mirror of
https://github.com/netbirdio/docs.git
synced 2026-10-17 11:09:04 +02:00
riccardom
182b1b9e87
The reference table listed 18 of the 23 keys the client recognises, and claimed a count of 16. Six keys were missing from every downloadable template as well, including lazyConnection, which the page already documented: - lazyConnection, disableAdvancedView, enableLocalMetrics, localMetricsAddress, allowRemoteJobs and debugBundleUploadURL are now in the reference table and in netbird.admx/.adml, io.netbird.client.plist, netbird-macos.mobileconfig, netbird-macos.sh and netbird-policy.reg. - Notes call out the two pairs that read as related but are not: disableMetricsCollection (anonymous telemetry) versus enableLocalMetrics (the client's own Prometheus endpoint), and disableAdvancedView being UI-only, so unlike its neighbours it never causes a request to be rejected. iOS and tvOS now have a section of their own. The channel is Apple's Managed App Configuration against bundle id io.netbird.app (io.netbird.app.tv on tvOS), with a new netbird-ios-appconfig.plist template and per-provider instructions. The section states what the policy reaches today: the app locks its interface and refuses configuration changes, while the tunnel engine runs in a Network Extension that does not receive the app configuration, so keys the engine applies to the connection are not enforced there yet. Two template defects found on the way: - netbird-macos.mobileconfig was not well-formed XML. Its header comment contained a double hyphen, which XML forbids inside a comment, so plutil -lint and any strict parser rejected the file an admin downloaded. - netbird-policy.reg had one LF-terminated line among CRLF ones; normalised, with the UTF-16LE encoding reg import requires preserved. Verified with npm run build and npm run lint:mdx, plus XML well-formedness on all five XML templates, bash -n on the shell template, and a cross-reference check that every string and presentation the ADMX references is defined in the ADML.
130 lines
8.7 KiB
XML
130 lines
8.7 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
revision="1.0"
|
|
schemaVersion="1.0"
|
|
xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
|
|
<displayName>NetBird Client Policies</displayName>
|
|
<description>Group Policy template for NetBird client MDM-managed settings. Values are written under HKLM\Software\Policies\NetBird and consumed by the netbird daemon at startup and every 1-minute reload tick.</description>
|
|
<resources>
|
|
<stringTable>
|
|
|
|
<!-- Categories -->
|
|
<string id="NetBird_Category">NetBird</string>
|
|
<string id="SUPPORTED_NetBird_All">NetBird Client 0.40+</string>
|
|
|
|
<!-- Identity / auth -->
|
|
<string id="ManagementURL_Name">Management URL</string>
|
|
<string id="ManagementURL_Help">URL of the NetBird management server. Format: https://host[:port]. When set, users cannot override this value via UI or CLI.</string>
|
|
|
|
<string id="PreSharedKey_Name">Pre-shared key</string>
|
|
<string id="PreSharedKey_Help">WireGuard pre-shared key used as an additional symmetric secret on every peer-to-peer tunnel. Secret value.</string>
|
|
|
|
<!-- Settings: engine / runtime behavior -->
|
|
<string id="DisableAutoConnect_Name">Disable auto-connect</string>
|
|
<string id="DisableAutoConnect_Help">When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.</string>
|
|
|
|
<string id="DisableAutostart_Name">Disable autostart</string>
|
|
<string id="DisableAutostart_Help">When enabled, the NetBird GUI is prevented from registering itself as an OS autostart entry on fresh installs, and any existing OS autostart entry registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.</string>
|
|
|
|
<string id="DisableClientRoutes_Name">Disable client routes</string>
|
|
<string id="DisableClientRoutes_Help">When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.</string>
|
|
|
|
<string id="DisableServerRoutes_Name">Disable server routes</string>
|
|
<string id="DisableServerRoutes_Help">When enabled, this client will not act as a routing peer for other clients. Equivalent to --disable-server-routes.</string>
|
|
|
|
<string id="BlockInbound_Name">Block inbound</string>
|
|
<string id="BlockInbound_Help">When enabled, the client firewall blocks all inbound peer traffic on the WireGuard interface. Equivalent to --block-inbound.</string>
|
|
|
|
<string id="AllowServerSSH_Name">Allow server SSH</string>
|
|
<string id="AllowServerSSH_Help">When enabled, this client accepts incoming SSH sessions via NetBird SSH. Equivalent to --allow-server-ssh.</string>
|
|
|
|
<string id="RosenpassEnabled_Name">Enable Rosenpass</string>
|
|
<string id="RosenpassEnabled_Help">Enables Rosenpass post-quantum key exchange on WireGuard tunnels. Both peers must support it.</string>
|
|
|
|
<string id="RosenpassPermissive_Name">Rosenpass permissive</string>
|
|
<string id="RosenpassPermissive_Help">When enabled, the client falls back to plain WireGuard if a peer does not support Rosenpass; otherwise it refuses the connection.</string>
|
|
|
|
<string id="WireguardPort_Name">WireGuard port</string>
|
|
