diff --git a/public/docs-static/img/agent-network/quickstart/agent-network-add-policy.png b/public/docs-static/img/agent-network/quickstart/agent-network-add-policy.png new file mode 100644 index 00000000..c029ed72 Binary files /dev/null and b/public/docs-static/img/agent-network/quickstart/agent-network-add-policy.png differ diff --git a/public/docs-static/img/agent-network/quickstart/agent-network-add-provider.png b/public/docs-static/img/agent-network/quickstart/agent-network-add-provider.png new file mode 100644 index 00000000..46428df2 Binary files /dev/null and b/public/docs-static/img/agent-network/quickstart/agent-network-add-provider.png differ diff --git a/public/docs-static/img/agent-network/quickstart/agent-network-agent-config.png b/public/docs-static/img/agent-network/quickstart/agent-network-agent-config.png new file mode 100644 index 00000000..925bf2a6 Binary files /dev/null and b/public/docs-static/img/agent-network/quickstart/agent-network-agent-config.png differ diff --git a/public/docs-static/img/agent-network/quickstart/agent-network-connect-device.png b/public/docs-static/img/agent-network/quickstart/agent-network-connect-device.png new file mode 100644 index 00000000..1023cb98 Binary files /dev/null and b/public/docs-static/img/agent-network/quickstart/agent-network-connect-device.png differ diff --git a/public/docs-static/img/agent-network/quickstart/agent-network-empty-endpoint.png b/public/docs-static/img/agent-network/quickstart/agent-network-empty-endpoint.png new file mode 100644 index 00000000..5bc598cc Binary files /dev/null and b/public/docs-static/img/agent-network/quickstart/agent-network-empty-endpoint.png differ diff --git a/public/docs-static/img/agent-network/quickstart/agent-network-endpoint.png b/public/docs-static/img/agent-network/quickstart/agent-network-endpoint.png new file mode 100644 index 00000000..6d8c805e Binary files /dev/null and b/public/docs-static/img/agent-network/quickstart/agent-network-endpoint.png differ diff --git a/src/pages/agent-network/policies/index.mdx b/src/pages/agent-network/policies/index.mdx index c8117508..4c5af06e 100644 --- a/src/pages/agent-network/policies/index.mdx +++ b/src/pages/agent-network/policies/index.mdx @@ -11,6 +11,12 @@ guardrails. agent network llm policy

