diff --git a/CLAUDE.md b/CLAUDE.md index eae5f983..78b4b520 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -18,7 +18,8 @@ npm run dev # Start dev server (also runs gen:edit-routes, gen:last npm run build # Production build (also runs gen:edit-routes, gen:last-updated, gen:sitemap) npm run start # Serve the production build (warns under `output: 'standalone'` — safe to ignore locally; prod runs `node server.js` from `.next/standalone`) npm run lint # ESLint (next/core-web-vitals) on src/ -npm run gen # Regenerate API docs from NetBird OpenAPI spec +npm run lint:mdx # Check MDX heading structure (scripts/lint-mdx-headings.mjs) +npm run gen # Regenerate API docs from NetBird OpenAPI spec (requires a Go toolchain: runs `go run .` in generator/ to expand the spec) npm run gen:edit-routes # Regenerate edit-on-GitHub routes (auto-runs with dev/build) npm run gen:last-updated # Regenerate per-page git last-modified dates (auto-runs with dev/build) npm run gen:sitemap # Regenerate public/sitemap.xml (auto-runs with dev/build) @@ -42,6 +43,7 @@ Documentation pages are MDX files in `src/pages/` using the Next.js Pages Router - `ipa/` - API documentation (served at `/api` via rewrite) - `use-cases/` - Tutorials and examples - `client/` - Client configuration +- `agent-network/` - Agent Network product docs (AI/LLM gateway: quickstart, policies, usage & logs, integrations) - `help/` - Troubleshooting ### MDX Page Conventions @@ -64,6 +66,7 @@ Custom components available in MDX files (see `README.md` for full usage example - Media: `` (from `@/components/YouTube`) - UI: ` - - -- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird) -- Follow us [on X](https://x.com/netbird) -- Join our [Slack Channel](/slack-url) -- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub diff --git a/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx b/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx deleted file mode 100644 index a9b2b113..00000000 --- a/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx +++ /dev/null @@ -1,214 +0,0 @@ -# Add Servers to the Network with Setup Keys - -For DevOps teams managing complex infrastructures, adding new servers or containers to the network is a persistent challenge. Traditionally, manual configuration and individual setup processes have been the norm, often leading to time-consuming, error-prone, and potentially insecure deployments. - -The problem with conventional server and container network integration methods includes: - -* **Time-Intensive Setup**: Manually configuring each new server or container for network access can be tedious and time-consuming, especially in rapidly scaling environments. -* **Scalability Limitations**: As infrastructure grows, the complexity of managing network access for numerous servers and containers increases exponentially. -* **Security Risks**: Manual processes can lead to human errors, potentially exposing servers to unauthorized access or creating security loopholes in the network. - -This guide introduces [NetBird's Setup Keys](/manage/peers/register-machines-using-setup-keys) as an elegant solution for seamlessly and securely adding servers and containers to your network by: - -* **Streamlining Deployment**: Providing a simple, automated way to connect new servers and containers to your NetBird network with minimal manual intervention. -* **Facilitating Scalability**: Enabling rapid expansion of your network infrastructure without compromising on security or operational efficiency. -* **Enhancing Security**: Implementing a secure, automated process that reduces the risk of human error and unauthorized access, strengthening your overall security posture. - -This approach significantly reduces deployment time, ensures consistent and secure network configurations, and supports seamless scalability. - -Let's dive into the step-by-step process of using [NetBird's Setup Keys](/manage/peers/register-machines-using-setup-keys) to securely add a server with a Docker container to your network. - -## Prerequisites - -For this tutorial, you'll need the following prerequisites: - -* A [NetBird account](https://app.netbird.io/) -* The [NetBird agent](https://docs.netbird.io/get-started/install) installed in your local machine -* A cloud-hosted virtual machine (VM) with SSH access -* [Docker](https://www.docker.com/) installed on the cloud VM - -With these prerequisites in place, you'll be