sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-10-17 02:59:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add docs for profile ownership and IPC authz

Browse Source
This commit is contained in:
Theodor S. Midtlien
2026-09-25 16:18:52 +02:00
parent 0d44d0b7ba
commit e56f8ae3c0
8 changed files with 273 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/components/NavigationDocs.jsx
+1
View File
@@ -876,6 +876,7 @@ export const docsNavigation = [
links: [
{ title: 'Desktop App', href: '/client/desktop-app' },
{ title: 'Profiles', href: '/client/profiles' },
{ title: 'Profile Ownership', href: '/client/profile-ownership' },
{ title: 'gRPC Daemon Socket', href: '/client/grpc-socket' },
{ title: 'HTTP/JSON Daemon Socket', href: '/client/json-socket' },
{ title: 'Environment Variables', href: '/client/environment-variables' },
src/pages/client/environment-variables.mdx
+2
View File
@@ -145,6 +145,8 @@ These control the exponential backoff when the client loses its connection to th
| Variable | Platform | Description |
|---|---|---|
| `NB_DISABLE_PROFILE_OWNERSHIP` | Linux, macOS, Windows, FreeBSD | Set to `true` to turn off [profile ownership](/client/profile-ownership). All identified local users can use all profiles and control all connections. Use only on a device with one user or legacy use cases. |
| `NB_DISABLE_DEFAULT_PROFILE_CLAIM` | Linux, macOS, Windows, FreeBSD | Set to `true` to stop the [automatic claim](/client/profile-ownership#automatic-claims) of the default profile. The default profile then has no owner until an administrator runs `netbird profile claim`. |
| `NB_STATE_DIR` | All | Override the directory where the client stores persistent state files (config, state.json, WireGuard keys). Defaults to `/var/lib/netbird` on Linux/macOS, `/var/db/netbird` on FreeBSD, `%PROGRAMDATA%\Netbird` on Windows. |
| `NB_DNS_STATE_FILE` | All | Override the path to the client state file (`state.json`). Despite the name, this is not DNS-specific: it stores all shutdown/recovery state including DNS settings, SSH config, routes, and auto-update progress. The default path is per-profile (e.g. `/var/lib/netbird/state.json` for the default profile). Setting this bypasses per-profile state isolation. Primarily used by the embedded client API (`embed.Options.StatePath`). |
| `NB_ROSENPASS_LOG_LEVEL` | All | Log level for the Rosenpass post-quantum key exchange subprocess. Accepted values: `debug`, `info`, `warn`, `error` (default: `info`). Separate from the main client log level. |
src/pages/client/grpc-socket.mdx
+34 -48
View File
@@ -33,13 +33,12 @@ migrated from `tcp://127.0.0.1:41731` automatically.
<Warning>
**Security warning:** The default Unix socket allows read and write access for
local users, so any local user can read status and configuration and perform
operations that do not require privileges. Operations that decide who may
obtain a shell on the machine are refused unless the caller is root, or an
administrator on Windows: see [Privileged
operations](#privileged-operations). If you require local-user isolation
beyond that, place a custom socket inside a restricted directory and ensure
that the directory is recreated securely at boot.
local users. Each local user can read basic status and use the profiles that
they own. Operations that decide who may obtain a shell on the machine are
refused unless the caller is root, or an administrator on Windows: see
[Privileged operations](#privileged-operations). To let only one group connect,
see [Restrict daemon access to a
group](/client/profile-ownership#restrict-daemon-access-to-a-group).
</Warning>
On Linux installations that use an instance-specific systemd service, the socket can instead be under `/var/run/netbird/<instance>.sock`. The NetBird CLI automatically uses the only socket in that directory when the default socket does not exist. If multiple instance sockets exist, pass the intended address explicitly with `--daemon-addr`.
@@ -56,10 +55,11 @@ Use the global `--daemon-addr` option when installing or reconfiguring the servi
```text
unix:///path/to/netbird.sock
tcp://host:port
npipe://name
```
The `tcp://host:port` format is deprecated. See [TCP sockets (deprecated)](#tcp-sockets-deprecated).
<Warning>
**Connectivity warning:** Reconfiguring the service restarts NetBird and can
briefly interrupt tunnel connectivity, routes, and DNS.
@@ -86,31 +86,24 @@ netbird --daemon-addr unix:///var/run/netbird-integration-grpc.sock status
instead. Do not pass an HTTP/JSON socket to `--daemon-addr`.
