mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-17 11:09:04 +02:00
riccardom
54aa32788e
The iOS section was written while the policy stopped at the app: the network extension that runs the engine has its own preferences domain, and Apple's app-configuration channel does not deliver there. The app now mirrors the configuration into the shared App Group and tells the extension when it changes, so the keys the engine applies to the connection are enforced too. What replaces the old warning is a timing caveat, which is what an admin actually needs in order to plan a rollout. The hand-off happens only while the app is running: in the foreground a change reaches the tunnel within about 30 seconds or immediately on activation, but iOS suspends a backgrounded app, so a policy pushed — or withdrawn — in that window applies the next time the app is opened. A tunnel brought up by VPN On Demand or the widget therefore runs on the last policy the app saw. tvOS keeps the old behaviour and now says so: the hand-off needs a shared app group, which does not work between the tvOS app and its extension, so only the interface is enforced there. Also corrected: blockInbound, wireguardPort and lazyConnection are no longer listed as having no effect but as having no control to lock, and debugBundleUploadURL moves out of the ignored list, since the engine applies it when a remote job produces a bundle. The app-config template carries the same three keys and the same timing note.
132 lines
4.4 KiB
Plaintext
132 lines
4.4 KiB
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<!--
|
|
NetBird Managed App Configuration (iOS / iPadOS / tvOS).
|
|
|
|
Bundle identifier of the managed app:
|
|
io.netbird.app (iOS, iPadOS)
|
|
io.netbird.app.tv (tvOS)
|
|
|
|
Delivery: your MDM sends this dictionary alongside the managed app
|
|
(Intune "App configuration policies" → Enter XML data; Jamf Pro
|
|
"Mobile Device Apps → App Configuration"; the equivalent App
|
|
Configuration field on Kandji, Mosyle, Workspace ONE, JumpCloud).
|
|
iOS hands it to the app, which reads it on every policy load.
|
|
|
|
The app must be installed BY the MDM. An app the user installed
|
|
from the App Store themselves cannot receive a configuration, and
|
|
NetBird then runs with no policy at all.
|
|
|
|
Editing this file:
|
|
- Delete or comment out every key you do NOT want to enforce. An
|
|
absent key means "no enforcement" for that field.
|
|
- Some MDM consoles want only the inner <dict>; paste from
|
|
<dict> to </dict> and drop the plist envelope in that case.
|
|
- Validate locally with:
|
|
plutil -lint netbird-ios-appconfig.plist
|
|
|
|
When a change takes effect: iOS hands this configuration to the
|
|
NetBird app, and the app passes it to the network extension that
|
|
runs the tunnel whenever the app is running. With the app in the
|
|
foreground a change reaches the tunnel within about 30 seconds;
|
|
while the app is closed or backgrounded iOS suspends it, so a
|
|
policy pushed (or withdrawn) in that window applies the next time
|
|
the app is opened. A tunnel brought up by VPN On Demand or the
|
|
widget runs on the last policy the app saw.
|
|
|
|
tvOS: only the interface is enforced. The hand-off needs a shared
|
|
app group, which does not work between the tvOS app and its
|
|
extension, so the tvOS engine runs without the policy.
|
|
|
|
Keys that do not apply to the platform are parsed and ignored here,
|
|
so one payload can be shared with desktop devices: allowServerSSH,
|
|
disableServerRoutes, disableAutostart, disableMetricsCollection,
|
|
enableLocalMetrics, localMetricsAddress, splitTunnelMode,
|
|
splitTunnelApps.
|
|
|
|
See the iOS section of docs/src/pages/client/mdm-integration.mdx.
|
|
-->
|
|
<plist version="1.0">
|
|
<dict>
|
|
|
|
<!-- ===== Identity / auth ===== -->
|
|
<key>managementURL</key>
|
|
<string>https://api.netbird.io:443</string>
|
|
|
|
<!--
|
|
Pre-shared key: secret. Remove the entry entirely when not
|
|
used; do NOT leave an empty <string></string>, which the
|
|
client treats as a deliberate empty-PSK enforcement.
|
|
-->
|
|
<!--
|
|
<key>preSharedKey</key>
|
|
<string>REPLACE_ME</string>
|
|
-->
|
|
|
|
<!-- ===== Interface lockdown =====
|
|
disableUpdateSettings : read-only mode — nothing is hidden,
|
|
every configuration control is locked.
|
|
disableProfiles : hide the Profiles section (no create,
|
|
switch or remove).
|
|
disableNetworks : remove the Resources tab.
|
|
disableAdvancedView : hide Advanced (on tvOS, the whole
|
|
section). -->
|
|
<!--
|
|
<key>disableUpdateSettings</key>
|
|
<true/>
|
|
|
|
<key>disableProfiles</key>
|
|
<true/>
|
|
|
|
<key>disableNetworks</key>
|
|
<true/>
|
|
|
|
<key>disableAdvancedView</key>
|
|
<true/>
|
|
-->
|
|
|
|
<!-- ===== Connection controls =====
|
|
Each of these locks its own control in the app. -->
|
|
<!--
|
|
<key>disableAutoConnect</key>
|
|
<false/>
|
|
|
|
<key>disableClientRoutes</key>
|
|
<false/>
|
|
|
|
<key>rosenpassEnabled</key>
|
|
<true/>
|
|
|
|
<key>rosenpassPermissive</key>
|
|
<false/>
|
|
-->
|
|
|
|
<!-- ===== Remote jobs =====
|
|
allowRemoteJobs present at any value locks the client toggle,
|
|
so pushing false pins remote jobs off. debugBundleUploadURL
|
|
overrides where a bundle produced by a remote job is sent. -->
|
|
<!--
|
|
<key>allowRemoteJobs</key>
|
|
<false/>
|
|
|
|
<key>debugBundleUploadURL</key>
|
|
<string>https://uploads.example.com</string>
|
|
-->
|
|
|
|
<!-- ===== Applied by the tunnel engine =====
|
|
No control to lock in the app - the engine applies these to
|
|
the connection itself. -->
|
|
<!--
|
|
<key>blockInbound</key>
|
|
<false/>
|
|
|
|
<key>wireguardPort</key>
|
|
<integer>51820</integer>
|
|
|
|
<key>lazyConnection</key>
|
|
<true/>
|
|
-->
|
|
|
|
</dict>
|
|
</plist>
|