prepared to set up a secure network connection using NetBird's Setup Keys by: - -1. Creating a Setup Key in your NetBird account -2. Provisioning a VM and installing NetBird using the Setup Key -3. Deploying a Docker container on the VM -4. Connecting the Docker container to the NetBird network using the Setup Key - -This process will demonstrate how Setup Keys simplify and secure the addition of new servers and containers to your NetBird network. - -## Creating a Setup Key in Your NetBird Account - -To seamlessly integrate virtual machines or Docker containers into your NetBird network, you'll start by creating a setup key. While [NetBird's documentation offers comprehensive guidance on this process](https://docs.netbird.io/manage/peers/register-machines-using-setup-keys), let's quickly review the essential steps: - -* Access your NetBird dashboard -* Navigate to `Settings` → `Setup Keys` -* Click the `Create Setup Key` button on the right -* Name your key (e.g., "VM-Docker-Demo") -* Set an expiration date (recommended for enhanced security) -* Configure auto-assigned groups if needed -* Click `Create Setup Key` to generate the setup key -* Copy the generated key and store it securely as you'll need it for the next steps - -Here's an example: - -![NetBird Generating Setup Key](/docs-static/img/manage/peers/access-infrastructure/setup-keys-add-servers-to-network/setup-keys-add-server-01.png) - -This setup key will serve as your secure passport for adding both your VM and Docker container to the NetBird network, -ensuring a consistent integration process. - - - The Setup Key expiration date applies only to the key's validity period for adding new peers to the network. - Once a peer is connected using the setup key, the expiration date does not affect the peer's network access. - - -## Provisioning a VM and Installing NetBird Using the Setup Key - -After creating your setup key, the next step is to provision your VM and install NetBird: - -* SSH into your cloud-hosted VM -* [Install NetBird](https://docs.netbird.io/get-started/install) by running: - -```bash -curl -fsSL https://pkgs.netbird.io/install.sh | sh -``` - -Once installation completes, connect to the NetBird network using your setup key: - -```bash -netbird up --setup-key -``` - -Verify NetBird's status: - -```bash -netbird status -``` - -You should see output confirming the connection status, assigned IP, and peer information. - -```bash -OS: linux/amd64 -Daemon version: 0.29.4 -CLI version: 0.29.4 -Management: Connected -Signal: Connected -Relays: 2/2 Available -Nameservers: 0/0 Available -FQDN: docker-vm.netbird.cloud -NetBird IP: 100.85.148.249/16 -Interface type: Kernel -Quantum resistance: false -Routes: - -Peers count: 0/0 Connected -``` - -You can also check the NetBird service status by running: - -```bash -sudo systemctl status netbird -``` - -This should show the service as active and running. - -```bash -● netbird.service - A WireGuard-based mesh network that connects your devices into a single private network. - Loaded: loaded (/etc/systemd/system/netbird.service; enabled; vendor preset: enabled) - Active: active (running) since Tue 2024-09-24 19:22:56 UTC; 52s ago - Main PID: 3819 (netbird) - Tasks: 7 (limit: 1011) - Memory: 26.3M - CPU: 113ms - CGroup: /system.slice/netbird.service - └─3819 /usr/bin/netbird service run --config /etc/netbird/config.json --log-level info --daemon-ad -``` - -Next, ensure NetBird starts automatically on boot: - -```bash -sudo systemctl enable netbird -``` - -Finally, log into your NetBird dashboard and navigate to `Peers` to confirm your VM is listed and connected. - -![NetBird Peers View](/docs-static/img/manage/peers/access-infrastructure/setup-keys-add-servers-to-network/setup-keys-add-server-02.png) - -By using the setup key, you've securely added your VM to the NetBird network with minimal manual configuration, demonstrating the efficiency and security benefits of this approach. - -## Deploying a Docker Container on the VM - -To test NetBird's secure point-to-point connection, we'll deploy a simple Docker container with a Nginx-based web server serving a welcome page. - -Create a directory for the Docker project: - -```bash -mkdir netbird-demo && cd netbird-demo -``` - -Create a HTML file with the welcome message: - -```bash -echo "

Welcome to NetBird Demo

If you can see this, you've successfully connected to the container via NetBird.