<string id="WireguardPort_Help">UDP port used by the local WireGuard interface. Allowed range: 1-65535.</string>
|
|
|
|
<string id="SplitTunnel_Name">Split tunnel</string>
|
|
<string id="SplitTunnel_Help">Restrict the NetBird tunnel to or from a chosen list of application package names. Choose either the allow mode (only the listed apps route through NetBird) or the disallow mode (the listed apps bypass NetBird; everything else routes through). The mode is mutually exclusive — only one can be active at a time. Android-only at the daemon level; Windows/macOS/iOS clients ignore this policy.</string>
|
|
<string id="SplitTunnel_Allow">Allow only listed apps (everything else bypasses)</string>
|
|
<string id="SplitTunnel_Disallow">Disallow listed apps (everything else routes)</string>
|
|
|
|
<!-- UI -->
|
|
<string id="DisableUpdateSettings_Name">Disable update settings</string>
|
|
<string id="DisableUpdateSettings_Help">When enabled, blocks every configuration change from the client UI and from the CLI (netbird up / login / setconfig). The Settings view stays viewable but read-only. Equivalent to --disable-update-settings.</string>
|
|
|
|
<string id="DisableProfiles_Name">Disable profiles</string>
|
|
<string id="DisableProfiles_Help">When enabled, the client UI/CLI cannot list, create, switch or remove NetBird connection profiles. Equivalent to --disable-profiles.</string>
|
|
|
|
<string id="DisableNetworks_Name">Disable networks</string>
|
|
<string id="DisableNetworks_Help">When enabled, the client UI/CLI cannot list, select or deselect NetBird networks (the corresponding daemon RPCs return Unavailable). Equivalent to --disable-networks.</string>
|
|
|
|
<string id="DisableMetricsCollection_Name">Disable metrics collection</string>
|
|
<string id="DisableMetricsCollection_Help">When enabled, the client does not collect or report local usage metrics.</string>
|
|
|
|
<string id="DisableAdvancedView_Name">Disable advanced view</string>
|
|
<string id="DisableAdvancedView_Help">When enabled, the client hides the advanced section of its interface. This policy only changes what the interface offers: it is not part of the daemon configuration and never causes a configuration change to be rejected. Setting it to Disabled explicitly re-enables the section.</string>
|
|
|
|
<string id="LazyConnection_Name">Lazy connections</string>
|
|
<string id="LazyConnection_Help">Local override for lazy connections. Enabled forces lazy connections on, Disabled forces them off, and leaving the policy Not Configured defers to the Management setting. The NB_LAZY_CONN environment variable takes precedence over this policy.</string>
|
|
|
|
<string id="AllowRemoteJobs_Name">Allow remote jobs</string>
|
|
<string id="AllowRemoteJobs_Help">Allows management-requested remote jobs, such as debug bundle requests, to run on this peer. Off by default; equivalent to --allow-remote-jobs. Configuring this policy at either value locks the corresponding client toggle, so Disabled pins remote jobs off.</string>
|
|
|
|
<string id="DebugBundleUploadURL_Name">Debug bundle upload URL</string>
|
|
<string id="DebugBundleUploadURL_Help">Overrides the upload service used for debug bundles produced by remote jobs, taking precedence over the value requested by Management. Must be an https URL including a host.</string>
|
|
|
|
<string id="EnableLocalMetrics_Name">Enable local metrics endpoint</string>
|
|
<string id="EnableLocalMetrics_Help">Exposes the client's local Prometheus /metrics endpoint. Unrelated to "Disable metrics collection", which governs anonymous usage telemetry.</string>
|
|
|
|
<string id="LocalMetricsAddress_Name">Local metrics listen address</string>
|
|
<string id="LocalMetricsAddress_Help">Listen address of the local Prometheus /metrics endpoint. Defaults to 127.0.0.1:9191 when the endpoint is enabled and this policy is Not Configured.</string>
|
|
|
|
</stringTable>
|
|
<presentationTable>
|
|
|
|
<presentation id="ManagementURL_Pres">
|
|
<textBox refId="ManagementURL_Text">
|
|
<label>Management URL:</label>
|
|
<defaultValue>https://api.netbird.io:443</defaultValue>
|
|
</textBox>
|
|
</presentation>
|
|
|
|
<presentation id="PreSharedKey_Pres">
|
|
<textBox refId="PreSharedKey_Text">
|
|
<label>Pre-shared key:</label>
|
|
</textBox>
|
|
</presentation>
|
|
|
|
<presentation id="WireguardPort_Pres">
|
|
<decimalTextBox refId="WireguardPort_Decimal" defaultValue="51820">WireGuard UDP port:</decimalTextBox>
|
|
</presentation>
|
|
|
|
<presentation id="SplitTunnel_Pres">
|
|
<dropdownList refId="SplitTunnel_Mode" defaultItem="0">Mode:</dropdownList>
|
|
<textBox refId="SplitTunnel_Apps">
|
|
<label>Package names (comma-separated):</label>
|
|
</textBox>
|
|
</presentation>
|
|
|
|
<presentation id="DebugBundleUploadURL_Pres">
|
|
<textBox refId="DebugBundleUploadURL_Text">
|
|
<label>Debug bundle upload URL:</label>
|
|
</textBox>
|
|
</presentation>
|
|
|
|
<presentation id="LocalMetricsAddress_Pres">
|
|
<textBox refId="LocalMetricsAddress_Text">
|
|
<label>Listen address:</label>
|
|
<defaultValue>127.0.0.1:9191</defaultValue>
|
|
</textBox>
|
|
</presentation>
|
|
|
|
</presentationTable>
|
|
</resources>
|
|
</policyDefinitionResources>
|