUpdate: false
|
|
|
|
# Embedded authentication/identity provider (Dex) configuration (always enabled)
|
|
auth:
|
|
# OIDC issuer URL - must be publicly accessible
|
|
issuer: "https://example.com/oauth2"
|
|
localAuthDisabled: false
|
|
signKeyRefreshEnabled: false
|
|
# OAuth2 redirect URIs for dashboard
|
|
dashboardRedirectURIs:
|
|
- "https://app.example.com/nb-auth"
|
|
- "https://app.example.com/nb-silent-auth"
|
|
# OAuth2 redirect URIs for CLI
|
|
cliRedirectURIs:
|
|
- "http://localhost:53000/"
|
|
# Optional initial admin user
|
|
# owner:
|
|
# email: "admin@example.com"
|
|
# password: "initial-password"
|
|
|
|
# Store configuration
|
|
store:
|
|
engine: "sqlite" # sqlite, postgres, or mysql
|
|
dsn: "" # Connection string for postgres or mysql
|
|
encryptionKey: ""
|
|
# file: "" # Custom SQLite file path (optional, defaults to {dataDir}/store.db)
|
|
|
|
# Activity events store configuration (optional, defaults to sqlite in dataDir)
|
|
# activityStore:
|
|
# engine: "sqlite" # sqlite or postgres
|
|
# dsn: "" # Connection string for postgres
|
|
# file: "" # Custom SQLite file path (optional, defaults to {dataDir}/events.db)
|
|
|
|
# Auth (embedded IdP) store configuration (optional, defaults to sqlite3 in dataDir/idp.db)
|
|
# authStore:
|
|
# engine: "sqlite3" # sqlite3 or postgres
|
|
# dsn: "" # Connection string for postgres (e.g., "host=localhost port=5432 user=postgres password=postgres dbname=netbird_idp sslmode=disable")
|
|
# file: "" # Custom SQLite file path (optional, defaults to {dataDir}/idp.db)
|
|
|
|
# Reverse proxy settings (optional)
|
|
# reverseProxy:
|
|
# trustedHTTPProxies: []
|
|
# trustedHTTPProxiesCount: 0
|
|
# trustedPeers: []
|