" > index.html -``` - -Create a `Dockerfile`: - -```bash -cat << EOF > Dockerfile -FROM nginx:alpine -COPY index.html /usr/share/nginx/html/index.html -EOF -``` - -Next, build and run the Docker container using the commands: - -```bash -docker build -t netbird-demo . -docker run -d --name netbird-demo-container -p 8080:80 netbird-demo -``` - -Notice that the container is accessible on port `8080` of the VM. You'll use this port to test the connection. - -## Connecting the Docker Container to the NetBird Network Using the Setup Key - -Now that your VM is connected to the NetBird secure network, you can verify the connection using either `curl` or your web browser. Simply use the NetBird-assigned IP address or domain for the VM to access the deployed web server. - -To locate the NetBird-assigned IP or domain, go to `Peers` in your NetBird dashboard and hover your cursor over the VM's name. - -![NetBird Peers IP Address or Domain](/docs-static/img/manage/peers/access-infrastructure/setup-keys-add-servers-to-network/setup-keys-add-server-03.png) - -Verify connectivity to the VM from any NetBird-connected device using: - -```bash -curl http://:8080 -``` - -The expected output should be similar to the following: - -```bash -$ curl 100.85.148.249:8080 -

Welcome to NetBird Demo

If you can see this, you've successfully connected to the container via NetBird.

-``` - -Alternatively, you can go to `http://VM_NETBIRD_DOMAIN:8080` using your browser: - -![NetBird Welcome Page](/docs-static/img/manage/peers/access-infrastructure/setup-keys-add-servers-to-network/setup-keys-add-server-04.png) - -Keep in mind that this tutorial used the default `All` group for simplicity. However, implementing [NetBird's Access Policy](https://docs.netbird.io/manage/access-control/manage-network-access) to restrict peer-to-peer connections to specific user groups is a best practice for gaining granular control over resource access, thus improving your network's overall security posture in various scenarios. - -## Optional: Automating SSH Access to Your VM - -To further enhance your network security, you can enable SSH access to your VM via an embedded NetBird SSH server. -This feature allows you to securely access your VM with SSH without exposing it to the public internet and without the need -for distributing and managing SSH keys. To enable NetBird SSH access, run the following command on your VM: - -```bash -sudo netbird up --allow-server-ssh -``` - -You can then use the NetBird SSH client to connect to your VM: - -```bash -sudo netbird ssh -``` - -Summing up, NetBird's setup keys solve the challenge of securely connecting unattended resources, streamlining the integration of servers and containers without user intervention. For those looking to scale, the [NetBird API](https://docs.netbird.io/api/resources/setup-keys) offers powerful automation capabilities, allowing programmatic management of peers, setup keys, and access policies. These features combine to create a robust, secure, and easily manageable network infrastructure that adapts to your organization's needs. diff --git a/src/pages/manage/integrations/mdm-deployment/intune-netbird-integration.mdx b/src/pages/manage/peers/mdm-deployment/intune-netbird-integration.mdx similarity index 82% rename from src/pages/manage/integrations/mdm-deployment/intune-netbird-integration.mdx rename to src/pages/manage/peers/mdm-deployment/intune-netbird-integration.mdx index 13e5d2fb..8ce06bbc 100644 --- a/src/pages/manage/integrations/mdm-deployment/intune-netbird-integration.mdx +++ b/src/pages/manage/peers/mdm-deployment/intune-netbird-integration.mdx @@ -37,11 +37,11 @@ Let's create a policy that enables the `Development` team to access the `Servers - Set the source group to `Development` (or the appropriate team group synchronized from Entra ID) and the destination group to `Servers` - Configure the protocol and port settings based on required access patterns (e.g., TCP 22 for SSH access to servers) -![Create Access Control Policy](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-01.png) +![Create Access Control Policy](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-01.png) Provide a descriptive name for the policy, such as "Dev Team Server Access" that indicates its purpose, and click `Save` to create and activate the policy. -![New control access policy](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-02.png) +![New control access policy](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-02.png) This access policy will automatically apply to all devices enrolled in Intune that belong to users in the `Development` group (as synchronized from **Entra ID**), providing them secure access to designated resources while preventing lateral movement to unauthorized systems. @@ -68,21 +68,21 @@ Using the Win32 method requires you to convert either NetBird's `.exe` or `.msi` - Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com), navigate to `Apps`, and click the `Windows` button. -![Adding Windows App](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-03.png) +![Adding Windows App](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-03.png) - Click the `+ Create` button to add a new Windows application -![Create Windows App](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-04.png) +![Create Windows App](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-04.png) - In the `App type` dropdown, select `Windows app (Win32)` and click `Select` -![Win32 app](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-14.png) +![Win32 app](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-14.png) - On the `Add App` screen, click `Select app package file` and browse to the location of the NetBird `.intunewin` file you created earlier - Select the `.intunewin` file and click `OK` -![Upload NetBird Intunewin](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-15.png) +![Upload NetBird Intunewin](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-15.png) - On the `App information` tab, configure NetBird with the following values: @@ -97,7 +97,7 @@ Using the Win32 method requires you to convert either NetBird's `.exe` or `.msi` You can leave the rest of the fields empty. -![NetBird Configuration](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-16.png) +![NetBird Configuration](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-16.png) - Click `Next` to advance to the `Program` tab. Use the following commands in the install and uninstall fields: @@ -108,14 +108,14 @@ You can leave the rest of the fields empty. For this example, leave the rest of the configuration unchanged. Note that you can change the install behavior and users' ability to uninstall NetBird if required. -![Program tab](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-17.png) +![Program tab](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-17.png) - Click `Next` to advance to the `Requirements` tab. Here you can specify the architecture and minimum OS version required for installing NetBird. For instance: - **Operating system architecture:** 64-bit - **Minimum operating system:** Windows 10 22H2 -![Requirements tab](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-18.png) +![Requirements tab](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-18.png) - Click `Next` to advance to the `Detection rules` tab. Intune lets you choose between **using a custom detection script** or **manually configuring detection rules**. Select the latter and configure it as follows: @@ -127,7 +127,7 @@ For this example, leave the rest of the configuration unchanged. Note that you c Click `OK` when ready. -![Detection Rules tab](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-19.png) +![Detection Rules tab](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-19.png) For examples on registry-based detection rules, refer to [Intune documentation](https://learn.microsoft.com/en-us/intune/intune-service/apps/apps-win32-add#step-4-detection-rules) @@ -137,19 +137,19 @@ For examples on registry-based detection rules, refer to [Intune documentation]( - On the `Assignments` tab, under `Required`, click `+ Add group` -![Add Groups to NetBird App](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-20.png) +![Add Groups to NetBird App](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-20.png) - Select the appropriate group that contains your users (like the `Development` group synchronized from Entra ID) and click `Select` -![Assign Groups](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-09.png) +![Assign Groups](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-09.png) - To continue, click `Next`. Review your configuration in the `Review + create` tab, then click `Create` to add NetBird to your Intune app catalog. -![Review Configuration](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-21.png) +![Review Configuration](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-21.png) - To verify that NetBird was added to Intune, navigate to `Apps > All Apps` to see your Windows applications: -![Windows App Catalog](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-22.png) +![Windows App Catalog](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-22.png) ## Deploying NetBird as a Line-of-business (LOB) App @@ -160,20 +160,20 @@ As a simpler alternative to the Win32 method described previously, you can deplo - Download the NetBird Windows MSI installer from the [NetBird installation documentation](https://docs.netbird.io/get-started/install/windows) - Sign in to the [Microsoft Intune admin center](https://intune.microsoft.com), navigate to `Apps`, and click the `Windows` button. -![Adding Windows App](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-03.png) +![Adding Windows App](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-03.png) - Click the `+ Create` button to add a new Windows application -![Create Windows App](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-04.png) +![Create Windows App](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-04.png) - In the `App type` dropdown, select `Line-of-business app` and click `Select` -![LOB app](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-05.png) +![LOB app](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-05.png) - On the `Add App` screen, click `Select app package file` and browse to the location of the NetBird MSI file you downloaded earlier - Select the NetBird MSI installer and click `OK` -![Upload NetBird MSI](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-06.png) +![Upload NetBird MSI](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-06.png) Click `Next` to configure NetBird with the following details: @@ -189,27 +189,27 @@ Click `Next` to configure NetBird with the following details: You can leave the rest of the fields empty. -![NetBird Configuration](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-07.png) +![NetBird Configuration](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-07.png) When ready, click `Next` to proceed to the `Assignments` tab. Under `Required`, click `+ Add group` -![Add Groups to NetBird App](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-08.png) +![Add Groups to NetBird App](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-08.png) - Select the appropriate group that contains your users (like the `Development` group synchronized from Entra ID) and click `Select` -![Assign Groups](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-09.png) +![Assign Groups](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-09.png) - To continue, click `Next`. Review your configuration in the `Review + create` tab, then click `Create` to add NetBird to your Intune app catalog. -![Review Configuration](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-11.png) +![Review Configuration](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-11.png) After adding NetBird, you'll see an overview screen for the NetBird app, showing deployment status and management options. -![NetBird App Overview](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-12.png) +![NetBird App Overview](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-12.png) To verify that NetBird was added to Intune, navigate to `Home > Apps | Windows` to see all your Windows applications: -![Windows App Catalog](/docs-static/img/manage/integrations/mdm-deployment/intune-netbird-integration/intune-13.png) +![Windows App Catalog](/docs-static/img/manage/peers/mdm-deployment/intune-netbird-integration/intune-13.png) ### Deploying NetBird to Other Platforms diff --git a/src/pages/manage/integrations/mdm-deployment/jamf-pro-netbird-integration.mdx b/src/pages/manage/peers/mdm-deployment/jamf-pro-netbird-integration.mdx similarity index 86% rename from src/pages/manage/integrations/mdm-deployment/jamf-pro-netbird-integration.mdx rename to src/pages/manage/peers/mdm-deployment/jamf-pro-netbird-integration.mdx index f192bded..ec36d5ef 100644 --- a/src/pages/manage/integrations/mdm-deployment/jamf-pro-netbird-integration.mdx +++ b/src/pages/manage/peers/mdm-deployment/jamf-pro-netbird-integration.mdx @@ -38,11 +38,11 @@ For this tutorial, we'll create a policy that allows the `Support` team to acces * Set the source group to `Support` and the destination group to `Servers`. * Configure the appropriate protocol and port settings (e.g., TCP 22 for SSH access). -![Access control policy for the support team](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-01.png) +![Access control policy for the support team](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-01.png) Give the policy a descriptive name (e.g., "Support team remote access") and click `Save` to create the policy. -![Access control policies list](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-02.png) +![Access control policies list](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-02.png) With this policy in place, any device assigned to the `Support` group will gain access to the `Servers` group as defined in the Access Control Policy. @@ -68,7 +68,7 @@ In the `Options` tab: Click `Save` to finish. If you see the message "Availability pending", click `Refresh` to update the package status. -![Uploading NetBird package](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-03.png) +![Uploading NetBird package](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-03.png) ### Creating a Policy for NetBird @@ -84,29 +84,29 @@ In the **Trigger** options, check the following boxes: These trigger selections ensure NetBird is installed promptly and remains current on all managed devices. Leave the remaining options as default. -![Jamf Pro policies, general section](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-04.png) +![Jamf Pro policies, general section](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-04.png) In the `Packages` section, click `Configure` and add the corresponding NetBird package: -![Jamf Pro policies, packages section](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-05.png) +![Jamf Pro policies, packages section](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-05.png) Accept