From cb4c29844f9cf6b79a7bfc45ccbf9da3444a11bf Mon Sep 17 00:00:00 2001 From: Brandon Hopkins <76761586+TechHutTV@users.noreply.github.com> Date: Wed, 14 Oct 2026 10:25:31 -0700 Subject: [PATCH] Document Traefik and CrowdSec upgrades for self-hosted deployments (#1030) * Updating 3rd party packages * Fixed possible unintentional crowdsec ban * Fixes and version updates * Document Traefik header handling * Traefik rollback and crowdsec allowlist note (#1035) * Warn that rolling Traefik back before v3.7.12 restores header-alias spoofing. --------- Co-authored-by: PizzaLovingNerd --- .../maintenance/crowdsec-dashboard.mdx | 39 +++-- src/pages/selfhosted/maintenance/crowdsec.mdx | 4 +- src/pages/selfhosted/maintenance/upgrade.mdx | 160 +++++++++++++++++- src/pages/selfhosted/marketplaces/vultr.mdx | 9 +- .../migration/enable-reverse-proxy.mdx | 2 +- .../selfhosted/selfhosted-quickstart.mdx | 4 +- 6 files changed, 188 insertions(+), 30 deletions(-) diff --git a/src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx b/src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx index 8d1afb65..452e8660 100644 --- a/src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx +++ b/src/pages/selfhosted/maintenance/crowdsec-dashboard.mdx @@ -11,6 +11,8 @@ The configuration reuses the CrowdSec LAPI container created by the NetBird quic For the NetBird Proxy IP reputation integration, see [CrowdSec IP Reputation](/selfhosted/maintenance/crowdsec). +For updates to Traefik, CrowdSec, or the bouncer plugin, see [Upgrading Traefik and CrowdSec](/selfhosted/maintenance/upgrade#upgrading-traefik-and-crowd-sec). + ## Prerequisites - A self-hosted NetBird deployment using the internal Traefik reverse proxy. @@ -86,25 +88,22 @@ EOF Start from the `docker-compose.yml` generated by the quickstart with proxy CrowdSec enabled. The file already includes a `crowdsec` service, and `proxy.env` already points NetBird Proxy to `http://crowdsec:8080`. -Under `services.traefik.command`, add the Traefik CrowdSec bouncer plugin static arguments: +Set the Traefik image to the validated version below and add the header handling and bouncer plugin arguments to the existing `services.traefik.command` list: ```yaml services: traefik: + image: traefik:v3.7.14 command: + - '--entrypoints.web.http.aliasHeadersStrategy=delete' + - '--entrypoints.websecure.http.aliasHeadersStrategy=delete' - '--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin' - - '--experimental.plugins.bouncer.version=v1.6.0' + - '--experimental.plugins.bouncer.version=v1.7.1' ``` -The generated Compose file already sets `--providers.docker.network` in the Traefik command block, normally to `netbird`, matching the network key in the Compose file. Leave it as generated and do not add a second copy of the flag. +The header settings remove request headers with names containing characters other than letters, digits, and hyphens. If you use custom headers or already set `underscoreHeadersStrategy`, review [Traefik header handling](/selfhosted/maintenance/upgrade#traefik-header-handling) before applying them. -Only change it if Traefik logs warnings about a missing Docker network. Compose prefixes the network name with the project name, which defaults to the install directory name, so the actual name varies by deployment. Check it before editing: - -```bash -docker network ls | grep netbird -``` - -An install in `/root` produces `root_netbird`; one in `/opt/netbird` produces `netbird_netbird`. +Verify that the existing `--providers.docker.network` value matches the actual Docker network name, which can include a Compose project prefix. Follow [Traefik Docker network](/selfhosted/maintenance/upgrade#traefik-docker-network) to check it and replace a mismatched value. Update the existing flag rather than adding a second copy. Under `services.traefik.depends_on`, make Traefik wait until CrowdSec is healthy: @@ -164,7 +163,7 @@ Replace `netbird.example.com` with your NetBird domain. Traefik labels do not re middleware to the `proxy-passthrough` TCP router. -Merge these fields into `services.crowdsec`. This adds the AppSec collections, registers the dashboard bouncer key, and updates the health check so CrowdSec reports healthy only after both LAPI and AppSec are available. Keep the generated fields that already exist in your Compose file, such as `image`, `container_name`, `restart`, `networks`, `labels`, `logging`, and `volumes`. +Merge these fields into `services.crowdsec`. This sets the validated image version, adds the AppSec collections, registers the dashboard bouncer key, and