</Note>
### Use a TCP Socket
```shell
sudo netbird service reconfigure \
--daemon-addr tcp://127.0.0.1:41731
```
Then specify that address when using the CLI on platforms where it is not the default:
```shell
netbird --daemon-addr tcp://127.0.0.1:41731 status
```
### TCP Sockets (Deprecated)
<Warning>
**Security warning:** The daemon gRPC server does not add authentication or
TLS. Keep TCP listeners bound to a trusted interface such as `127.0.0.1` and
do not expose them to an untrusted network. The API includes operations that
can read or change the local NetBird daemon's state.
A TCP connection also carries no caller identity, so the daemon cannot tell
who is calling and refuses every [privileged
operation](#privileged-operations) on that socket, whoever runs the client.
Use a Unix socket, or `npipe://` on Windows, if your integration needs them.
TCP sockets are deprecated. A future release removes them.
</Warning>
A TCP connection does not carry a caller identity. The daemon cannot identify the
caller, so it refuses every request on a TCP socket. Use a Unix socket on Linux and
macOS, or a named pipe on Windows.
If your service uses a TCP socket, change it to the default address:
```shell
sudo netbird service reconfigure --daemon-addr unix:///var/run/netbird.sock
```
On Windows, use `--daemon-addr npipe://netbird`.
## Privileged Operations
On the default sockets any local user can connect, so the daemon authorizes operations
@@ -118,6 +111,11 @@ by the identity of whoever calls it, read from the kernel rather than supplied b
the client: `SO_PEERCRED` on Linux, `LOCAL_PEERCRED` on macOS, and the named-pipe
client token on Windows. A caller whose identity cannot be established is refused.
Most operations also require the caller to own the profile, or to hold the active
connection. See [Profile ownership and daemon access](/client/profile-ownership). To let
only one group connect to the socket, see [Restrict daemon access to a
group](/client/profile-ownership#restrict-daemon-access-to-a-group).
Since 0.76.0 the following require root, or an administrator on Windows, because
they decide who may obtain a shell on the machine:
@@ -232,22 +230,10 @@ grpcurl \
daemon.DaemonService/Status
```
### Query Status Through a TCP Socket
### Query Status on Windows
This applies to a custom loopback TCP listener, since `grpcurl` cannot dial a
Windows named pipe and the Windows default is therefore not reachable this way. Use
a client that can open the pipe, or configure a TCP listener for testing and accept
that [privileged operations](#privileged-operations) are refused on it:
```shell
grpcurl \
-plaintext \
-import-path ./client/proto \
-proto daemon.proto \
-d '{}' \
127.0.0.1:41731 \
daemon.DaemonService/Status
```
`grpcurl` cannot connect to a Windows named pipe. Use a client that can open a named
pipe. Do not use a TCP socket, because the daemon refuses every request on it.
`-plaintext` is required because the local daemon socket does not use TLS. For a Unix socket, pass the full `unix:///...` URI and include `-unix`. The URI form also avoids a Unix-socket regression in some `grpcurl` 1.9.x builds.
@@ -274,7 +260,7 @@ For a long-running integration, generate a gRPC client from the same `daemon.pro
1. Download or vendor `client/proto/daemon.proto` from the NetBird repository.
2. Generate client bindings with the Protocol Buffer and gRPC tools for your language.
3. Create a local gRPC channel to the configured Unix or TCP address without TLS. That does not make the socket safe to expose remotely.
3. Create a local gRPC channel to the configured Unix socket or named pipe without TLS.
4. Create a `daemon.DaemonService` client from that channel.
5. Call unary methods or consume server streams using the generated request and response types.
@@ -300,7 +286,7 @@ This is expected. Supply `daemon.proto` with your tool's equivalent of the `grpc
### A Client Receives an Unavailable or Connection-Refused Error
Confirm that the daemon is running and that the integration uses the same socket address as the service. For a Unix socket, also verify access to the socket and each parent directory. For TCP, verify the host and port and ensure the listener remains bound to a trusted interface.
Confirm that the daemon is running and that the integration uses the same socket address as the service. For a Unix socket, also verify access to the socket and each parent directory. If the address uses `tcp://`, change it to a Unix socket or a named pipe. The daemon refuses every request on a TCP socket.
### A Call Is Refused With PermissionDenied
@@ -308,8 +294,8 @@ The operation is one of the [privileged operations](#privileged-operations) and
caller is not root, or not an administrator on Windows. Check the `ErrorInfo` detail
on the error: `PRIVILEGE_REQUIRED` in domain `daemon.netbird.io` means the daemon
identified the caller and refused the change, rather than failing to reach it. On a
TCP socket every such operation is refused, because the transport carries no caller
identity.