the default values for **Distribution Point** and **Action** -![Jamf Pro policies, packages section](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-06.png) +![Jamf Pro policies, packages section](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-06.png) In the `Scope` tab, specify the target computers (all computers, specific computers or groups, etc.). For simplicity in this example, use `All Computers`. -![Jamf Pro policies, target computers](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-07.png) +![Jamf Pro policies, target computers](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-07.png) Optionally, in the `User Interaction` tab: * Enter messages to display before and after the policy runs. * This can help inform users about the installation process. -![Jamf Pro policies, user interaction](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-08.png) +![Jamf Pro policies, user interaction](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-08.png) Click `Save` to finish. -![NetBird policy](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-09.png) +![NetBird policy](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-09.png) This configuration ensures NetBird is installed as soon as any machine enrolls, maintaining security across your device fleet. @@ -133,7 +133,7 @@ After setting up NetBird deployment policy in Jamf Pro, it's crucial to verify t * In the device details, go to the `Management` tab and locate the `Policies` section. * Look for the NetBird policy in the list of applied policies. -![Jamf Pro, confirming NetBird is installed](/docs-static/img/manage/integrations/mdm-deployment/jamf-pro-netbird-integration//netbird-jamf-10.png) +![Jamf Pro, confirming NetBird is installed](/docs-static/img/manage/peers/mdm-deployment/jamf-pro-netbird-integration/netbird-jamf-10.png) If you see the NetBird policy listed, that would indicate that NetBird has been successfully installed on the device. diff --git a/src/pages/manage/integrations/mdm-deployment/kandji-netbird-integration.mdx b/src/pages/manage/peers/mdm-deployment/kandji-netbird-integration.mdx similarity index 84% rename from src/pages/manage/integrations/mdm-deployment/kandji-netbird-integration.mdx rename to src/pages/manage/peers/mdm-deployment/kandji-netbird-integration.mdx index df7841d2..88c6de02 100644 --- a/src/pages/manage/integrations/mdm-deployment/kandji-netbird-integration.mdx +++ b/src/pages/manage/peers/mdm-deployment/kandji-netbird-integration.mdx @@ -28,11 +28,11 @@ For instance, let's suppose you want to create a policy that allows the `Support * Set the source group to `Support` and the destination group to `Servers`. * Choose the appropriate protocol and port settings (e.g., TCP 22). -![Creating a new access policy for the Support team](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-01.png) +![Creating a new access policy for the Support team](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-01.png) Give the policy a descriptive name (e.g., Support team remote access) and click `Save` to create the policy. -![Support team access policy](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-02.png) +![Support team access policy](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-02.png) Now that you've configured NetBird, let's shift the focus to Kandji MDM integration and set up the automated deployment of NetBird on support team devices. @@ -40,13 +40,13 @@ Now that you've configured NetBird, let's shift the focus to Kandji MDM integrat Navigate to `Library` and click `Add new`. Then, find and select `Custom Apps` and click `Add & Configure` to deploy a new [Custom App](https://www.support.kandji.io/support/solutions/articles/72000559807-deploying-custom-apps). -![Creating a new Custom App in Kandji](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-04.png) +![Creating a new Custom App in Kandji](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-04.png) Give the Custom App a descriptive name (e.g., NetBird_vX.XX_Support_Team, where X.XX is the current version of NetBird being deployed). Scroll down to **Install Details**, where you'll see different options. Select `Installer Package` to install NetBird using the official macOS package. Using a package ensures you're installing the exact same version on all devices. This example uses the Apple Silicon package that you can download [here](https://pkgs.netbird.io/macos/arm64). Drag the file to the `Installer Package` field box to upload it to Kandji MDM. -![Creating a new Custom App in Kandji](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-05.png) +![Creating a new Custom App in Kandji](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-05.png) Next, click on `Add Preinstall Script` and paste the following code: @@ -141,41 +141,41 @@ For instance, you can [create tags](https://www.support.kandji.io/support/soluti To create a tag in Kandji MDM, go to `DEVICES`, click on the hamburger menu at the top right, and select `Manage tags`: -![Manage Tags in