+ + This page explains how to create and manage access to AI providers and gateways. If you are + looking for a guide on how to manage access to internal resources, see + [Access Control](/manage/access-control). + + ## How Policies Work - **Source groups** — the users/agents the policy applies to. diff --git a/src/pages/agent-network/quickstart.mdx b/src/pages/agent-network/quickstart.mdx index c537d2b4..887bb594 100644 --- a/src/pages/agent-network/quickstart.mdx +++ b/src/pages/agent-network/quickstart.mdx @@ -1,42 +1,129 @@ import { Note } from '@/components/mdx' export const description = - 'Get an LLM request routed through NetBird Agent Network end to end: connect a provider, create a policy, and make your first keyless call.' + 'Get an LLM request routed through NetBird Agent Network end to end: set up the NetBird server with the proxy, connect a provider, create a policy, and make your first keyless call.' -# Quickstart +# NetBird Agent Network Quickstart -This guide takes you from zero to a working, keyless LLM call through Agent -Network in a few minutes. +This guide takes you from a fresh server to a working, keyless LLM call through +Agent Network. - You'll need an account with Agent Network enabled and at least one connected - peer (your agent or workstation) on the tunnel. + NetBird Agent Network is open source and self-hosted, so you can run it on your own servers. This guide sets up a minimal + NetBird deployment with the core Agent Network functionality. You can enable the full platform later. + The code lives in the [netbirdio/netbird](https://github.com/netbirdio/netbird/agent-network) repository. -## 1. Connect a provider +## Infrastructure Requirements -Add an AI provider (for example OpenAI) and paste its API key. NetBird stores -the key and exposes a tunnel-only endpoint in return. See -[Providers](/agent-network/providers). +- A Linux VM with at least **1 CPU** and **2 GB** of memory. +- The VM must be publicly accessible on **TCP ports 80 and 443**, and **UDP port 3478**. +- A **public domain** that resolves to the VM's public IP (e.g. `netbird.example.com`), + plus a **wildcard record** (e.g. `*.netbird.example.com`) so agent-network + endpoints resolve. -## 2. Create a policy +The public domain is not used for the Agent Network itself. It is only used to establish network connectivity +and manage the platform. -Create a policy that connects a source group (your users or agents) to the -provider. See [Policies](/agent-network/policies). +## Software Requirements -## 3. Make a request +- Docker with the docker-compose plugin v2 or higher ([Docker installation guide](https://docs.docker.com/engine/install/)) +- [jq](https://jqlang.github.io/jq/) — install with `sudo apt install jq` or `sudo yum install jq` +- [curl](https://curl.se/) — install with `sudo apt install curl` or `sudo yum install curl` -Point your LLM client at the Agent Network endpoint instead of the provider's -URL — no API key required from the client. +### Installation script + +Download and run the installation script: ```bash -# TODO: replace with the real endpoint + example request -curl https:///v1/chat/completions \ - -H "Content-Type: application/json" \ - -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}' +curl -fsSL https://pkgs.netbird.io/getting-started.sh | NETBIRD_AGENT_NETWORK=true bash ``` -## 4. See it in Usage & Logs +Once the script finishes, open `https://netbird.example.com`, create your admin +account on the setup page, create an admin user, and log in. -Open [Usage & Logs](/agent-network/usage-and-logs) to confirm the request was -recorded, with the caller identity, model, tokens, and cost. \ No newline at end of file +To access a provider via NetBird, you need to use an **agent network endpoint**, which is generated when you connect your +first provider. + +## Add Your Device to the Network + +Agent network endpoints are private and reachable only over the NetBird overlay network. +To access one, your agent’s device must run the NetBird client and be authenticated, keeping access keyless, authorized, +and protected by a peer-to-peer encrypted WireGuard tunnel. + +1. In the NetBird dashboard go to **Peers > User Devices**. +2. Click **Add Peer** and download the NetBird client app for your device. +3. Run the client app, click "Connect", and log in with your NetBird account when prompted + +

+ agent network connect +

+ +You should now see your device in the peers list in the NetBird dashboard. + + +## Connect a Provider + +Go to **Agent Network > Providers** and add an AI provider, such as Anthropic if you use Claude Code. +Paste the provider’s API key. NetBird stores the API key server-side and returns a tunnel-only endpoint that agents +can use securely. You can optionally set a list of allowed models and a custom token price. +See [Providers](/agent-network/providers) for more details. + +

+ agent network add provider +

+ +You should now see a newly-generated endpoint above the **Providers** table. + +

+ agent network endpoint +

+ +## Configure Your Agent + +Point your agent at the NetBird endpoint as its **base URL**. No provider API key +is needed on the client. NetBird authorizes each request against your policies and +injects the upstream provider key server-side. + +Click the **Agent Config** button next to your agent network endpoint and pick the +tab that matches your tool. The dashboard pre-fills your endpoint for you. + +Copy the snippet for your tool. Claude Code reads `~/.claude/settings.json` and Codex reads +`~/.codex/config.toml`. + +

+ agent network agent config +

+ +## Create a Policy + +By default, Agent Network denies every request. Nothing reaches a provider until a +policy explicitly allows it. A policy connects a **Source Group** (your users or +agent devices) to one or more **Providers**, and is where you attach optional token +and budget limits and guardrails. + +1. Go to **Team > Users** and add your user to a group, such as **Engineering**. +2. Go to **Agent Network > Policies** and click **Add Policy**. +3. Select the **Source Group** you want to authorize. +4. Choose the **Provider** that members of the group can access. +5. _(Optional)_ Set **token / budget limits** and attach **guardrails**. +6. Save the policy. + +

+ agent network add policy +

+ +With the policy in place, the agent you configured above can now reach the provider. +Run it as usual, or send a quick test request, using a model your provider allows: + +```bash +curl https:///v1/messages \ + --header "Content-Type: application/json" \ + --header "anthropic-version: 2023-06-01" \ + --data '{"model":"claude-opus-4-8","max_tokens":1024,"messages":[{"role":"user","content":"What is NetBird?"}]}' +``` + +## Verify in Usage & Logs + +Open **Usage & Logs** to confirm the request was +recorded with the caller identity, model, tokens, and cost. \ No newline at end of file