Alisdair MacLeod
5243481316
get OIDC configuration from proxy flags/env
2026-02-03 12:10:23 +00:00
Alisdair MacLeod
76a39c1dcb
Revert "add management side of OIDC authentication"
...
This reverts commit 02ce918114
2026-02-03 10:03:38 +00:00
Alisdair MacLeod
02ce918114
add management side of OIDC authentication
2026-02-03 09:42:40 +00:00
Alisdair MacLeod
30cfc22cb6
correct proto and proxy authentication for oidc
2026-02-03 09:01:39 +00:00
Alisdair MacLeod
3168afbfcb
clean up proxy reported urls when using them for validation
2026-02-02 15:59:24 +00:00
Alisdair MacLeod
a73ee47557
ignore ports when performing proxy mapping lookups
2026-02-02 14:39:13 +00:00
Alisdair MacLeod
fa6ff005f2
add validation logging
2026-02-02 10:53:46 +00:00
Alisdair MacLeod
095379fa60
add logging to domain validation
2026-02-02 10:27:20 +00:00
Alisdair MacLeod
30572fe1b8
add domain validation using values from proxies
2026-02-02 09:53:49 +00:00
Misha Bragin
b20d484972
[docs] Add selfhosting video ( #5235 )
2026-02-01 16:06:36 +01:00
Vlad
8931293343
[management] run cancelPeerRoutinesWithoutLock in sync ( #5234 )
2026-02-01 15:44:27 +01:00
Vlad
7b830d8f72
disable sync lim ( #5233 )
2026-02-01 14:37:00 +01:00
Misha Bragin
3a0cf230a1
Disable local users for a smooth single-idp mode ( #5226 )
...
Add LocalAuthDisabled option to embedded IdP configuration
This adds the ability to disable local (email/password) authentication when using the embedded Dex identity provider. When disabled, users can only authenticate via external
identity providers (Google, OIDC, etc.).
This simplifies user login when there is only one external IdP configured. The login page will redirect directly to the IdP login page.
Key changes:
Added LocalAuthDisabled field to EmbeddedIdPConfig
Added methods to check and toggle local auth: IsLocalAuthEnabled, HasNonLocalConnectors, DisableLocalAuth, EnableLocalAuth
Validation prevents disabling local auth if no external connectors are configured
Existing local users are preserved when disabled and can login again when re-enabled
Operations are idempotent (disabling already disabled is a no-op)
2026-02-01 14:26:22 +01:00
Alisdair MacLeod
3a6f364b03
use a defined logger
...
this should avoid issues with the embedded
client also attempting to use the same global logger
2026-01-30 16:31:32 +00:00
Alisdair MacLeod
5345d716ee
Merge branch 'main' into prototype/reverse-proxy
2026-01-30 14:46:08 +00:00
Alisdair MacLeod
f882c36e0a
simplify authentication
2026-01-30 14:08:52 +00:00
Viktor Liu
0c990ab662
[client] Add block inbound option to the embed client ( #5215 )
2026-01-30 10:42:39 +01:00
Viktor Liu
101c813e98
[client] Add macOS default resolvers as fallback ( #5201 )
2026-01-30 10:42:14 +01:00
Alisdair MacLeod
e95cfa1a00
add support for some basic authentication methods
2026-01-29 16:34:52 +00:00
Zoltan Papp
5333e55a81
Fix WG watcher missing initial handshake ( #5213 )
...
Start the WireGuard watcher before configuring the WG endpoint to ensure it captures the initial handshake timestamp.
Previously, the watcher was started after endpoint configuration, causing it to miss the handshake that occurred during setup.
2026-01-29 16:58:10 +01:00
pascal
0d480071b6
pass accountID
2026-01-29 14:47:22 +01:00
pascal
8e0b7b6c25
add api for access log events
2026-01-29 14:27:57 +01:00
Viktor Liu
81c11df103
[management] Streamline domain validation ( #5211 )
2026-01-29 13:51:44 +01:00
Alisdair MacLeod
f204da0d68
fix management reverseproxy proto mapping
2026-01-29 12:29:21 +00:00
Alisdair MacLeod
7d74904d62
add roundtripper debug log
2026-01-29 12:03:14 +00:00
Alisdair MacLeod
760ac5e07d
use the netbird client transport directly
2026-01-29 11:11:28 +00:00
Viktor Liu
f74bc48d16
[Client] Stop NetBird on firewall init failure ( #5208 )
2026-01-29 11:05:06 +01:00
Alisdair MacLeod
4352228797
allow setting the proxy url for autocert server name
2026-01-29 10:03:48 +00:00
Vlad
0169e4540f
[management] fix skip of ephemeral peers on deletion ( #5206 )
2026-01-29 10:58:45 +01:00
Alisdair MacLeod
74c770609c
fix access log context cancelled
2026-01-29 09:33:23 +00:00
Alisdair MacLeod
f4ca36ed7e
fix non-nil path assignment
2026-01-29 08:40:03 +00:00
mlsmaycon
c86da92fc6
update log init
2026-01-28 23:18:54 +01:00
mlsmaycon
3f0c577456
use util.InitLog
2026-01-28 22:59:08 +01:00
mlsmaycon
717da8c7b7
fix nil path
2026-01-28 22:40:39 +01:00
mlsmaycon
a0a61d4f47
add extra debug logs
2026-01-28 21:26:57 +01:00
Vlad
cead3f38ee
[management] fix ephemeral peers being not removed ( #5203 )
2026-01-28 18:24:12 +01:00
Alisdair MacLeod
5b1fced872
Merge remote-tracking branch 'origin/prototype/reverse-proxy' into prototype/reverse-proxy
2026-01-28 16:55:12 +00:00
Alisdair MacLeod
c98dcf5ef9
get all proxy endpoints when a proxy connects
2026-01-28 16:55:05 +00:00
pascal
57cb6bfccb
add log on broadcasting update
2026-01-28 17:52:38 +01:00
Alisdair MacLeod
95bf97dc3c
add env var for debug logs
2026-01-28 16:38:24 +00:00
Alisdair MacLeod
3d116c9d33
add debug logs and switch to logrus for logs
2026-01-28 15:44:35 +00:00
Zoltan Papp
b55262d4a2
[client] Refactor/optimise raw socket headers ( #5174 )
...
Pre-create and reuse packet headers to eliminate per-packet allocations.
2026-01-28 15:06:59 +01:00
Alisdair MacLeod
a9ce9f8d5a
add grpc TLS with selection inferred from management URL
2026-01-28 13:44:47 +00:00
Alisdair MacLeod
10b981a855
fix gorm id failures
2026-01-28 13:16:47 +00:00
Alisdair MacLeod
7700b4333d
correctly interpret custom domains from the database
2026-01-28 12:45:32 +00:00
Alisdair MacLeod
7d0131111e
Merge remote-tracking branch 'origin/prototype/reverse-proxy' into prototype/reverse-proxy
2026-01-28 12:36:23 +00:00
Alisdair MacLeod
1daea35e4b
remove scheme information from management address when connecting via grpc
2026-01-28 12:36:13 +00:00
pascal
f97544af0d
go mod tidy
2026-01-28 13:02:22 +01:00
pascal
231e80cc15
Merge branch 'main' into prototype/reverse-proxy
2026-01-28 12:52:42 +01:00
Alisdair MacLeod
a4c1362bff
pass proxy information to management on grpc connection
2026-01-28 10:50:35 +00:00
Alisdair MacLeod