diff --git a/public/docs-static/img/how-to-guides/add-setup-key.png b/public/docs-static/img/how-to-guides/add-setup-key.png
index 2e35be03..79dae790 100644
Binary files a/public/docs-static/img/how-to-guides/add-setup-key.png and b/public/docs-static/img/how-to-guides/add-setup-key.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-01.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-01.png
new file mode 100644
index 00000000..e738730d
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-01.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-02.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-02.png
new file mode 100644
index 00000000..fc6a4e01
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-02.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-03.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-03.png
new file mode 100644
index 00000000..41d5be04
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-03.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-04.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-04.png
new file mode 100644
index 00000000..58d77099
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-04.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-05.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-05.png
new file mode 100644
index 00000000..0e55e91c
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-05.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-06.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-06.png
new file mode 100644
index 00000000..a901bf40
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-06.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-07.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-07.png
new file mode 100644
index 00000000..e17c8d1a
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-07.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-08.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-08.png
new file mode 100644
index 00000000..06d3e030
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-08.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-09.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-09.png
new file mode 100644
index 00000000..c9703ab9
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-09.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-10.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-10.png
new file mode 100644
index 00000000..a222ae7c
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-10.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-11.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-11.png
new file mode 100644
index 00000000..4173f170
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-11.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-12.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-12.png
new file mode 100644
index 00000000..98a20cab
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-12.png differ
diff --git a/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-13.png b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-13.png
new file mode 100644
index 00000000..0143737b
Binary files /dev/null and b/public/docs-static/img/how-to-guides/deploying-netbird-with-intune/intune-13.png differ
diff --git a/public/docs-static/img/troubleshooting-client/ui-bundle-success.png b/public/docs-static/img/troubleshooting-client/ui-bundle-success.png
new file mode 100644
index 00000000..b8fe6c05
Binary files /dev/null and b/public/docs-static/img/troubleshooting-client/ui-bundle-success.png differ
diff --git a/public/docs-static/img/troubleshooting-client/ui-bundle-wizard.png b/public/docs-static/img/troubleshooting-client/ui-bundle-wizard.png
new file mode 100644
index 00000000..1ca94e6c
Binary files /dev/null and b/public/docs-static/img/troubleshooting-client/ui-bundle-wizard.png differ
diff --git a/public/docs-static/img/troubleshooting-client/ui-settings.png b/public/docs-static/img/troubleshooting-client/ui-settings.png
new file mode 100644
index 00000000..31384fb2
Binary files /dev/null and b/public/docs-static/img/troubleshooting-client/ui-settings.png differ
diff --git a/src/components/GoogleTagManager.jsx b/src/components/GoogleTagManager.jsx
new file mode 100644
index 00000000..3d32abe7
--- /dev/null
+++ b/src/components/GoogleTagManager.jsx
@@ -0,0 +1,31 @@
+import * as React from "react";
+import Script from "next/script";
+
+// Google Tag Manager ID
+const GTM_ID = "GTM-PGWDPDN3";
+
+export const GoogleTagManagerHeadScript = () => {
+ return (
+
+ );
+};
+
+export const GoogleTageManagerBodyScript = () => {
+ return (
+
+ );
+};
diff --git a/src/pages/_document.jsx b/src/pages/_document.jsx
index b3493318..25d8d20a 100644
--- a/src/pages/_document.jsx
+++ b/src/pages/_document.jsx
@@ -1,4 +1,5 @@
import { Head, Html, Main, NextScript } from 'next/document'
+import {GoogleTageManagerBodyScript, GoogleTagManagerHeadScript} from "@/components/GoogleTagManager";
const modeScript = `
let darkModeMediaQuery = window.matchMedia('(prefers-color-scheme: dark)')
@@ -39,10 +40,12 @@ export default function Document() {
return (
-
+
+
+
diff --git a/src/pages/about-netbird/how-netbird-works.mdx b/src/pages/about-netbird/how-netbird-works.mdx
index e1d22f33..b5079b11 100644
--- a/src/pages/about-netbird/how-netbird-works.mdx
+++ b/src/pages/about-netbird/how-netbird-works.mdx
@@ -113,8 +113,7 @@ It runs in the cloud NetBird-managed and can be self-hosted.
The Relay service is a [TURN server](https://webrtc.org/getting-started/turn-server) in WebRTC terminology.
In fact, we use an open-source implementation called [Coturn](https://github.com/coturn/coturn).
-The purpose of this service is to be a "plan B" and relay traffic between peers in case a point-to-point connection isn't possible.
-
+The purpose of this service is to be a "plan B" and relay traffic between peers in case a point-to-point connection isn't possible. However starting with v0.29.0 a new relay based on WebSocket is implemented, moving away from TURN relay (coturn). [More info](https://netbird.io/knowledge-hub/september-newsletter).
diff --git a/src/pages/how-to/add-users-to-your-network.mdx b/src/pages/how-to/add-users-to-your-network.mdx
index 2e7d7b03..09b87658 100644
--- a/src/pages/how-to/add-users-to-your-network.mdx
+++ b/src/pages/how-to/add-users-to-your-network.mdx
@@ -60,12 +60,31 @@ button.
See the [Provision Users and Groups From Your Identity Provider](/how-to/idp-sync) section for more details.
## Manage user roles
-NetBird has three user roles - `Owner`, `Admin`, and `User`. The roles allow you to control the level of access to the management API of your account.
+NetBird has five user roles - `Owner`, `Admin`, `Network Admin`, `Auditor` and `User`. The roles allow you to control the level of access to the management API of your account.
- `Owner` role - has full access to the account and can manage all aspects of the account. There can be only one account owner in NetBird. Users with the owner role can delete their organization account. See the [Delete NetBird account](/how-to/delete-account) section for more.
- `Admin` role - has full access to the account except that administrators can't delete or update the role of the Owner user and delete the organization account.
+- `Network Admin` role - has access to manage network configurations, including access policies, DNS settings, networks, and network routes, but they can only view user and device information and general settings.
+- `Auditor` role - can read all configurations but not modify any of them.
- `User` role - has limited access to the account, allowing users to view peers they own and others they can connect to. Users can create personal access tokens for programmatic access.
+| | Owner | Admin | Network Admin | User | Auditor |
+| --: | :--: | :--: | :--: | :--: | :--: |
+| Peers | β | β | π | π | π |
+| Setup Keys | β | β | π | β | π |
+| Access Control | β | β | β | β | π |
+| Networks | β | β | β | β | π |
+| Network Routes | β | β | β | β | π |
+| DNS | β | β | β | β | π |
+| Team | β | β | π | β | π |
+| Activity | β | β | π | β | π |
+| Settings | β | β | π | β | π |
+
+| |
+|-:|
+|β = Full access \| π = Read only \| β = No access|
+
+
To manage user roles, proceed to the `Users` tab and click on the user you want to update:
@@ -78,6 +97,7 @@ Click the `Save` button to save the changes.
Only users with the `Owner` role can assign another user as `Owner`; this action will transfer the `Owner` role to another user, making the current user `Admin`.
+
## Get started
diff --git a/src/pages/how-to/cli.mdx b/src/pages/how-to/cli.mdx
index dd5e2a36..76118c08 100644
--- a/src/pages/how-to/cli.mdx
+++ b/src/pages/how-to/cli.mdx
@@ -60,6 +60,7 @@ The command will check if the peer is logged in and connect to the management se
--dns-resolver-address string Sets a custom address for NetBird's local DNS resolver. If set, the agent won't attempt to discover the best ip and port to listen on. An empty string "" clears the previous configuration. E.g. --dns-resolver-address 127.0.0.1:5053 or --dns-resolver-address ""
--enable-rosenpass [Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.
--external-ip-map strings Sets external IPs maps between local addresses and interfaces.You can specify a comma-separated list with a single IP and IP/IP or IP/Interface Name. An empty string "" clears the previous configuration. E.g. --external-ip-map 12.34.56.78/10.0.0.1 or --external-ip-map 12.34.56.200,12.34.56.78/10.0.0.1,12.34.56.80/eth1 or --external-ip-map ""
+ --extra-dns-labels strings Sets DNS labels. You can specify a comma-separated list of up to 32 labels. An empty string "" clears the previous configuration. E.g. --extra-dns-labels vpc1 or --extra-dns-labels vpc1,mgmt1 or --extra-dns-labels ""
-F, --foreground-mode start service in foreground
-h, --help help for up
--interface-name string Wireguard interface name (default "utun100")
@@ -86,6 +87,14 @@ In case you need to use a setup key, use the `--setup-key` flag :
```shell
netbird up --setup-key AAAA-BBB-CCC-DDDDDD
```
+You can set extra DNS labels with the `--extra-dns-labels` flag:
+```shell
+netbird up --setup-key AAAA-BBB-CCC-DDDDDD --extra-dns-labels vpc1,mgmt1
+```
+
+ This feature requires a setup-key with permissions to add peers with the extra labels.
+
+Multiple peers with the same extra labels will generate grouped DNS labels on the client side, and this feature can be used for DNS round-robing load balancing.
### login
Command to authenticate the NetBird client to a management service. If the peer is not logged in, by default, it will attempt to initiate an SSO login flow.
diff --git a/src/pages/how-to/kubernetes-operator.mdx b/src/pages/how-to/kubernetes-operator.mdx
index 22f4cb85..fd709315 100644
--- a/src/pages/how-to/kubernetes-operator.mdx
+++ b/src/pages/how-to/kubernetes-operator.mdx
@@ -16,13 +16,10 @@ seamlessly access your Kubernetes services and control plane from your NetBird n
- Access to a Kubernetes v1.11.3+ cluster.
- (Recommended) Cert Manager.
-### Installation
-You have two methods of installing the NetBird Kubernetes operator: using Helm or the install.yaml file.
-
#### Using Helm
1. Add helm repository.
```shell
-helm repo add netbirdio https://netbirdio.github.io/kubernetes-operator
+helm repo add netbirdio https://netbirdio.github.io/helms
```
2. (Recommended) Install [cert-manager](https://cert-manager.io/docs/installation/#default-static-install) for k8s API to communicate with the NetBird operator.
```shell
@@ -77,16 +74,6 @@ The configuration or version update of the operator can be done with `helm upgra
helm upgrade --create-namespace -f values.yaml -n netbird netbird-operator netbirdio/kubernetes-operator
```
-#### Using install.yaml
-
-install.yaml only includes a very basic template for deploying a stripped-down version of Kubernetes-operator.
-This option does not include any configurations for ingress capabilities and requires the cert-manager to be installed.
-
-
-```shell
-kubectl create namespace netbird
-kubectl apply -n netbird -f https://raw.githubusercontent.com/netbirdio/kubernetes-operator/refs/heads/main/manifests/install.yaml
-```
## Expose Kubernetes Control Plane to your NetBird Network
To access your Kubernetes control plane from a NetBird network, you can expose your Kubernetes control plane as a
[NetBird resource](/how-to/networks#resources) by enabling the following option in the operator values:
@@ -231,6 +218,38 @@ The operator will create a policy in your management account similar to the one
You can reference multiple policy bases using a comma separated list of policy bases: `netbird.io/policy: "app-users,app-admins"`
+### Policy auto-creation
+
+1. Ensure `ingress.allowAutomaticPolicyCreation` is set to true in the Helm chart and apply.
+2. Annotate a service with `netbird.io/policy` with the name of the policy as a kubernetes object, for example `netbird.io/policy: default`. This will create an NBPolicy with the name `default--`.
+3. Annotate the same service with `netbird.io/policy-source-groups` with a comma-separated list of group names to allow as a source, for example `netbird.io/policy-source-groups: dev`.
+4. (Optional) Annotate the service with `netbird.io/policy-name` for a human-friendly name, for example `netbird.io/policy-name: "default:Default policy for kubernetes cluster"`.
+Example:
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+ name: app
+ annotations:
+ netbird.io/expose: "true"
+ netbird.io/groups: "app-access"
+ netbird.io/policy: "app-users"
+ netbird.io/policy-source-groups: "dev"
+ netbird.io/policy-name: "dev:Developers to app"
+spec:
+ selector:
+ app: app
+ ports:
+ - protocol: TCP
+ port: 8080
+ targetPort: 80
+ type: ClusterIP
+```
+
+
+ If a policy already exists with the name specified in `netbird.io/policy`, the other settings will be ignored in favor of the existing policy.