updates the health check so CrowdSec reports healthy only after both LAPI and AppSec are available. Keep the other generated fields, including `container_name`, `restart`, `networks`, `labels`, `logging`, and `volumes`. The installer-created health check only verifies the CrowdSec Local API: @@ -189,7 +188,7 @@ Dashboard protection also needs the AppSec listener on port `7422`, so replace t ```yaml services: crowdsec: - ... + image: crowdsecurity/crowdsec:v1.8.1 environment: COLLECTIONS: "crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" BOUNCER_KEY_netbird_dashboard: "${CROWDSEC_DASHBOARD_BOUNCER_KEY}" @@ -241,6 +240,12 @@ A known malicious probe should return `403`: curl -ks -A 'Mozilla/5.0 NetBirdDashboardCheck' -o /dev/null -w '%{http_code}\n' "https://$NETBIRD_DOMAIN/.env" ``` + + Use only the `/.env` and `/api/.env` probes when testing from your admin IP. Triggering two different AppSec rules within about a minute can ban that IP for 4 hours, blocking the dashboard, `/api`, and `/oauth2`. To lift a ban, [recover access over SSH](#recovering-from-a-dashboard-lockout). + + The default `crowdsecurity/whitelists` parser exempts loopback and private IPv4 ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) from this ban. Requests from those addresses are still blocked individually with `403`, so testing from a LAN client does not show whether a public IP would be banned. + + Check AppSec metrics and bouncer registration: ```bash @@ -346,7 +351,7 @@ First identify which of the two mechanisms is blocking you, because they are han docker compose exec crowdsec cscli decisions list ``` -If your address is listed, an **IP decision** is blocking you. If it is not, the block is an **AppSec** match on the request itself: AppSec inspects requests and does not create decisions, so `cscli decisions delete` has no effect in that case. Confirm with `cscli metrics show appsec` and `cscli alerts list`, where AppSec matches appear with `kind` set to `waf`. +If your address is listed, an **IP decision** is blocking you. This includes bans created by the `crowdsecurity/appsec-vpatch` scenario after repeated AppSec matches, which appear with that reason. If it is not, the block is an **AppSec** match on the request itself: an individual AppSec match does not create a decision, so `cscli decisions delete` has no effect in that case. Confirm with `cscli metrics show appsec` and `cscli alerts list`, where AppSec matches appear with `kind` set to `waf`. Allowlisting the address resolves both cases. `cscli allowlists add` fails with `allowlist '' not found` if the list does not already exist, so create it first if you have not set one up: @@ -399,13 +404,7 @@ If CrowdSec is stopped or unreachable while `crowdsecAppsecUnreachableBlock=true Separately, a reverse proxy service in `enforce` mode denies all connections while its bouncer has not completed its initial sync, for example when the proxy starts with the LAPI unavailable. See [Enforcement modes](/selfhosted/maintenance/crowdsec#enforcement-modes). -If Traefik logs warnings about a missing Docker network, check the actual network name: - -```bash -docker network ls | grep netbird -``` - -Then set `--providers.docker.network` to the actual network name, commonly `netbird_netbird`. +If Traefik logs warnings about a missing Docker network, follow [Traefik Docker network](/selfhosted/maintenance/upgrade#traefik-docker-network) to correct the configured name. If AppSec metrics do not increment, confirm that the middleware is attached to the dashboard router and that Traefik can reach `crowdsec:8080` and `crowdsec:7422`. diff --git a/src/pages/selfhosted/maintenance/crowdsec.mdx b/src/pages/selfhosted/maintenance/crowdsec.mdx index cf6d1f08..a24ff544 100644 --- a/src/pages/selfhosted/maintenance/crowdsec.mdx +++ b/src/pages/selfhosted/maintenance/crowdsec.mdx @@ -10,6 +10,8 @@ export const description = 'Enable CrowdSec IP reputation blocking for self-host This page covers how the integration works and how to operate it. For full setup instructions, see [Step 7: Enable CrowdSec IP reputation](/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowdsec-ip-reputation) in the Enable Reverse Proxy guide. +For version selection and updates to an existing deployment, see [Upgrading Traefik and CrowdSec](/selfhosted/maintenance/upgrade#upgrading-traefik-and-crowd-sec). + If you're running the [quickstart script](/selfhosted/selfhosted-quickstart) for a fresh installation, it offers to enable CrowdSec automatically when you choose the built-in Traefik option and enable the