mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-19 20:19:06 +02:00
riccardom
182b1b9e87
The reference table listed 18 of the 23 keys the client recognises, and claimed a count of 16. Six keys were missing from every downloadable template as well, including lazyConnection, which the page already documented: - lazyConnection, disableAdvancedView, enableLocalMetrics, localMetricsAddress, allowRemoteJobs and debugBundleUploadURL are now in the reference table and in netbird.admx/.adml, io.netbird.client.plist, netbird-macos.mobileconfig, netbird-macos.sh and netbird-policy.reg. - Notes call out the two pairs that read as related but are not: disableMetricsCollection (anonymous telemetry) versus enableLocalMetrics (the client's own Prometheus endpoint), and disableAdvancedView being UI-only, so unlike its neighbours it never causes a request to be rejected. iOS and tvOS now have a section of their own. The channel is Apple's Managed App Configuration against bundle id io.netbird.app (io.netbird.app.tv on tvOS), with a new netbird-ios-appconfig.plist template and per-provider instructions. The section states what the policy reaches today: the app locks its interface and refuses configuration changes, while the tunnel engine runs in a Network Extension that does not receive the app configuration, so keys the engine applies to the connection are not enforced there yet. Two template defects found on the way: - netbird-macos.mobileconfig was not well-formed XML. Its header comment contained a double hyphen, which XML forbids inside a comment, so plutil -lint and any strict parser rejected the file an admin downloaded. - netbird-policy.reg had one LF-terminated line among CRLF ones; normalised, with the UTF-16LE encoding reg import requires preserved. Verified with npm run build and npm run lint:mdx, plus XML well-formedness on all five XML templates, bash -n on the shell template, and a cross-reference check that every string and presentation the ADMX references is defined in the ADML.
111 lines
3.8 KiB
Plaintext
111 lines
3.8 KiB
Plaintext
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<!--
|
|
NetBird Managed App Configuration (iOS / iPadOS / tvOS).
|
|
|
|
Bundle identifier of the managed app:
|
|
io.netbird.app (iOS, iPadOS)
|
|
io.netbird.app.tv (tvOS)
|
|
|
|
Delivery: your MDM sends this dictionary alongside the managed app
|
|
(Intune "App configuration policies" → Enter XML data; Jamf Pro
|
|
"Mobile Device Apps → App Configuration"; the equivalent App
|
|
Configuration field on Kandji, Mosyle, Workspace ONE, JumpCloud).
|
|
iOS hands it to the app, which reads it on every policy load.
|
|
|
|
The app must be installed BY the MDM. An app the user installed
|
|
from the App Store themselves cannot receive a configuration, and
|
|
NetBird then runs with no policy at all.
|
|
|
|
Editing this file:
|
|
- Delete or comment out every key you do NOT want to enforce. An
|
|
absent key means "no enforcement" for that field.
|
|
- Some MDM consoles want only the inner <dict>; paste from
|
|
<dict> to </dict> and drop the plist envelope in that case.
|
|
- Validate locally with:
|
|
plutil -lint netbird-ios-appconfig.plist
|
|
|
|
Scope on iOS: these keys lock and reshape the app's interface, and
|
|
the app refuses configuration changes accordingly. Keys the tunnel
|
|
engine applies to the connection itself are not yet enforced on
|
|
iOS, because the engine runs in a Network Extension that does not
|
|
receive the app configuration. See the iOS section of
|
|
docs/src/pages/client/mdm-integration.mdx.
|
|
|
|
Keys with no iOS surface (allowServerSSH, disableServerRoutes,
|
|
disableAutostart, disableMetricsCollection, enableLocalMetrics,
|
|
localMetricsAddress, debugBundleUploadURL, splitTunnelMode,
|
|
splitTunnelApps) are parsed and ignored here, so one payload can be
|
|
shared with desktop devices.
|
|
|
|
blockInbound, wireguardPort and lazyConnection are left out of this
|
|
template on purpose: they are applied by the tunnel engine, which
|
|
on iOS does not receive this configuration yet. They do no harm in
|
|
a shared payload, they simply have no effect on an iOS device.
|
|
-->
|
|
<plist version="1.0">
|
|
<dict>
|
|
|
|
<!-- ===== Identity / auth ===== -->
|
|
<key>managementURL</key>
|
|
<string>https://api.netbird.io:443</string>
|
|
|
|
<!--
|
|
Pre-shared key: secret. Remove the entry entirely when not
|
|
used; do NOT leave an empty <string></string>, which the
|
|
client treats as a deliberate empty-PSK enforcement.
|
|
-->
|
|
<!--
|
|
<key>preSharedKey</key>
|
|
<string>REPLACE_ME</string>
|
|
-->
|
|
|
|
<!-- ===== Interface lockdown =====
|
|
disableUpdateSettings : read-only mode — nothing is hidden,
|
|
every configuration control is locked.
|
|
disableProfiles : hide the Profiles section (no create,
|
|
switch or remove).
|
|
disableNetworks : remove the Resources tab.
|
|
disableAdvancedView : hide Advanced (on tvOS, the whole
|
|
section). -->
|
|
<!--
|
|
<key>disableUpdateSettings</key>
|
|
<true/>
|
|
|
|
<key>disableProfiles</key>
|
|
<true/>
|
|
|
|
<key>disableNetworks</key>
|
|
<true/>
|
|
|
|
<key>disableAdvancedView</key>
|
|
<true/>
|
|
-->
|
|
|
|
<!-- ===== Connection controls =====
|
|
Each of these locks its own control in the app. -->
|
|
<!--
|
|
<key>disableAutoConnect</key>
|
|
<false/>
|
|
|
|
<key>disableClientRoutes</key>
|
|
<false/>
|
|
|
|
<key>rosenpassEnabled</key>
|
|
<true/>
|
|
|
|
<key>rosenpassPermissive</key>
|
|
<false/>
|
|
-->
|
|
|
|
<!-- ===== Remote jobs =====
|
|
Present at any value locks the client toggle, so pushing
|
|
false pins remote jobs off. -->
|
|
<!--
|
|
<key>allowRemoteJobs</key>
|
|
<false/>
|
|
-->
|
|
|
|
</dict>
|
|
</plist>
|