+
+
## Accessing Remote Services Using Sidecars
To access services running in different locations from your Kubernetes clusters, you can deploy NetBird sidecarsβadditional
containers that run alongside your Kubernetes service containers within the same pod.
diff --git a/src/pages/how-to/register-machines-using-setup-keys.mdx b/src/pages/how-to/register-machines-using-setup-keys.mdx
index 5fa4f9a0..6c1a927d 100644
--- a/src/pages/how-to/register-machines-using-setup-keys.mdx
+++ b/src/pages/how-to/register-machines-using-setup-keys.mdx
@@ -23,14 +23,11 @@ There are 2 types of setup keys:
## Ephemeral peers
-Ephemeral peers allows you to add temporary peers to your network and having them automatically removed once they become offline for over 10 minutes.
-This is particular useful when you want to run NetBird with Kubernetes pods or autoscaling groups.
+You can create a setup key with the ephemeral peers option enabled.
+Peers added with this key that later become offline for over 10 minutes will be removed automatically from the NetBird system.
-## Allow Extra DNS Labels
-This flag allows peers added with the setup key to add additional extra DNS labels to their peers.
-This is useful when you want to add more context to your peers and access these peers using a single domain name.
+This is useful when you want to add containers or auto scaling instances to your network.
-```bash {{ title: 'Starting NetBird Client' }}
## Using setup keys
Setup keys are available in the NetBird Management Dashboard under the `Setup Keys` tab [https://app.netbird.io/setup-keys](https://app.netbird.io/setup-keys).
@@ -53,6 +50,13 @@ You can set expiration when creating a key. When expired, the setup key can't be
By default, every reusable key has unlimited usage.
We recommend limiting the number of times the key can be used, e.g., set it to 30 if you need to enroll only 30 machines.
+## Allow Extra DNS labels
+
+You can create a setup key with the `Allow Extra DNS labels` option enabled.
+When enabled, peers added using this key will be able to add extra DNS labels and with that other peers in the NetBird network can reach them with these labels.
+
+If you add multiple peers with the same labels, they became part of a DNS round-robin group for the shared label. This is useful to access services running on multiple nodes.
+
## Peer Auto-grouping
diff --git a/src/pages/how-to/routing-traffic-to-multiple-resources.mdx b/src/pages/how-to/routing-traffic-to-multiple-resources.mdx
index 3223c485..975afc0a 100644
--- a/src/pages/how-to/routing-traffic-to-multiple-resources.mdx
+++ b/src/pages/how-to/routing-traffic-to-multiple-resources.mdx
@@ -4,7 +4,7 @@ Adding routes to resources within on-premises or cloud is a common scenario for
## Example
In the following scenario, we will cover the case where all users have restricted access to internal DNS servers in the internal network, and the DevOps team has full access to the entire network.
The network address is `172.16.0.0/15` and DNS servers has the IPs `172.16.30.2` and `172.17.100.2`.
-These IP ranges will routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the network.
+These IP ranges will be routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the network.
### Create a Network
To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard:
@@ -108,4 +108,4 @@ With the steps above, we created resources that allow different levels of access
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
- Follow us [on Twitter](https://twitter.com/netbird)
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-31rofwmxc-27akKd0Le0vyRpBcwXkP0g)
-- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub
\ No newline at end of file
+- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub
diff --git a/src/pages/how-to/troubleshooting-client.mdx b/src/pages/how-to/troubleshooting-client.mdx
index 528441fb..da8f8af3 100644
--- a/src/pages/how-to/troubleshooting-client.mdx
+++ b/src/pages/how-to/troubleshooting-client.mdx
@@ -106,7 +106,54 @@ names. Adding the `-S` flag will add system information like network routes and
netbird debug bundle -AS
```
-This will output the path of the generated file, which can be accessed with administrative privileges.
+This will output the path of the generated file. The output file is owned by and can only be accessed by the user
+NetBird is running as, by default it is: `Administrator` on Windows, `root` on MacOS/Linux or the operating system's
+equivalent.
+
+### Debug bundle uploads
+
+
+New in version `0.43.1`.
+
+
+Without local administrative privileges you can still share the debug bundles with us
+by using the `-U` / `--upload-bundle` flag.
+It will securely upload the debug bundle to our servers for access by the NetBird support team.