TCP socket the daemon refuses every request, because TCP carries no caller identity.
TCP sockets are deprecated.
### A Method or Field Is Unimplemented
src/pages/client/json-socket.mdx
+8 -36
View File
@@ -87,28 +87,15 @@ curl --silent --show-error \
http://localhost/daemon.DaemonService/Status
```
### Use a TCP Socket
Pass an address with the `tcp://` scheme to expose the gateway over TCP:
```shell
sudo netbird service reconfigure \
--enable-json-socket \
--json-socket tcp://127.0.0.1:8080
```
### TCP Sockets (Deprecated)
<Warning>
**Security warning:** The gateway does not add authentication or TLS. Keep TCP
listeners bound to a trusted interface such as `127.0.0.1` and do not expose
them to an untrusted network. The API includes operations that can read or
change the local NetBird daemon's state.
A TCP connection carries no caller identity, so the gateway cannot tell who is
calling and every
[privileged operation](/client/grpc-socket#privileged-operations) is refused on
such a socket, whoever runs the client.
TCP sockets are deprecated. A future release removes them.
</Warning>
A TCP connection does not carry a caller identity. The daemon cannot identify the
caller, so it refuses every request on a TCP socket. Use a Unix socket.
To disable the gateway again, run:
```shell
@@ -150,19 +137,6 @@ The response is a JSON representation of the daemon's status response. For examp
The exact fields and values depend on the client version and current connection state.
### Query Status Through a TCP Socket
If the gateway is listening on `tcp://127.0.0.1:8080`, use a normal HTTP request:
```shell
curl --silent --show-error \
--request POST \
--header 'Content-Type: application/json' \
--data '{}' \
--write-out '\n' \
http://127.0.0.1:8080/daemon.DaemonService/Status
```
### Call the API from an Integration
The following Python example calls the status endpoint over a Unix socket using only the standard library:
@@ -200,8 +174,6 @@ print(status["status"])
connection.close()
```
For a TCP listener, any standard HTTP client can call the same path and JSON body without Unix-socket support.
## Map gRPC Methods to HTTP
The gateway exposes every method in `daemon.DaemonService`, and every endpoint uses
@@ -260,8 +232,8 @@ The operation is one of the
client is not root, or not an administrator on Windows. The response body carries a
`PRIVILEGE_REQUIRED` detail in domain `daemon.netbird.io`, with a summary and the
command that performs the same operation with the privileges it needs. On a TCP
gateway socket these operations are always refused.
gateway socket the daemon refuses every request.
### A TCP Request Cannot Connect
### A TCP Request Is Refused
Confirm that the host and port in the request match the value passed to `--json-socket`. Prefer `127.0.0.1` over `0.0.0.0` unless remote access is explicitly required and protected by an additional security boundary.
TCP sockets are deprecated, and the daemon refuses every request on them. Change `--json-socket` to a Unix socket. See [TCP sockets (deprecated)](#tcp-sockets-deprecated).
src/pages/client/mdm-integration.mdx
+2 -1
View File
@@ -60,7 +60,7 @@ stale residue on the device.
## Policy keys reference
The same 20 keys apply on every platform. Names are camelCase in the
The same 21 keys apply on every platform. Names are camelCase in the
managed-configuration payload; the Windows ADMX template renders the
PascalCase variant in the Group Policy Editor — both are recognized.
@@ -86,6 +86,7 @@ PascalCase variant in the Group Policy Editor — both are recognized.
| `disableNetworks` | boolean | Hide the Networks / Exit Node menus in the GUI and reject the related RPCs. |
| `enableLocalMetrics` | boolean | Expose the client's [local Prometheus `/metrics` endpoint](/client/local-metrics). |
| `localMetricsAddress` | string | Listen address of the local `/metrics` endpoint (default `127.0.0.1:9191`). |
| `allowGroups` | string | Let only the listed groups connect to the daemon socket. Overrides `--allow-group`. An empty value removes the restriction. On macOS, set one `gid:<id>` value. On Windows, set comma-separated `sid:<SID>` values. See [Restrict daemon access to a group](/client/profile-ownership#restrict-daemon-access-to-a-group). |
| `splitTunnelMode` | string | `allow` or `disallow` — split-tunnel policy mode (Android only at the client level; harmless on desktop). |
| `splitTunnelApps` | string | Comma-separated list of package names that the split-tunnel mode applies to (Android only). |
src/pages/client/profile-ownership.mdx
+209
View File
@@ -0,0 +1,209 @@
import { Note, Warning } from '@/components/mdx'
export const description =
'How the NetBird daemon authorizes local users, how profile ownership works, and how to restrict daemon access.'
