* [doc] Document per-target reverse proxy access control
* docs: screenshots, when-to-use and Bypass warning for target access actions
- Add screenshots of the target Access setting and the target-list indicators
- Add "When to use per-target access actions"
- Warn that Bypass authentication makes the path public
- Note that a Block on /admin/ does not cover /admin
- Access logs: describe the User-column icon and tooltip; document access_action=invalid_path
* docs: tighten target access wording
* docs: say where the access log icons appear
---------
Co-authored-by: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
* Document nblink
nblink forwards local ports into a NetBird network from an unprivileged
process, so it covers the cases where the agent cannot be installed: managed
laptops without administrator rights, rootless containers, and short-lived CI
jobs.
Covers the download, the forward syntax, the container environment variables,
and the access control and userspace limits that decide whether it fits.
* Add use cases to the nblink page
The page explained what nblink does and how to run it, but not when to reach
for it, which is the first thing a reader needs to decide.
Covers the three cases it fits best: an MCP server or local AI agent calling
an internal API, Agent Network access from a machine where the client cannot
be installed, and a sidecar for an application that ignores proxy settings.
* Note what the mounted nblink setup key requires
The container example referenced a secret path it never mounted, so it
could not have worked as written. The mount also needs calling out, because
the container runs as an arbitrary UID while a bind mount keeps the host
file's owner and mode, and a key written with the usual private mode is
unreadable to it.
* Document the nblink Host and Origin checks
A loopback forward answers only where Host names the loopback interface and
refuses a cross-site Origin, because a page the reader visits can point its
own hostname at 127.0.0.1 and would otherwise reach the upstream through the
listener under their identity.
* Describe the nblink cross-site check and its residual
The page described only the Host and Origin checks. A page can also embed the
loopback address directly, where Sec-Fetch-Site is the signal that stops it,
and a browser too old to send that header still gets through.
* Publish the nblink container port on loopback only
The container example published port 8080 on every host interface while the
forward inside listened on 0.0.0.0 with public bind enabled, so anything that
could reach the Docker host could use the forward under the peer's identity.
The paragraph beneath it justified that by saying the container boundary
restricts access, which it does not once the port is published.
The example now publishes on 127.0.0.1, with the reason the listener still
has to bind 0.0.0.0 inside the container.
The same section had drifted from the binary in two other places. The
key-file note described what -v does with a missing source path, while the
example uses --mount, which refuses to start. And a public forward now
answers 421 to a name it was not told about, which the page never mentioned:
--allowed-host is added to the container section, the configuration table and
the access-control section, including that a listed name is trusted and
applies to every forward.
* docs: add MDM fleet rollout use case
The MDM reference pages cover installing the client and enforcing its
settings separately, per OS and per vendor, but nothing walks through a
whole rollout. This use case ties install, SSO enrollment, policy, and
update ownership together, with an end-to-end Intune example for Windows
and macOS, and links out to the reference pages for detail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JM8WrDg3kV1PQriXwjmzCb
* docs: move MDM rollout under a Deployment use-case group
Group the MDM rollout guide under a new Deployment section in the Use
Cases sidebar. Reuse existing Intune, desktop app, and Intune compliance
screenshots in the walkthrough. Drop the iOS section and the "What this
does not do" section to keep the guide focused on Windows and macOS
laptops.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JM8WrDg3kV1PQriXwjmzCb
* docs: tighten MDM rollout use case for clarity and scan
Polish the fleet rollout page: shorter preamble, clearer policy and update guidance, Related tiles, and a plain checklist without the redundant recap.
* docs: align Intune Ignore app version with update owner
The rollout guide requires Yes when NetBird owns updates and No when Intune does. Document both options on the Intune deploy page so the two guides do not conflict.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Brandon Hopkins <brandon@techhut.tv>
* Mark direct Google IdP as not recommended for self-hosted
Using Google directly as the self-hosted IdP depends on Management
sending the OAuth client secret to every client, which is deprecated
and will be removed. It also cannot support the device authorization
flow, so headless Linux and FreeBSD peers cannot log in with SSO or
use `netbird ssh` (see netbirdio/netbird discussion 8113).