proxy. @@ -173,6 +175,6 @@ docker compose exec crowdsec cscli alerts list docker compose exec crowdsec cscli decisions delete --ip ``` -`cscli alerts list` includes a `kind` column that identifies which component generated the alert: `crowdsec` for local log detection, `waf` for an AppSec match, and `cscli` for a manually added decision. AppSec matches block the individual request but do not create an IP decision, so they never appear in `cscli decisions list`; use `cscli metrics show appsec` to inspect those instead. +`cscli alerts list` includes a `kind` column that identifies which component generated the alert: `crowdsec` for local log detection, `waf` for an AppSec match, and `cscli` for a manually added decision. An individual AppSec match blocks only that request and does not appear in `cscli decisions list`; use `cscli metrics show appsec` to inspect those instead. If you installed the `crowdsecurity/appsec-virtual-patching` collection for [dashboard protection](/selfhosted/maintenance/crowdsec-dashboard), matches against two different AppSec rules from the same IP within about a minute trigger the `crowdsecurity/appsec-vpatch` scenario, which creates a regular 4-hour IP ban that does appear in `cscli decisions list`. Loopback and private IPv4 addresses are exempt from this ban through the default `crowdsecurity/whitelists` parser, although their individual matching requests are still blocked. For dashboard lockouts specifically, see [Recovering from a dashboard lockout](/selfhosted/maintenance/crowdsec-dashboard#recovering-from-a-dashboard-lockout). diff --git a/src/pages/selfhosted/maintenance/upgrade.mdx b/src/pages/selfhosted/maintenance/upgrade.mdx index c0234174..82cd3fbf 100644 --- a/src/pages/selfhosted/maintenance/upgrade.mdx +++ b/src/pages/selfhosted/maintenance/upgrade.mdx @@ -1,5 +1,7 @@ # Upgrade Your Self-Hosted NetBird Installation +This guide covers NetBird upgrades and [updating Traefik and CrowdSec](#upgrading-traefik-and-crowd-sec), including deployments created from marketplace images. Run the commands from the directory containing your `docker-compose.yml` (`/opt/netbird` on [Vultr](/selfhosted/marketplaces/vultr)). + ## Check for Updates The NetBird Dashboard displays an update indicator at the bottom of the left navigation menu when a new version is available: @@ -27,6 +29,8 @@ Example response: } ``` +The dashboard indicator and version API cover NetBird components. They do not report updates for Traefik, CrowdSec, or the optional Traefik CrowdSec bouncer plugin. Check those projects' releases separately, as described below. + ## Check Release Notes Before upgrading, review the release notes for any breaking changes or migration steps: @@ -44,7 +48,8 @@ To upgrade NetBird to the latest version: 1. Run the backup steps described in the [backup](/selfhosted/maintenance/backup) section. 2. Review the release notes (see above) for any breaking changes. -3. Pull the latest NetBird docker images: +3. Check the `image:` entries in `docker-compose.yml`. If you use explicit version tags, change them to the releases you want to deploy before pulling. `docker compose pull` downloads the configured tags; it does not change them. With `:latest`, it fetches the image currently published under that tag. +4. Pull the configured NetBird images: ```bash docker compose pull netbird-server dashboard ``` @@ -52,7 +57,7 @@ To upgrade NetBird to the latest version: ```bash docker compose pull proxy ``` -4. Restart the NetBird containers with the new images: +5. Restart the NetBird containers with the new images: ```bash docker compose up -d --force-recreate netbird-server dashboard ``` @@ -72,11 +77,160 @@ Compare it with the `management_current_version` field returned by `GET /api/ins -For upgrades from older versions (pre-v0.26.0), see the [Legacy upgrade notes](#legacy-self-hosting-with-zitadel-idp) below. +For upgrades from older versions (pre-v0.26.0), see the [legacy upgrade notes](/selfhosted/selfhosted-guide#upgrade). +## Upgrading Traefik and CrowdSec + +Traefik and CrowdSec have their own release cycles. Upgrading NetBird does not update their version tags or apply changes from newer installation scripts to your existing Compose file. Use your existing configuration for upgrades; rerunning `getting-started.sh` is not an upgrade procedure. + +### Choosing versions + +The following dependency versions have been validated for self-hosted NetBird as of **October 9, 2026**: + +| Component | Validated version | +| --- | --- | +| Bundled Traefik | `traefik:v3.7.14` | +| CrowdSec | `crowdsecurity/crowdsec:v1.8.1` | +| Traefik CrowdSec bouncer plugin | `v1.7.1` | + +Installer defaults can differ from these versions. Check the image tags in your `docker-compose.yml`; the bouncer plugin is configured separately in the [dashboard AppSec guide](/selfhosted/maintenance/crowdsec-dashboard#update-docker-compose-yml). Before adopting a newer release, review its migration requirements and verify it with your NetBird configuration in a test deployment. + +- **Traefik:** check the [releases](https://github.com/traefik/traefik/releases), [support policy](https://doc.traefik.io/traefik/deprecation/releases/), and [v3 migration notes](https://doc.traefik.io/traefik/migrate/v3/). Configuration changes can be required within the same major version. +- **CrowdSec:** check the [releases](https://github.com/crowdsecurity/crowdsec/releases) and [Docker documentation](https://docs.crowdsec.net/u/getting_started/installation/docker/). +- **Dashboard AppSec:** also check the [Traefik bouncer plugin releases](https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/releases). The plugin version is set by `--experimental.plugins.bouncer.version` in Traefik's `command:` list. Changing the CrowdSec image does not update it. + +You can subscribe to release notifications on each GitHub repository using **Watch → Custom → Releases**. Check security advisories and upstream support status as well as the installer defaults when planning updates. + +Full version tags such as `traefik:v3.7.14` and `crowdsecurity/crowdsec:v1.8.1` select specific releases. A minor-version tag such as `traefik:v3.6` can fetch a newer patch image without a Compose edit. For controlled rollouts, use full version tags for all images, or image digests when you need immutable references, and update them deliberately after validation. + +### Before changing a version + +1. Record the configured images and the images currently in use: + + ```bash + docker compose config --images + docker compose images + docker compose exec traefik traefik version + ``` + + If CrowdSec is enabled, also run: + + ```bash + docker compose exec crowdsec cscli version + ``` + + Record the current plugin version if you use dashboard AppSec. For each image, save its digest for rollback; use an image ID from `docker compose images`: + + ```bash + docker image inspect --format '{{json .RepoDigests}}' + ``` + +2. [Back up the deployment](/selfhosted/maintenance/backup), including the Compose file, environment files, Traefik dynamic configuration, CrowdSec configuration and database, and certificate volumes. If you enabled dashboard AppSec, also back up the Compose project `.env` file containing its bouncer key and the `crowdsec/acquis.d/` configuration. +3. Review release notes for every version you are skipping, then test the candidate versions with the [checks below](#verify-the-upgrade). Keep SSH access available independently of the dashboard and proxy while testing blocks or restarting services. + +### Apply the update + +Change one component at a time so you can identify regressions. Edit that service's `image:` in `docker-compose.yml` to the version or digest you selected, preserving its existing environment, labels, networks, and volume mounts. If the image is supplied through a Compose variable, update that variable instead. + +For Traefik, also check [header handling](#traefik-header-handling) and the [Docker network setting](#traefik-docker-network) before recreating the container. + +Validate the configuration before applying it: + +```bash +docker compose config --quiet +``` + +For CrowdSec, pull and recreate only its service: + +```bash +docker compose pull crowdsec +docker compose up -d --no-deps crowdsec +docker compose ps crowdsec +docker compose logs --tail=100 crowdsec +``` + +Confirm CrowdSec is healthy and repeat the blocking checks below before continuing. AppSec-protected requests can be denied while CrowdSec is unavailable. + +For Traefik, pull and recreate its service after editing its image: + +```bash +docker compose pull traefik +docker compose up -d --no-deps traefik +docker compose logs --tail=100 traefik +``` + +If you change only the bouncer plugin version, apply the updated Traefik `command:` with `docker compose up -d --no-deps traefik`. A plain `docker compose restart` does not apply Compose configuration changes. + +These restarts briefly interrupt the affected services. Preserve the existing CrowdSec database, bouncer keys, and certificate volumes; do not use `docker compose down -v` during an upgrade. + +### Verify the upgrade + +A running