+
+```shell
+netbird debug bundle -AS -U
+```
+
+This will output an `Upload file key`, which is effectively a random filename in our internal storage system
+and can be safely shared with us through insecure channels such as GitHub Issues or Slack.
+
+```text
+> sudo netbird debug bundle -U
+Local file:
+/tmp/netbird.debug.2611377582.zip
+Upload file key:
+1234567890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/12345678-90ab-cdef-1234-567890abcdef
+```
+
+### Debug bundle uploads with GUI
+
+
+New in version `0.43.2`.
+
+
+You can also use the GUI `Settings` > `Create Debug Bundle` wizard to upload the bundle:
+
+
Returns a list of all network traffic events
-
+
+ ### Query Parameters
+
+
+
+ Page number
+
+
+
+ Number of items per page
+
+
+
+ Filter by user ID
+
+
+
+ Filter by protocol
+
+
+
+ Filter by event type
+
+
+
+ Filter by direction
+
+
+
+ Filters events with a partial match on user email, source and destination names and source and destination addresses
+
+
+
+ Start date for filtering events (ISO 8601 format, e.g., 2024-01-01T00:00:00Z).
+
+
+
+ End date for filtering events (ISO 8601 format, e.g., 2024-01-31T23:59:59Z).
+
+
+
#### Step 5: Create a authentication flow for device token authentication
-Navigate to Authentik admin interface > Flows & Stages > Flows > Create
+
+- Navigate to authentik admin interface
+- Click `Flows and Stages` on the left menu, then click `Flows` then `Create`
+- Fill in the form with the following values and click `Create`
+ - Name: `default-device-code-flow`
+ - Title: `Device Code Flow`
+ - Designation: `Stage Configuration`
+ - Authentication: `Require authentication`
+
+- Navigate to authentik admin interface
+- Click `System` on the left menu, then click `Brands`
+- Click on the edit button of domain `authentik-default`
+- Under Default flows set Device code flow to `default-device-code-flow`
+- Click `Update`
-Then go to: System > Brands > Edit used default > Default Flows > set **Device code flow** to newly created device flow
-Press `Update`
Your authority OIDC configuration will be available under:
diff --git a/src/pages/selfhosted/postgres-store.mdx b/src/pages/selfhosted/postgres-store.mdx
index c6aae982..d1596856 100644
--- a/src/pages/selfhosted/postgres-store.mdx
+++ b/src/pages/selfhosted/postgres-store.mdx
@@ -1,9 +1,5 @@
# Management Postgresql store
-
-This feature provides experimental support for using Postgres as the storage engine. Please use with caution and ensure proper testing in your environment.
-
-
## Using Postgres for fresh installations
As of version 0.26.0, the default configuration for fresh installations is SQLite storage.
@@ -198,4 +194,4 @@ docker compose logs management
You should see an entry similar to:
```
2024-05-10T15:09:34Z INFO management/server/store.go:109: using SQLite file store engine
-```
\ No newline at end of file
+```
diff --git a/src/pages/selfhosted/selfhosted-guide.mdx b/src/pages/selfhosted/selfhosted-guide.mdx
index ae2eace9..dba3a580 100644
--- a/src/pages/selfhosted/selfhosted-guide.mdx
+++ b/src/pages/selfhosted/selfhosted-guide.mdx
@@ -22,6 +22,7 @@ NetBird with custom IdPs.
- Virtual machine offered by any cloud provider (e.g., AWS, DigitalOcean, Hetzner, Google Cloud, Azure ...).
- Any Linux OS.
- Docker Compose installed (see [Install Docker Compose](https://docs.docker.com/compose/install/)).
+- [jq](https://jqlang.github.io/jq/) installed. In most distributions usually available in the official repositories and can be installed with `sudo apt install jq` or `sudo yum install jq`
- Domain name pointing to the public IP address of your server.
- Open TCP ports ```80, 443, 33073, 10000, 33080``` (Dashboard HTTP & HTTPS, Management gRPC & HTTP APIs, Signal gRPC API, Relay respectively) on your server.
- Coturn is used for relay using the STUN/TURN protocols. It requires a listening port, `UDP 3478`, and range of ports, `UDP 49152-65535`, for dynamic relay connections. These are set as defaults in setup file, but can be configured to your requirements.
@@ -78,6 +97,7 @@ Click the `Save` button to save the changes.
+
+
+