Kandji](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-06.png) +![Manage Tags in Kandji](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-06.png) A new pop-up window will appear; click `+ Add tag`, enter a name for the tag (e.g., `Support`), and click `Save`. -![Creating a new Tag](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-07.png) +![Creating a new Tag](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-07.png) Navigate to the `BLUEPRINTS` section in Kandji and click the `New Blueprint` dropdown. Select `New Assignment Map` from the options. In the new window, you'll be presented with preconfigured templates or the option to start a new Blueprint from scratch. For this custom NetBird deployment, choose to start a new Blueprint from scratch. -![Creating a new Blueprint](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-08.png) +![Creating a new Blueprint](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-08.png) Give the Blueprint a descriptive name (e.g., NetBird_Apple_Silicon) and click `Create Blueprint`. This action will open Kandji's visual Blueprint builder, where you'll configure the deployment logic for NetBird. Click `Edit assignments` to start editing the Blueprint. -![Blank Blueprint](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-09.png) +![Blank Blueprint](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-09.png) You'll see a list of apps from the library on the left, including the recently created NetBird custom app. To implement the deployment logic, hover over the `+` sign and click it to add a new conditional block. This block will determine which devices receive the NetBird installation based on specific criteria. -![Add new Block to the Blueprint](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-10.png) +![Add new Block to the Blueprint](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-10.png) Next, click the pencil icon to edit the rules. -![Add Logic to the Blueprint](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-11.png) +![Add Logic to the Blueprint](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-11.png) In the **Assignment Rules** window, configure the conditions for NetBird installation. Use the `Support` tag to trigger the deployment, ensuring NetBird is installed only on devices assigned to the support team. Press `Confirm` to continue. -![Using Tags to target the support team](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-12.png) +![Using Tags to target the support team](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-12.png) Back to the visual Blueprint builder, locate the NetBird custom app and drag it into the newly created conditional block. This action associates the NetBird installation with the specified deployment criteria for the support team. -![Add NetBird custom app to Blueprint logic](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-13.png) +![Add NetBird custom app to Blueprint logic](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-13.png) Click `Save` to update the Blueprint with the new logic. This action also assigns the Blueprint to the NetBird custom app, finalizing the deployment pipeline configuration. -![Finished Blueprint](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-14.png) +![Finished Blueprint](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-14.png) ## Testing and Verifying the Automated Provisioning Pipeline @@ -183,10 +183,10 @@ Kandji checks devices every 15 minutes by default, so any device tagged with `Su To verify the deployment pipeline, navigate to `DEVICES` in Kandji, select an enrolled device, and click `Edit device details` > `Edit tags`. Assign the `Support` tag to trigger the NetBird installation. -![Verifying Blueprint logic](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-15.png) +![Verifying Blueprint logic](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-15.png) You can also confirm the process in NetBird. Log in to a NetBird account with administrative privileges, navigate to `Peers`, and look for the new device. -![Verifying peer in NetBird](/docs-static/img/manage/integrations/mdm-deployment/kandji-netbird-integration//netbird-kandji-16.png) +![Verifying peer in NetBird](/docs-static/img/manage/peers/mdm-deployment/kandji-netbird-integration/netbird-kandji-16.png) In this tutorial, you've learned how to integrate NetBird's VPN solution with Kandji MDM for Apple devices. By configuring NetBird Access Policies, creating Kandji MDM Blueprints, and setting up an automated deployment pipeline, you've established a robust system for managing network access across your organization. diff --git a/src/pages/manage/integrations/mdm-deployment/macos-cli-pkg-deployment.mdx b/src/pages/manage/peers/mdm-deployment/macos-cli-pkg-deployment.mdx similarity index 97% rename from src/pages/manage/integrations/mdm-deployment/macos-cli-pkg-deployment.mdx rename to src/pages/manage/peers/mdm-deployment/macos-cli-pkg-deployment.mdx index 25b9b25b..e9f81370 100644 --- a/src/pages/manage/integrations/mdm-deployment/macos-cli-pkg-deployment.mdx +++ b/src/pages/manage/peers/mdm-deployment/macos-cli-pkg-deployment.mdx @@ -212,10 +212,10 @@ xcrun stapler staple netbird-cli-${VERSION}.pkg Upload the `.pkg` to your MDM solution and create a deployment policy. The exact steps vary by platform: -* **Jamf Pro**: Upload the package under `Settings > Computer Management > Packages`, then create a policy with appropriate triggers (enrollment, recurring check-in). See [Deploying NetBird with Jamf Pro](/manage/integrations/mdm-deployment/jamf-pro-netbird-integration) for detailed instructions. -* **Kandji**: Create a Custom App library item with the `Installer Package` option. See [Deploying NetBird with Kandji](/manage/integrations/mdm-deployment/kandji-netbird-integration) for detailed instructions. +* **Jamf Pro**: Upload the package under `Settings > Computer Management > Packages`, then create a policy with appropriate triggers (enrollment, recurring check-in). See [Deploying NetBird with Jamf Pro](/manage/peers/mdm-deployment/jamf-pro-netbird-integration) for detailed instructions. +* **Kandji**: Create a Custom App library item with the `Installer Package` option. See [Deploying NetBird with Kandji](/manage/peers/mdm-deployment/kandji-netbird-integration) for detailed instructions. * **Munki**: Import the `.pkg` into your Munki repository using `munkiimport` and assign it to the appropriate manifest. -* **Microsoft Intune**: Upload as a macOS LOB app. See [Deploying NetBird with Intune](/manage/integrations/mdm-deployment/intune-netbird-integration) for detailed instructions. +* **Microsoft Intune**: Upload as a macOS LOB app. See [Deploying NetBird with Intune](/manage/peers/mdm-deployment/intune-netbird-integration) for detailed instructions. ## Managing updates diff --git a/src/pages/manage/integrations/mdm-deployment/windows-gpo-deployment.mdx b/src/pages/manage/peers/mdm-deployment/windows-gpo-deployment.mdx similarity index 96% rename from src/pages/manage/integrations/mdm-deployment/windows-gpo-deployment.mdx rename to src/pages/manage/peers/mdm-deployment/windows-gpo-deployment.mdx index 8b42f1eb..c3225f01 100644 --- a/src/pages/manage/integrations/mdm-deployment/windows-gpo-deployment.mdx +++ b/src/pages/manage/peers/mdm-deployment/windows-gpo-deployment.mdx @@ -139,7 +139,7 @@ The install script's own log is at `%ProgramData%\NetBird\netbird-deploy.log`, a ## When not to use GPO -Group Policy only reaches domain-joined Windows machines. For Windows devices managed by Intune, use [Deploy with Intune](/manage/integrations/mdm-deployment/intune-netbird-integration) with the same ADMX or an OMA-URI profile. For macOS fleets, see [Jamf Pro](/manage/integrations/mdm-deployment/jamf-pro-netbird-integration) or [Kandji](/manage/integrations/mdm-deployment/kandji-netbird-integration). The registry values themselves are tool-agnostic, so anything that can write `HKLM\Software\Policies\NetBird` (SCCM, an RMM, a provisioning image) gives you the same enforcement without GPO. +Group Policy only reaches domain-joined Windows machines. For Windows devices managed by Intune, use [Deploy with Intune](/manage/peers/mdm-deployment/intune-netbird-integration) with the same ADMX or an OMA-URI profile. For macOS fleets, see [Jamf Pro](/manage/peers/mdm-deployment/jamf-pro-netbird-integration) or [Kandji](/manage/peers/mdm-deployment/kandji-netbird-integration). The registry values themselves are tool-agnostic, so anything that can write `HKLM\Software\Policies\NetBird` (SCCM, an RMM, a provisioning image) gives you the same enforcement without GPO. ## Recap diff --git a/src/pages/use-cases/kubernetes/routing-peers-and-kubernetes.mdx b/src/pages/use-cases/kubernetes/routing-peers-and-kubernetes.mdx index f078585c..6d325cac 100644 --- a/src/pages/use-cases/kubernetes/routing-peers-and-kubernetes.mdx +++ b/src/pages/use-cases/kubernetes/routing-peers-and-kubernetes.mdx @@ -140,7 +140,22 @@ kubectl apply -f deployment.yml ``` - In this example the setup key is passed as an environment variable. You should use a secret to pass the setup key. + In this example the setup key is passed as a plain environment variable to keep the manifest short. In a real deployment, store it in a Kubernetes secret instead: + + ```shell + kubectl create secret generic netbird-setup-key --from-literal=NB_SETUP_KEY=YOUR_SETUP_KEY + ``` + + Then reference it from the container spec: + + ```yaml + env: + - name: NB_SETUP_KEY + valueFrom: + secretKeyRef: + name: netbird-setup-key + key: NB_SETUP_KEY + ``` ### Step 5: Make the deployment highly available @@ -157,6 +172,8 @@ spec: replicas: 3 ... ``` + +With more than one replica, a static `NB_HOSTNAME` would give every routing peer the same name in the dashboard. Remove the `NB_HOSTNAME` variable from the manifest instead — the client then falls back to the container hostname, which in Kubernetes is the pod name, so each replica registers under its own pod's name. Apply the updated deployment file to your Kubernetes cluster using the following command: ```shell kubectl apply -f deployment.yml