container alone does not confirm that routing, certificate issuance, or blocking works. Check the features enabled in your deployment: + +| Area | What to verify | +| --- | --- | +| Dashboard and peers | Sign in, load peers and policies, connect an existing peer, enroll a test peer, and verify peer connectivity and relay fallback. | +| Reverse proxy | Reach an existing service and create a test service. Exercise the protocols, authentication methods, and access restrictions you use, including HTTP, WebSockets, TCP/UDP/TLS services, and Traefik TLS passthrough where configured. | +| Certificates | Check trusted HTTPS on the dashboard and proxied domains without disabling certificate verification. Use a new test hostname to verify certificate issuance, and check ACME logs for failures. An existing valid certificate alone does not verify issuance or renewal; exercise renewal in the test deployment and monitor it after rollout. See [Certificate troubleshooting](/selfhosted/troubleshooting/certificates). | +| Client IPs | Confirm proxy access logs contain the original client IP, so IP restrictions and CrowdSec decisions apply to the correct address. | +| CrowdSec IP reputation | Follow [Testing the integration](/selfhosted/maintenance/crowdsec#testing-the-integration): confirm the bouncer syncs, a temporary decision blocks in enforce mode, observe mode allows and logs the verdict, and access returns after removing the decision. | +| Dashboard AppSec | If configured, repeat [Verify protection](/selfhosted/maintenance/crowdsec-dashboard#verify-protection) and [the middleware checks](/selfhosted/maintenance/crowdsec-dashboard#verifying-the-middleware-stays-attached). Normal dashboard and OIDC requests should succeed; `/.env` and `/api/.env` probes should return `403`, with AppSec metrics confirming inspection. Test dashboard IP blocking separately. | +| Persistence | Restart the updated services and repeat the checks. Confirm certificates, CrowdSec enrollment, bouncer authentication, and AppSec configuration survive the restart. | + +Record the exact image versions or digests, plugin version, and test results with your deployment configuration so the next upgrade has a known working starting point. + +### Roll back a dependency update + +Restore the previous image digest or full version tag and any configuration changed for that component, including the bouncer plugin version. Recreate the affected service with `docker compose up -d --no-deps ` and repeat the verification checks. Restoring a moving tag such as `v3.6` or `latest` may fetch the upgraded image again; use the recorded digest to recover the exact previous image. + +When rolling Traefik back to a release older than `v3.7.12`, also remove the `aliasHeadersStrategy` flags added in [Traefik header handling](#traefik-header-handling). Those releases do not recognize the option and fail to start with `field not found, node: aliasHeadersStrategy`. + + +Traefik v3.0.0 through v3.7.11 are affected by header-alias spoofing ([GHSA-rf44-j88r-hh8c](https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c)). Removing `aliasHeadersStrategy` so those releases can start restores that vulnerable handling: a client can send an alias of a header Traefik wrote, and a backend that treats those names as the same variable can read the client's value instead. Do not expose an affected rollback version to untrusted traffic. Return to `v3.7.12` or newer, with `aliasHeadersStrategy` set to `delete`, once service is restored. + + +If the release migrated stored data or configuration in a way the older version cannot read, stop the affected service and [restore its pre-upgrade backup](/selfhosted/maintenance/backup) before starting the older image. Changing an image tag does not undo a database migration. + ## Migration Notes +### Traefik header handling + +Traefik v3.7.12 introduced `aliasHeadersStrategy` and warns when it is unset. When upgrading to the validated `v3.7.14` version, add these settings to the existing `services.traefik.command` list in `docker-compose.yml`: + +```yaml + - '--entrypoints.web.http.aliasHeadersStrategy=delete' + - '--entrypoints.websecure.http.aliasHeadersStrategy=delete' +``` + +These settings apply to HTTP traffic on both entry points, whether or not CrowdSec is enabled. Replace any existing `underscoreHeadersStrategy` flags with these settings. The `delete` strategy helps prevent header spoofing by removing request headers whose names contain characters other than letters, digits, and hyphens. It also removes legitimate headers such as `X_Request_Id`, so check custom integrations before enabling it. See [Traefik's header handling documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#aliasheadersstrategy). + +### Traefik Docker network + +Some installer-generated Compose files set `--providers.docker.network=netbird`, while Compose creates a network named `_netbird`. Traefik then warns and falls back to another network. This usually works with one shared network but can select the wrong one when containers have several. + +Check the networks attached to the bundled Traefik container: + +```bash +docker inspect netbird-traefik --format '{{range $name, $_ := .NetworkSettings.Networks}}{{println $name}}{{end}}' +``` + +Replace the existing `--providers.docker.network` value with the shared network's actual name. For example, if the command prints `netbird_netbird`: + +```yaml + - '--providers.docker.network=netbird_netbird' +``` + +The name depends on the Compose project. An explicitly named network, such as `netbird` in the enterprise installer, does not receive a project prefix. Keep that name if it already matches. See [Docker's network naming documentation](https://docs.docker.com/reference/compose-file/networks/#name). + +After changing either Traefik setting, validate the Compose file and recreate Traefik: + +```bash +docker compose config --quiet +docker compose up -d --no-deps traefik +docker compose logs --tail=100 traefik +``` + ### Set `reverseProxy.trustedPeers` on older deployments Deployments created with the Quickstart script (or a marketplace image based on it, such as [Vultr](/selfhosted/marketplaces/vultr)) before **September 2026** are missing the `reverseProxy.trustedPeers` setting in the generated `config.yaml`. Without it, server versions up to v0.79 record your reverse proxy's address instead of the real client IP for each peer connection. Versions after v0.79 ([netbird#7589](https://github.com/netbirdio/netbird/pull/7589)) instead fall back to accepting forwarded client-IP headers from **any** source and log a spoofing warning at startup. diff --git a/src/pages/selfhosted/marketplaces/vultr.mdx b/src/pages/selfhosted/marketplaces/vultr.mdx index d64b092e..eb5440a7 100644 --- a/src/pages/selfhosted/marketplaces/vultr.mdx +++ b/src/pages/selfhosted/marketplaces/vultr.mdx @@ -72,15 +72,16 @@ The Vultr instance ships with a root password. Before relying on the deployment, ## Maintaining your deployment -The NetBird stack lives in **`/opt/netbird`** on the instance, including the `docker-compose.yml` and environment files. If the dashboard shows an **Update available** banner, SSH in and upgrade by pulling the latest images and restarting the containers: +The NetBird stack lives in **`/opt/netbird`** on the instance, including the `docker-compose.yml` and environment files. SSH in and run the [Upgrade guide](/selfhosted/maintenance/upgrade) from that directory, starting with a backup and release-note review: ```bash cd /opt/netbird -docker compose pull -docker compose up -d +docker compose config --images ``` -Refresh the dashboard and the banner should clear. See the [Upgrade guide](/selfhosted/maintenance/upgrade) for the full procedure, including migration notes and rollback steps. +The dashboard's **Update available** indicator covers NetBird components. Traefik, CrowdSec, and the optional dashboard AppSec plugin need separate update checks. Follow [Upgrading Traefik and CrowdSec](/selfhosted/maintenance/upgrade#upgrading-traefik-and-crowd-sec) for version selection, targeted updates, verification, and rollback. + +An updated marketplace image does not change an existing instance's Compose file or image tags. Maintain the running deployment with these steps rather than redeploying it from a newer image. ## Next steps diff --git a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx index e36ec9ab..ece375b2 100644 --- a/src/pages/selfhosted/migration/enable-reverse-proxy.mdx +++ b/src/pages/selfhosted/migration/enable-reverse-proxy.mdx @@ -358,7 +358,7 @@ Add the following service to your `docker-compose.yml`: ```yaml crowdsec: - image: crowdsecurity/crowdsec:v1.7.7 + image: crowdsecurity/crowdsec:v1.8.1 container_name: netbird-crowdsec restart: unless-stopped networks: [netbird] diff --git a/src/pages/selfhosted/selfhosted-quickstart.mdx b/src/pages/selfhosted/selfhosted-quickstart.mdx index 6fe8a936..a3b34215 100644 --- a/src/pages/selfhosted/selfhosted-quickstart.mdx +++ b/src/pages/selfhosted/selfhosted-quickstart.mdx @@ -193,6 +193,8 @@ NetBird includes built-in local user management powered by an embedded