Mark the standalone Google setup as not recommended, correct the
legacy page's claim that the client secret was already removed,
document the device flow limitation, and add a Google connector
example to the external-to-embedded IdP migration guide.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WxGYofKNYt3aGPnbg6RQsX
* Point Google users to Management Setup in the advanced guide
Step 3 told every provider to follow its Standalone Setup (Advanced)
section, which no longer matches the Google page. Send Google users to
the Quickstart and the Google Management Setup instead, and keep the
standalone instruction for the other providers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WxGYofKNYt3aGPnbg6RQsX
---------
Co-authored-by: Claude <noreply@anthropic.com>
Remote jobs are now an explicit opt-in on the peer (default off), enabled
with --allow-remote-jobs or the allowRemoteJobs MDM policy, and a new
debugBundleUploadURL MDM policy overrides the debug-bundle upload service.
Document both MDM keys in the MDM integration reference, and note the
opt-in requirement plus the new anonymization-level and upload-URL bundle
parameters on the Remote Jobs page.
Domains that already have CAA records refuse certificate issuance unless
the certificate authority is authorized, leaving reverse proxy services
unreachable over HTTPS after the domain verifies successfully.
Document the sectigo.com value used by ZeroSSL on NetBird Cloud's managed
proxy clusters, the issue/issuewild records to add, CAA inheritance from
parent domains, and how to check existing records. Add a troubleshooting
entry for certificates that are not issued after verification.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [doc] Explain custom domain verification expiry
Describe the 48-hour verification deadline, hourly cleanup, and activity event
so administrators know why a pending domain disappears and how to register it
again. Include the upgrade window and the exception for legacy service use.
* [doc] Explain custom domain name normalization
Describe how new custom domain registrations normalize case, internationalized
names, and a trailing dot, and reject malformed or wildcard names.
The Wails 3 desktop app links GTK 4.10+ (GtkFileDialog) and WebKitGTK 6.0,
verified against the shipped v0.75.0 netbird-ui binary. The previously
documented floor of Debian 12 / Ubuntu 22.04 is below that: both ship
WebKitGTK 6.0 but only GTK 4.8 and 4.6, where the app starts and then
crashes on the first file dialog.
- Document the real floor per distribution and mark RHEL 9, Amazon Linux 2
and Amazon Linux 2023 as CLI only.
- Name the GTK 4 and WebKitGTK 6.0 packages in the install commands, since
netbird-ui does not declare them as dependencies.
- Note that EPEL provides webkitgtk6.0 on RHEL/AlmaLinux/Rocky 10.
- Remove libappindicator from the RPM install lines. The tray is a D-Bus
StatusNotifierItem and does not link libappindicator; keep the GNOME
extension step, which is still required for the tray to appear.
- Note that Linux netbird-ui packages are x86_64 only.
* Update BYOP documentation to reflect "Clusters" terminology and add shared vs account cluster details.
* Update BYOP DNS documentation and replace modal images
* Add script to generate sitemap.xml and update related configurations
* chore: add robots.txt referencing sitemap.xml
---------
Co-authored-by: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
* Add force approval docs
* add force approval
* add filter and batch operation
* Rename force approval docs to bypass compliance
- Rename force-approval.mdx to bypass-compliance.mdx
- Update navigation title from "Force Approval" to "Bypass Compliance"
- Update all internal links to use new path
- Update image paths to /bypass-compliance/
- Update terminology in EDR integration docs
* add images
---------
Co-authored-by: Ashley Mensah <ashleyamo982@gmail.com>
* Update reverse proxy documentation for domain and DNS record changes
* Clarify reverse proxy domain description in migration guide
* Update domain requirement clarification in migration guide
Clarified the domain requirement for the proxy + added missing charactr afer example domain
---------
Co-authored-by: shuuri-labs <61762328+shuuri-labs@users.noreply.github.com>
* Escape MDX-specific characters in API templates and refine NavigationAPI links
* Update API pages with v0.66.0
---------
Co-authored-by: netbirddev <dev@netbird.io>
* Handle merge api component conflicts
Added a fixConflictingEnumAllOf() function in generator/api.ts that pre-processes the spec before merging
* Update API pages with v0.62.2
---------
Co-authored-by: netbirddev <dev@netbird.io>
* update slack url and twitter
use a dedicated url for slack, allowing update in a single place
rename Twitter references to X
* rollback Install NetBird title in navigation menu
