From c5739068081f9c37969a5ddffd7a31bcad88a980 Mon Sep 17 00:00:00 2001
From: mlsmaycon <mlsmaycon@gmail.com>
Date: Tue, 11 Aug 2026 11:48:17 +0000
Subject: [PATCH] [client] Document the remote-jobs MDM keys in the policy
 schemas

Add allowRemoteJobs (bool) and debugBundleUploadURL (string) to the
remaining MDM policy schema artifacts so administrators can enforce them
through every supported channel: the Windows ADMX/ADML templates, the
macOS .mobileconfig and the bare-plist helper, and the .reg example. The
macOS managed-preferences plist was covered with the code change.
---
 docs/netbird-macos.mobileconfig |  13 +++++++++++++
 docs/netbird-macos.sh           |   4 ++++
 docs/netbird-policy.reg         | Bin 1558 -> 1732 bytes
 docs/netbird.adml               |  12 ++++++++++++
 docs/netbird.admx               |  25 +++++++++++++++++++++++++
 5 files changed, 54 insertions(+)

diff --git a/docs/netbird-macos.mobileconfig b/docs/netbird-macos.mobileconfig
index 8216dd55d..203ca02af 100644
--- a/docs/netbird-macos.mobileconfig
+++ b/docs/netbird-macos.mobileconfig
@@ -121,6 +121,19 @@
                                 <false/>
                                 -->
 
+                                <!-- ===== Remote jobs (debug bundles) =====
+                                     allowRemoteJobs      : opt into management-requested
+                                                            remote jobs. Off by default.
+                                     debugBundleUploadURL : override the debug-bundle upload
+                                                            service (https URL); precedence
+                                                            over the management value. -->
+                                <!--
+                                <key>allowRemoteJobs</key>
+                                <true/>
+                                <key>debugBundleUploadURL</key>
+                                <string>https://upload.example.com</string>
+                                -->
+
                                 <!-- ===== WireGuard UDP port (int) =====
                                      Range 1-65535. Omit to keep the default. -->
                                 <!--
diff --git a/docs/netbird-macos.sh b/docs/netbird-macos.sh
index e40efd80d..bf5b78bcc 100644
--- a/docs/netbird-macos.sh
+++ b/docs/netbird-macos.sh
@@ -56,6 +56,8 @@ NULL='__UNSET__'
 managementURL='https://api.netbird.io:443'
 preSharedKey="$NULL"                       # secret; redacted in log
 allowServerSSH='true'
+allowRemoteJobs="$NULL"
+debugBundleUploadURL="$NULL"                # https URL; overrides management
 blockInbound="$NULL"
 disableAutoConnect="$NULL"
 disableAutostart="$NULL"
@@ -154,6 +156,8 @@ main() {
   is_set "$managementURL"             && emit_string  managementURL             "$managementURL"
   is_set "$preSharedKey"              && emit_string  preSharedKey              "$preSharedKey"
   is_set "$allowServerSSH"            && emit_bool    allowServerSSH            "$allowServerSSH"
+  is_set "$allowRemoteJobs"           && emit_bool    allowRemoteJobs           "$allowRemoteJobs"
+  is_set "$debugBundleUploadURL"      && emit_string  debugBundleUploadURL      "$debugBundleUploadURL"
   is_set "$blockInbound"              && emit_bool    blockInbound              "$blockInbound"
   is_set "$disableAutoConnect"        && emit_bool    disableAutoConnect        "$disableAutoConnect"
   is_set "$disableAutostart"          && emit_bool    disableAutostart          "$disableAutostart"
diff --git a/docs/netbird-policy.reg b/docs/netbird-policy.reg
index 7c5090942ca129eaf04a2576746c84340c577e61..d116e4c77d96ad4cd57d73792932645c73b2ffb8 100644
GIT binary patch
delta 148
zcmbQnbA)%p6h>J`h8!TwXDDX~Vn}7k1+q$jv=@+0Vkn-xkyU=O9Wz&ADv(#okj~%)
zB=Z<jfI3ncLKzCcIun8XP@rxf1|<etAkF}qPy&=IX0T$=2f|V$b$UR36%2_$dq8?q
T8T1&Efi~qbC~fX#>|_A|fMy>P

delta 12
TcmX@YJB??<6voX?Oie5RA36j!

diff --git a/docs/netbird.adml b/docs/netbird.adml
index 07e6c73a6..05cfb71ad 100644
--- a/docs/netbird.adml
+++ b/docs/netbird.adml
@@ -39,6 +39,12 @@
       <string id="AllowServerSSH_Name">Allow server SSH</string>
       <string id="AllowServerSSH_Help">When enabled, this client accepts incoming SSH sessions via NetBird SSH. Equivalent to --allow-server-ssh.</string>
 
+      <string id="AllowRemoteJobs_Name">Allow remote jobs</string>
+      <string id="AllowRemoteJobs_Help">When enabled, this client accepts management-requested remote jobs (e.g. debug bundles). Off by default. Equivalent to --allow-remote-jobs.</string>
+
+      <string id="DebugBundleUploadURL_Name">Debug bundle upload URL</string>
+      <string id="DebugBundleUploadURL_Help">Overrides the upload service used for debug bundles produced by remote jobs, taking precedence over the value requested by management. Must be an https URL with a host.</string>
+
       <string id="RosenpassEnabled_Name">Enable Rosenpass</string>
       <string id="RosenpassEnabled_Help">Enables Rosenpass post-quantum key exchange on WireGuard tunnels. Both peers must support it.</string>
 
@@ -79,6 +85,12 @@
         </textBox>
       </presentation>
 
+      <presentation id="DebugBundleUploadURL_Pres">
+        <textBox refId="DebugBundleUploadURL_Text">
+          <label>Debug bundle upload URL:</label>
+        </textBox>
+      </presentation>
+
       <presentation id="PreSharedKey_Pres">
         <textBox refId="PreSharedKey_Text">
           <label>Pre-shared key:</label>
diff --git a/docs/netbird.admx b/docs/netbird.admx
index 747447085..6a188cff1 100644
--- a/docs/netbird.admx
+++ b/docs/netbird.admx
@@ -124,6 +124,31 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="AllowRemoteJobs"
+            class="Machine"
+            displayName="$(string.AllowRemoteJobs_Name)"
+            explainText="$(string.AllowRemoteJobs_Help)"
+            key="Software\Policies\NetBird"
+            valueName="AllowRemoteJobs">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
+    <policy name="DebugBundleUploadURL"
+            class="Machine"
+            displayName="$(string.DebugBundleUploadURL_Name)"
+            explainText="$(string.DebugBundleUploadURL_Help)"
+            key="Software\Policies\NetBird"
+            presentation="$(presentation.DebugBundleUploadURL_Pres)">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <elements>
+        <text id="DebugBundleUploadURL_Text" valueName="DebugBundleUploadURL" required="false" />
+      </elements>
+    </policy>
+
     <policy name="RosenpassEnabled"
             class="Machine"
             displayName="$(string.RosenpassEnabled_Name)"