sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-16 18:49:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Document --letsencrypt-listen-address for Signal and Management

Browse Source
This commit is contained in:
jnfrati
2026-10-07 15:41:26 +02:00
parent fd7f5c0ddb
commit bc134edb2c
2 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/selfhosted/environment-variables.mdx
+5
View File
@@ -126,6 +126,10 @@ These variables can override CLI flags at runtime. The naming convention is `NB_
| `NB_DISABLE_GEOLITE_UPDATE` | Disable GeoLite database updates |
| `NB_SETUP_PAT_ENABLED` | Enable optional Personal Access Token creation from `/api/setup` during initial setup. See [Automated Setup](/selfhosted/automated-setup). |
<Note>
The Management server does not read an environment variable for `--letsencrypt-listen-address`. Pass it as a command-line flag. See the `NB_LETSENCRYPT_LISTEN_ADDRESS` entry under [Signal Server Variables](#signal-server-variables) for what the setting does.
</Note>
### Advanced Runtime Variables
| Variable | Description |
@@ -150,6 +154,7 @@ These variables can override CLI flags at runtime. The naming convention is `NB_
| `NB_METRICS_PORT` | Prometheus metrics port |
| `NB_SSL_DIR` | SSL certificates directory |
| `NB_LETSENCRYPT_DOMAIN` | Let's Encrypt domain |
| `NB_LETSENCRYPT_LISTEN_ADDRESS` | Address of the separate Let's Encrypt challenge listener (overrides `--letsencrypt-listen-address`). Default `:443`. Used only when Let's Encrypt is on and `NB_PORT` is not `443`. Set it to an empty value to disable the separate listener when public port 443 is forwarded to `NB_PORT`. |
| `NB_CERT_FILE` | TLS certificate file |
| `NB_CERT_KEY` | TLS certificate key file |
| `NB_LOG_LEVEL` | Log level |
src/pages/selfhosted/maintenance/scaling/set-up-external-signal.mdx
+24
View File
@@ -70,6 +70,30 @@ volumes:
signal_data:
```
### Let's Encrypt challenge listener
When `NB_PORT` is not `443`, the signal server opens a separate listener for the Let's Encrypt challenges. Set its address with `--letsencrypt-listen-address` or `NB_LETSENCRYPT_LISTEN_ADDRESS`. The default is `:443`.
A process that does not run as root (for example, the UBI images) cannot bind port 443. In this case, choose one of these options:
- Set the listener to a port that the process can bind, and forward public port 443 to it:
```bash
NB_LETSENCRYPT_LISTEN_ADDRESS=:8443
```
- Forward public port 443 to `NB_PORT`, and disable the separate listener with an empty value. The main TLS listener then answers the TLS-ALPN-01 challenges:
```bash
NB_LETSENCRYPT_LISTEN_ADDRESS=
```
If the challenge listener cannot bind its address, the signal server logs an error and continues to run.
<Note>
The Management server has the same `--letsencrypt-listen-address` flag, with the same default. It does not read an environment variable for it. If its challenge listener cannot bind, the Management server stops with an error. The Relay and the combined server do not use this flag.
</Note>
## Alternative: TLS with Existing Certificates
If you have existing TLS certificates, replace the Let's Encrypt variable in `signal.env` with: