Exclude the notifier response callback from generated bindings

Keep the UI running when the notification service fails to start
[infrastructure] Deprecate legacy Dex and Zitadel getting-started scripts (#6952 )
2026-07-29 20:01:29 +02:00 · 2026-07-29 15:14:54 +02:00 · 2026-07-29 13:47:28 +02:00 · 2026-07-29 12:20:43 +02:00
8 changed files with 156 additions and 1604 deletions
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -249,78 +249,35 @@ jobs:
          docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City_[0-9]*.mmdb
          docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames_[0-9]*.db

-  test-getting-started-script:
+  test-legacy-getting-started-scripts:
    runs-on: ubuntu-latest
    steps:
-      - name: Install jq
-        run: sudo apt-get install -y jq
-
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

-      - name: run script with Zitadel PostgreSQL
-        run: NETBIRD_DOMAIN=use-ip bash -x infrastructure_files/getting-started-with-zitadel.sh
-
-      - name: test Caddy file gen postgres
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen postgres
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen postgres
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen postgres
+      - name: Verify Dex retirement notice
        run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
+          if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Dex installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Dex support is not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/local" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt

-      - name: test zitadel.env file gen postgres
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen postgres
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen postgres
-        run: test -f relay.env
-
-      - name: test zdb.env file gen postgres
-        run: test -f zdb.env
-
-      - name: Postgres run cleanup
+      - name: Verify Zitadel retirement notice
        run: |
-          docker compose down --volumes --rmi all
-          rm -rf docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json zdb.env
-
-      - name: run script with Zitadel CockroachDB
-        run: bash -x infrastructure_files/getting-started-with-zitadel.sh
-        env:
-          NETBIRD_DOMAIN: use-ip
-          ZITADEL_DATABASE: cockroach
-
-      - name: test Caddy file gen CockroachDB
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen CockroachDB
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen CockroachDB
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen CockroachDB
-        run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
-
-      - name: test zitadel.env file gen CockroachDB
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen CockroachDB
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen CockroachDB
-        run: test -f relay.env
+          if bash infrastructure_files/getting-started-with-zitadel.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Zitadel installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Zitadel support and existing Zitadel deployments are not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/zitadel" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-guide" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -14,7 +14,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"

 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -63,7 +62,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *notifications.NotificationService
+	notifier        *Notifier
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -103,7 +102,7 @@ func main() {
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := notifications.New()
+	notifier := newNotifier()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -210,7 +209,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *notifications.NotificationService) {
+func requestNotificationAuthorization(notifier *Notifier) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)
--- a/client/ui/notifier.go
+++ b/client/ui/notifier.go
@@ -0,0 +1,101 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+)
+
+var errNotificationsUnavailable = errors.New("notifications unavailable")
+
+// Notifier wraps the Wails notification service so an unavailable backend
+// disables notifications instead of aborting the app. Startup fails for
+// environment reasons (a bare unbundled binary on macOS has no bundle
+// identifier, a headless Linux session has no D-Bus session bus), and Wails
+// treats a service startup error as fatal. After a failed startup every call
+// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
+// identifier raises an Objective-C exception that recover() cannot catch.
+type Notifier struct {
+	inner     *notifications.NotificationService
+	available atomic.Bool
+}
+
+func newNotifier() *Notifier {
+	return &Notifier{inner: notifications.New()}
+}
+
+// ServiceName implements the Wails service-name hook for startup logs.
+func (n *Notifier) ServiceName() string {
+	return n.inner.ServiceName()
+}
+
+// ServiceStartup starts the platform notifier, downgrading failure to a
+// warning so the app keeps running without notifications.
+func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
+	if err := n.inner.ServiceStartup(ctx, options); err != nil {
+		log.Warnf("notifications disabled: %v", err)
+		return nil
+	}
+	n.available.Store(true)
+	return nil
+}
+
+func (n *Notifier) ServiceShutdown() error {
+	if !n.available.Load() {
+		return nil
+	}
+	return n.inner.ServiceShutdown()
+}
+
+func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
+	if !n.available.Load() {
+		return false, errNotificationsUnavailable
+	}
+	return n.inner.CheckNotificationAuthorization()
+}
+
+func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
+	if !n.available.Load() {
+		return false, errNotificationsUnavailable
+	}
+	return n.inner.RequestNotificationAuthorization()
+}
+
+// SendNotification delivers a notification, silently dropping it when the
+// backend never started (notifications are best-effort everywhere).
+func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
+	if !n.available.Load() {
+		log.Debugf("notifications disabled, dropping %q", options.ID)
+		return nil
+	}
+	return n.inner.SendNotification(options)
+}
+
+func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
+	if !n.available.Load() {
+		log.Debugf("notifications disabled, dropping %q", options.ID)
+		return nil
+	}
+	return n.inner.SendNotificationWithActions(options)
+}
+
+func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
+	if !n.available.Load() {
+		return nil
+	}
+	return n.inner.RegisterNotificationCategory(category)
+}
+
+// OnNotificationResponse registers the response callback. Pure Go state, so
+// it is safe (and simply inert) when the backend never started.
+//
+//wails:ignore
+func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
+	n.inner.OnNotificationResponse(callback)
+}
--- a/client/ui/tray.go
+++ b/client/ui/tray.go
@@ -44,7 +44,7 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *notifications.NotificationService
+	Notifier        *Notifier
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager
--- a/client/ui/tray_notify.go
+++ b/client/ui/tray_notify.go
@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)
--- a/client/ui/tray_update.go
+++ b/client/ui/tray_update.go
@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *notifications.NotificationService
+	notifier     *Notifier
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }

-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,
--- a/infrastructure_files/getting-started-with-dex.sh
+++ b/infrastructure_files/getting-started-with-dex.sh
@@ -1,557 +1,19 @@
-#!/bin/bash
+#!/usr/bin/env bash

-set -e
+cat >&2 <<'EOF'
+ERROR: This legacy installation script has been retired and no longer runs.

-# NetBird Getting Started with Dex IDP
-# This script sets up NetBird with Dex as the identity provider
+Dex support is not deprecated. For new deployments, use getting-started.sh:

-# Sed pattern to strip base64 padding characters
-SED_STRIP_PADDING='s/=//g'
+https://docs.netbird.io/selfhosted/selfhosted-quickstart

-check_docker_compose() {
-  if command -v docker-compose &> /dev/null
-  then
-      echo "docker-compose"
-      return
-  fi
-  if docker compose --help &> /dev/null
-  then
-      echo "docker compose"
-      return
-  fi
+The current installer includes NetBird's embedded Dex-based identity provider.
+Local users and external identity providers can be managed through the
+NetBird Dashboard:

-  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
-  exit 1
-}
+https://docs.netbird.io/selfhosted/identity-providers/local

-check_jq() {
-  if ! command -v jq &> /dev/null
-  then
-    echo "jq is not installed or not in PATH, please install with your package manager. e.g. sudo apt install jq" > /dev/stderr
-    exit 1
-  fi
-  return 0
-}
-
-get_main_ip_address() {
-  if [[ "$OSTYPE" == "darwin"* ]]; then
-    interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
-    ip_address=$(ifconfig "$interface" | grep 'inet ' | awk '{print $2}')
-  else
-    interface=$(ip route | grep default | awk '{print $5}' | head -n 1)
-    ip_address=$(ip addr show "$interface" | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)
-  fi
-
-  echo "$ip_address"
-  return 0
-}
-
-check_nb_domain() {
-  DOMAIN=$1
-  if [[ "$DOMAIN-x" == "-x" ]]; then
-    echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
-    return 1
-  fi
-
-  if [[ "$DOMAIN" == "netbird.example.com" ]]; then
-    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
-    return 1
-  fi
-  return 0
-}
-
-read_nb_domain() {
-  READ_NETBIRD_DOMAIN=""
-  echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
-  read -r READ_NETBIRD_DOMAIN < /dev/tty
-  if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
-    read_nb_domain
-  fi
-  echo "$READ_NETBIRD_DOMAIN"
-  return 0
-}
-
-get_turn_external_ip() {
-  TURN_EXTERNAL_IP_CONFIG="#external-ip="
-  IP=$(curl -s -4 https://jsonip.com | jq -r '.ip')
-  if [[ "x-$IP" != "x-" ]]; then
-    TURN_EXTERNAL_IP_CONFIG="external-ip=$IP"
-  fi
-  echo "$TURN_EXTERNAL_IP_CONFIG"
-  return 0
-}
-
-wait_dex() {
-  set +e
-  echo -n "Waiting for Dex to become ready (via $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN)"
-  counter=1
-  while true; do
-    # Check Dex through Caddy proxy (also validates TLS is working)
-    if curl -sk -f -o /dev/null "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration" 2>/dev/null; then
-      break
-    fi
-    if [[ $counter -eq 60 ]]; then
-      echo ""
-      echo "Taking too long. Checking logs..."
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 caddy
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 dex
-    fi
-    echo -n " ."
-    sleep 2
-    counter=$((counter + 1))
-  done
-  echo " done"
-  set -e
-  return 0
-}
-
-init_environment() {
-  CADDY_SECURE_DOMAIN=""
-  NETBIRD_PORT=80
-  NETBIRD_HTTP_PROTOCOL="http"
-  NETBIRD_RELAY_PROTO="rel"
-  TURN_USER="self"
-  TURN_PASSWORD=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  TURN_MIN_PORT=49152
-  TURN_MAX_PORT=65535
-  TURN_EXTERNAL_IP_CONFIG=$(get_turn_external_ip)
-
-  # Generate secrets for Dex
-  DEX_DASHBOARD_CLIENT_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-
-  # Generate admin password
-  NETBIRD_ADMIN_PASSWORD=$(openssl rand -base64 16 | sed "$SED_STRIP_PADDING")
-
-  if ! check_nb_domain "$NETBIRD_DOMAIN"; then
-    NETBIRD_DOMAIN=$(read_nb_domain)
-  fi
-
-  if [[ "$NETBIRD_DOMAIN" == "use-ip" ]]; then
-    NETBIRD_DOMAIN=$(get_main_ip_address)
-  else
-    NETBIRD_PORT=443
-    CADDY_SECURE_DOMAIN=", $NETBIRD_DOMAIN:$NETBIRD_PORT"
-    NETBIRD_HTTP_PROTOCOL="https"
-    NETBIRD_RELAY_PROTO="rels"
-  fi
-
-  check_jq
-
-  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
-
-  if [[ -f dex.yaml ]]; then
-    echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
-    echo "You can use the following commands:"
-    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml Caddyfile dex.yaml dashboard.env turnserver.conf management.json relay.env"
-    echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
-    exit 1
-  fi
-
-  echo Rendering initial files...
-  render_docker_compose > docker-compose.yml
-  render_caddyfile > Caddyfile
-  render_dex_config > dex.yaml
-  render_dashboard_env > dashboard.env
-  render_management_json > management.json
-  render_turn_server_conf > turnserver.conf
-  render_relay_env > relay.env
-
-  echo -e "\nStarting Dex IDP\n"
-  $DOCKER_COMPOSE_COMMAND up -d caddy dex
-
-  # Wait for Dex to be ready (through caddy proxy)
-  sleep 3
-  wait_dex
-
-  echo -e "\nStarting NetBird services\n"
-  $DOCKER_COMPOSE_COMMAND up -d
-
-  echo -e "\nDone!\n"
-  echo "You can access the NetBird dashboard at $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
-  echo ""
-  echo "Login with the following credentials:"
-  install -m 600 /dev/null .env
-  printf 'Email: admin@%s\nPassword: %s\n' \
-      "$NETBIRD_DOMAIN" "$NETBIRD_ADMIN_PASSWORD" >> .env
-  echo "Email: admin@$NETBIRD_DOMAIN"
-  echo "Password: $NETBIRD_ADMIN_PASSWORD"
-  echo ""
-  echo "Dex admin UI is not available (Dex has no built-in UI)."
-  echo "To add more users, edit dex.yaml and restart: $DOCKER_COMPOSE_COMMAND restart dex"
-  return 0
-}
-
-render_caddyfile() {
-  cat <<EOF
-{
-  debug
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80${CADDY_SECURE_DOMAIN} {
-    import security_headers
-    # Relay
-    reverse_proxy /relay* relay:80
-    # Signal
-    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
-    # Management
-    reverse_proxy /api/* management:80
-    reverse_proxy /management.ManagementService/* h2c://management:80
-    # Dex
-    reverse_proxy /dex/* dex:5556
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+This compatibility notice will be removed in NetBird v0.80.
 EOF
-  return 0
-}

-render_dex_config() {
-  # Generate bcrypt hash of the admin password
-  # Using a simple approach - htpasswd or python if available
-  ADMIN_PASSWORD_HASH=""
-  if command -v htpasswd &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(htpasswd -bnBC 10 "" "$NETBIRD_ADMIN_PASSWORD" | tr -d ':\n')
-  elif command -v python3 &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(python3 -c "import bcrypt; print(bcrypt.hashpw('$NETBIRD_ADMIN_PASSWORD'.encode(), bcrypt.gensalt(rounds=10)).decode())" 2>/dev/null || echo "")
-  fi
-
-  # Fallback to a known hash if we can't generate one
-  if [[ -z "$ADMIN_PASSWORD_HASH" ]]; then
-    # This is hash of "password" - user should change it
-    ADMIN_PASSWORD_HASH='$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W'
-    NETBIRD_ADMIN_PASSWORD="password"
-    echo "Warning: Could not generate password hash. Using default password: password. Please change it in dex.yaml" > /dev/stderr
-  fi
-
-  cat <<EOF
-# Dex configuration for NetBird
-# Generated by getting-started-with-dex.sh
-
-issuer: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-
-storage:
-  type: sqlite3
-  config:
-    file: /var/dex/dex.db
-
-web:
-  http: 0.0.0.0:5556
-
-# gRPC API for user management (used by NetBird IDP manager)
-grpc:
-  addr: 0.0.0.0:5557
-
-oauth2:
-  skipApprovalScreen: true
-
-# Static OAuth2 clients for NetBird
-staticClients:
-  # Dashboard client
-  - id: netbird-dashboard
-    name: NetBird Dashboard
-    secret: $DEX_DASHBOARD_CLIENT_SECRET
-    redirectURIs:
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth
-
-  # CLI client (public - uses PKCE)
-  - id: netbird-cli
-    name: NetBird CLI
-    public: true
-    redirectURIs:
-      - http://localhost:53000/
-      - http://localhost:54000/
-
-# Enable password database for static users
-enablePasswordDB: true
-
-# Static users - add more users here as needed
-staticPasswords:
-  - email: "admin@$NETBIRD_DOMAIN"
-    hash: "$ADMIN_PASSWORD_HASH"
-    username: "admin"
-    userID: "$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "admin-user-id-001")"
-
-# Optional: Add external identity provider connectors
-# connectors:
-#   - type: github
-#     id: github
-#     name: GitHub
-#     config:
-#       clientID: \$GITHUB_CLIENT_ID
-#       clientSecret: \$GITHUB_CLIENT_SECRET
-#       redirectURI: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/callback
-#
-#   - type: ldap
-#     id: ldap
-#     name: LDAP
-#     config:
-#       host: ldap.example.com:636
-#       insecureNoSSL: false
-#       bindDN: cn=admin,dc=example,dc=com
-#       bindPW: admin
-#       userSearch:
-#         baseDN: ou=users,dc=example,dc=com
-#         filter: "(objectClass=person)"
-#         username: uid
-#         idAttr: uid
-#         emailAttr: mail
-#         nameAttr: cn
-EOF
-  return 0
-}
-
-render_turn_server_conf() {
-  cat <<EOF
-listening-port=3478
-$TURN_EXTERNAL_IP_CONFIG
-tls-listening-port=5349
-min-port=$TURN_MIN_PORT
-max-port=$TURN_MAX_PORT
-fingerprint
-lt-cred-mech
-user=$TURN_USER:$TURN_PASSWORD
-realm=wiretrustee.com
-cert=/etc/coturn/certs/cert.pem
-pkey=/etc/coturn/private/privkey.pem
-log-file=stdout
-no-software-attribute
-pidfile="/var/tmp/turnserver.pid"
-no-cli
-EOF
-  return 0
-}
-
-render_management_json() {
-  cat <<EOF
-{
-    "Stuns": [
-        {
-            "Proto": "udp",
-            "URI": "stun:$NETBIRD_DOMAIN:3478"
-        }
-    ],
-    "Relay": {
-        "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
-        "CredentialsTTL": "24h",
-        "Secret": "$NETBIRD_RELAY_AUTH_SECRET"
-    },
-    "Signal": {
-        "Proto": "$NETBIRD_HTTP_PROTOCOL",
-        "URI": "$NETBIRD_DOMAIN:$NETBIRD_PORT"
-    },
-    "HttpConfig": {
-        "AuthIssuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex",
-        "AuthAudience": "netbird-dashboard",
-        "OIDCConfigEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration"
-    },
-    "IdpManagerConfig": {
-        "ManagerType": "dex",
-        "ClientConfig": {
-            "Issuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex"
-        },
-        "ExtraConfig": {
-            "GRPCAddr": "dex:5557"
-        }
-    },
-    "DeviceAuthorizationFlow": {
-        "Provider": "hosted",
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "DeviceAuthEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/device/code",
-            "TokenEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/token"
-        }
-    },
-    "PKCEAuthorizationFlow": {
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "RedirectURLs": ["http://localhost:53000/", "http://localhost:54000/"]
-        }
-    }
-}
-EOF
-  return 0
-}
-
-render_dashboard_env() {
-  cat <<EOF
-# Endpoints
-NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-NETBIRD_MGMT_GRPC_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-# OIDC
-AUTH_AUDIENCE=netbird-dashboard
-AUTH_CLIENT_ID=netbird-dashboard
-AUTH_CLIENT_SECRET=$DEX_DASHBOARD_CLIENT_SECRET
-AUTH_AUTHORITY=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-USE_AUTH0=false
-AUTH_SUPPORTED_SCOPES=openid profile email offline_access
-AUTH_REDIRECT_URI=/nb-auth
-AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-# SSL
-NGINX_SSL_PORT=443
-# Letsencrypt
-LETSENCRYPT_DOMAIN=none
-EOF
-  return 0
-}
-
-render_relay_env() {
-  cat <<EOF
-NB_LOG_LEVEL=info
-NB_LISTEN_ADDRESS=:80
-NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT
-NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
-EOF
-  return 0
-}
-
-render_docker_compose() {
-  cat <<EOF
-services:
-  # Caddy reverse proxy
-  caddy:
-    image: caddy
-    container_name: netbird-caddy
-    restart: unless-stopped
-    networks: [netbird]
-    ports:
-      - '443:443'
-      - '443:443/udp'
-      - '80:80'
-    volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Dex - identity provider
-  dex:
-    image: ghcr.io/dexidp/dex:v2.38.0
-    container_name: netbird-dex
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - ./dex.yaml:/etc/dex/config.docker.yaml:ro
-      - netbird_dex_data:/var/dex
-    command: ["dex", "serve", "/etc/dex/config.docker.yaml"]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # UI dashboard
-  dashboard:
-    image: netbirdio/dashboard:latest
-    container_name: netbird-dashboard
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./dashboard.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Signal
-  signal:
-    image: netbirdio/signal:latest
-    container_name: netbird-signal
-    restart: unless-stopped
-    networks: [netbird]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Relay
-  relay:
-    image: netbirdio/relay:latest
-    container_name: netbird-relay
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./relay.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Management
-  management:
-    image: netbirdio/management:latest
-    container_name: netbird-management
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - netbird_management:/var/lib/netbird
-      - ./management.json:/etc/netbird/management.json
-    command: [
-      "--port", "80",
-      "--log-file", "console",
-      "--log-level", "info",
-      "--disable-anonymous-metrics=false",
-      "--single-account-mode-domain=netbird.selfhosted",
-      "--dns-domain=netbird.selfhosted",
-      "--idp-sign-key-refresh-enabled",
-    ]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Coturn, AKA TURN server
-  coturn:
-    image: coturn/coturn
-    container_name: netbird-coturn
-    restart: unless-stopped
-    volumes:
-      - ./turnserver.conf:/etc/turnserver.conf:ro
-    network_mode: host
-    command:
-      - -c /etc/turnserver.conf
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-volumes:
-  netbird_caddy_data:
-  netbird_dex_data:
-  netbird_management:
-
-networks:
-  netbird:
-EOF
-  return 0
-}
-
-init_environment
+exit 1
--- a/infrastructure_files/getting-started-with-zitadel.sh
+++ b/infrastructure_files/getting-started-with-zitadel.sh