# Profile ownership and daemon access
The NetBird daemon runs as root, or as LocalSystem on Windows. Each local user can connect to its socket. Without a check, one user can read or change the profile of another user, or stop that user's connection.
To prevent this, the daemon identifies each caller and gives each profile an owner. A user can use only the profiles that they own. A connection belongs to the user who started it.
## How the daemon identifies a caller
The daemon gets the identity of the caller from the operating system, not from the request. If the daemon cannot identify the caller, it refuses the request.
A TCP socket does not carry an identity, so the daemon refuses every request on it. TCP sockets are deprecated. For more information, see [TCP sockets (deprecated)](/client/grpc-socket#tcp-sockets-deprecated).
## Access levels
The daemon gives each request one of four access levels. Each level can do all the operations of the levels above it in this table.
| Level | Who | Operations |
| --- | --- | --- |
| Identified | Any user that the daemon can identify | Read basic status. List your profiles. Add a profile. |
| Profile owner | The owner of the profile | Read and change the profile configuration. Rename, remove, or deregister the profile. |
| Session holder | The owner of the active profile and the connection is up | Disconnect. Log in. Switch profiles. Select networks. Read detailed status. Create a debug bundle. |
| Privileged | Root, an elevated administrator, or the user that the daemon runs as | All operations on all profiles. Claim a profile. |
The daemon lets the user that it runs as act as a privileged user only when the daemon itself is not privileged. An example is a rootless container.
## Profile ownership
Each profile records one owner. On Linux and macOS, the owner is a user ID, for example `uid:1000`. On Windows, the owner is a security identifier (SID), for example `sid:S-1-5-21-...`.
When you add a profile, you become its owner. Root and administrators can see and use all profiles.
<Warning>
If you add a profile with `sudo`, root becomes the owner. Run `netbird profile add` as your own user.
</Warning>
### Commands and required access
| Command | Required level |
| --- | --- |
| `netbird status` | Identified. Detailed status requires session holder. |
| `netbird profile list`, `netbird profile add` | Identified |
| `netbird profile rename`, `netbird profile remove`, `netbird deregister` | Profile owner |
| `netbird up`, `netbird down`, `netbird login`, `netbird profile select` | Session holder |
| `netbird debug bundle` | Session holder |
| `netbird profile claim` | Privileged |
`netbird profile list` shows only the profiles that you own. To show the owner of each profile, add `--show-owner`:
```shell
sudo netbird profile list --show-owner
```
```text
NAME ACTIVE OWNER
default * alice
work bob
lab unowned
```
### Connections of other users
When a user connects, the active profile and its connection belong to that user. Other users cannot connect, disconnect, or switch profiles until the connection stops. To stop the connection of another user, run:
```shell
sudo netbird down
```
### Claim a profile
To give a profile an owner, run `netbird profile claim` as root or as an administrator:
```shell
sudo netbird profile claim <profile> --owner <owner>
```
The `<owner>` value is an account name, a `uid:<id>` value, or a `sid:<SID>` value. The daemon does not check that a `uid` or `sid` value belongs to an existing account.
On Linux and macOS, if you do not set `--owner`, the owner is the user who ran `sudo`. If you run the command in a root shell without `sudo`, `--owner` is required. On Windows, `--owner` is required.
## Restrict daemon access to a group
By default, all local users can connect to the daemon socket. To let only one group connect, set `--allow-group` when you install the service:
```shell
sudo netbird service install --allow-group netbird-users
```
The operating system then refuses connections from users outside the group. This restriction also applies to the [HTTP/JSON daemon socket](/client/json-socket).
- On Linux and macOS, you can set only one group. The value is a group name or a group ID.
- On Windows, you can set a comma-separated list of groups or accounts. LocalSystem, elevated administrators, and the account that the daemon runs as always keep access.
- The installer resolves group names to IDs, including LDAP, SSSD, and Active Directory groups. If a name does not resolve, the installation stops.
- `netbird service reconfigure` resolves the names again.
- To remove the restriction, run `sudo netbird service reconfigure --allow-group ""`.
<Note>
A TCP socket cannot carry the restriction. If you set `--allow-group` for a daemon on a TCP socket, the daemon does not start.
</Note>
### Set allowed groups with MDM
On managed Windows and macOS devices, use the `allowGroups` [MDM policy key](/client/mdm-integration). On Windows, the Group Policy name is **Restrict the daemon sockets**.
- The MDM value replaces the `--allow-group` value. An empty value removes a restriction that the installer set.
- On macOS, set exactly one group ID, for example `gid:1001`.
- On Windows, set a comma-separated list of SIDs, for example `sid:S-1-5-21-...`.
- Use IDs, not names. The daemon reads this value when it starts. It waits a maximum of 5 seconds to resolve names.
<Warning>
If the daemon cannot read the MDM policy or resolve the value, it does not start. This behavior prevents an open socket on a device that must be restricted.
</Warning>
## Environment variables
Set these variables on the daemon. For instructions, see [Client environment variables](/client/environment-variables#setting-environment-variables).
| Variable | Description |
| --- | --- |
| `NB_DISABLE_PROFILE_OWNERSHIP` | Set to `true` to turn off profile ownership. All identified users can use all profiles and control all connections. Android and iOS always work this way. |
| `NB_DISABLE_DEFAULT_PROFILE_CLAIM` | Set to `true` to stop the automatic claim of the default profile. The default profile then has no owner until an administrator claims it. |
<Warning>
`NB_DISABLE_PROFILE_OWNERSHIP` removes the isolation between local users. Use it only on a device with one user.
</Warning>
## Upgrade from an earlier version
Earlier versions kept profiles in one directory for each user, for example `/var/lib/netbird/<username>/`, and recorded no owner. When the new daemon starts for the first time, it migrates these profiles. Your profiles stay in their directories.
The migration does these steps:
1. Gives a new unique ID to profiles that have the same ID in different user directories.
2. Records the owner of the profiles of the last active user and of the default profile.
3. Creates the `profiles.v1` directory in the state directory. This directory shows that the migration is complete.
If the migration fails, the daemon writes the error to the log and tries again at the next start. The daemon saves new profiles in the `profiles.v1` directory.
### Automatic claims
After the migration, some profiles can still have no owner. The daemon gives them an owner when a user sends a request:
- **Profiles in a user directory.** The daemon records the user whose name matches the directory as the owner.
- **Default profile.** The daemon records the first user who is logged in at the console of the device as the owner. A console is a local graphical session, or a local seat on Linux. A user in a remote SSH session is not at the console.
Root and administrators never become owners through an automatic claim.
On a device with no console, for example a server, the default profile keeps no owner. To give it an owner, run:
```shell
sudo netbird profile claim default --owner <owner>
```
## Troubleshooting
### Another user has this machine connected
**Symptom:** A command fails with a message that says another user has the machine connected.
**Cause:** Another user started the current connection.
**Fix:** Ask that user to disconnect, or run `sudo netbird down`.
### The profile belongs to another user
**Symptom:** A command fails with a message that says the profile belongs to another user.
**Cause:** You do not own the profile.
**Fix:** Use a profile that you own. Or, ask an administrator to run `sudo netbird profile claim <profile> --owner <your-user>`.
### The profile has no owner on record
**Symptom:** A command fails with a message that says the profile has no owner on record.
**Cause:** The profile was not claimed. This is usual on a device with no console, or when you connect over SSH.
**Fix:** Run the `netbird profile claim` command that the error message shows.
### A profile is missing from the profile list
**Cause:** `netbird profile list` shows only the profiles that you own.
**Fix:** To see all profiles and their owners, run `sudo netbird profile list --show-owner`.
### Detailed status is unavailable
**Symptom:** `netbird status` shows `Detailed status is unavailable: the connection belongs to another user.`
**Cause:** Another user holds the connection. You can see only the daemon status.
### The daemon does not start after you set allowed groups
**Possible causes:**
- A group name does not resolve.
- You set more than one group on Linux or macOS.
- The daemon or the JSON socket uses a TCP socket.
- The daemon cannot read the MDM policy.
**Fix:** Read the daemon log. The log shows which of these causes stopped the daemon.
### Collect information for support
A debug bundle includes `profiles.txt` and `active_profile.json`. These files show each profile, its owner, and the active profile. For instructions, see [Troubleshooting client issues](/help/troubleshooting-client).
src/pages/client/profiles.mdx
+15 -8
View File
@@ -56,13 +56,17 @@ Each profile has two parts:
The `default` profile is special: its ID is always `default`. You can rename its display label,
but it keeps that reserved ID and cannot be removed.
The default profile is stored as `default.json` in NetBird's state directory. Additional service profiles are stored under a per-user subdirectory as `<id>.json`:
The default profile is stored as `default.json` in NetBird's state directory. New profiles are stored in the `profiles.v1` subdirectory as `<id>.json`:
| OS | Default state directory | Additional profile example |
| --- | --- | --- |
| Linux and macOS | `/var/lib/netbird/` | `/var/lib/netbird/<username>/<id>.json` |
| FreeBSD | `/var/db/netbird/` | `/var/db/netbird/<username>/<id>.json` |
| Windows | `%ProgramData%\Netbird\` | `%ProgramData%\Netbird\<username>\<id>.json` |
| Linux and macOS | `/var/lib/netbird/` | `/var/lib/netbird/profiles.v1/<id>.json` |
| FreeBSD | `/var/db/netbird/` | `/var/db/netbird/profiles.v1/<id>.json` |
| Windows | `%ProgramData%\Netbird\` | `%ProgramData%\Netbird\profiles.v1\<id>.json` |
Profiles from earlier versions stay in their per-user subdirectory, for example `/var/lib/netbird/<username>/<id>.json`.
Each profile has an owner, and only the owner can use it. See [Profile ownership and daemon access](/client/profile-ownership).
`NB_STATE_DIR` overrides the default state directory. Treat profile files as credentials: stop the service before manual maintenance, restrict access, and prefer the GUI or CLI for normal profile management.
@@ -124,7 +128,7 @@ When profiles are disabled:
With the CLI, you can manage profiles easily. The main command is:
```bash
netbird profile <add|list|select|rename|remove> [name|handle]
netbird profile <add|list|select|rename|remove|claim> [name|handle]
````
<Note>
@@ -210,12 +214,12 @@ For example, running this command might output:
```text
NAME ACTIVE
work ✓
work *
default
home
```
A **✓** in the `ACTIVE` column marks the active profile; inactive profiles are left blank.
The list shows only the profiles that you own. A `*` in the `ACTIVE` column marks the active profile; inactive profiles are left blank.
To also show each profile's short ID, add the `--show-id` flag:
@@ -225,7 +229,7 @@ netbird profile list --show-id
```text
ID NAME ACTIVE
a1b2c3d4 work ✓
a1b2c3d4 work *
default default
e5f6a7b8 home
```
@@ -233,6 +237,9 @@ e5f6a7b8 home
This is useful when several profiles share the same name. The ID column lets you tell them
apart and select or remove the right one by its ID prefix.
To show the owner of each profile, add `--show-owner`. To claim a profile for a user, see
[Claim a profile](/client/profile-ownership#claim-a-profile).
### Select (Switch) a Profile
To switch to a specific profile, use:
src/pages/get-started/cli.mdx
+2 -2
View File
@@ -42,7 +42,7 @@ Below is the list of global flags:
--admin-url string Admin Panel URL [http|https]://[host]:[port] (default "https://app.netbird.io:443")
-A, --anonymize anonymize IP addresses and non-netbird.io domains in logs and status output
-c, --config string Overrides the default profile file location. Deprecated on `up` and `login`; use `--service-env NB_CONFIG=<path>` instead.
--daemon-addr string Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name] (default "unix:///var/run/netbird.sock", "npipe://netbird" on Windows)
--daemon-addr string Daemon service address to serve CLI requests [unix|npipe]://[path|name]. tcp://host:port is deprecated: it carries no caller identity, so the daemon refuses every request on it (default "unix:///var/run/netbird.sock", "npipe://netbird" on Windows)
-n, --hostname string Sets a custom hostname for the device
--log-file console Sets NetBird log paths written to simultaneously. If "console" is specified the log will be output to stdout. If "syslog" is specified the log will be sent to the syslog daemon. You can pass the flag multiple times or separate entries by comma (default [/var/log/netbird/client.log])
-l, --log-level string Sets NetBird log level (default "info")
@@ -78,7 +78,7 @@ export NB_DISABLE_UPDATE_SETTINGS=true
export NB_LOG_LEVEL=debug
# Set custom daemon address
export NB_DAEMON_ADDR="tcp://localhost:8080"
export NB_DAEMON_ADDR="unix:///var/run/netbird.sock"
```
Beyond flag-derived variables, the client also supports a number of advanced environment variables for tuning networking, firewall, ICE connectivity, and more. See the [Client Environment Variables](/client/environment-variables) reference for the full list.