netbird/combined/config.yaml.example

# NetBird Combined Server Configuration
# Copy this file to config.yaml and customize for your deployment
#
# This is a Management server with optional embedded Signal, Relay, and STUN services.
# By default, all services run locally. You can use external services instead by
# setting the corresponding override fields.
#
# Architecture:
#   - Management: Always runs locally (this IS the management server)
#   - Signal: Local by default; set 'signalUri' to use external (disables local)
#   - Relay: Local by default; set 'relays' to use external (disables local)
#   - STUN: Local on port 3478 by default; set 'stuns' to use external instead

server:
  # Main HTTP/gRPC port for all services (Management, Signal, Relay)
  listenAddress: ":443"

  # Public address that peers will use to connect to this server
  # Used for relay connections and management DNS domain
  # Format: protocol://hostname:port (e.g., https://server.mycompany.com:443)
  exposedAddress: "https://server.mycompany.com:443"

  # STUN server ports (defaults to [3478] if not specified; set 'stuns' to use external)
  # stunPorts:
  #   - 3478

  # Metrics endpoint port
  metricsPort: 9090

  # Healthcheck endpoint address
  healthcheckAddress: ":9000"

  # Logging configuration
  logLevel: "info"    # Default log level for all components: panic, fatal, error, warn, info, debug, trace
  logFile: "console"  # "console" or path to log file

  # TLS configuration (optional)
  tls:
    certFile: ""
    keyFile: ""
    letsencrypt:
      enabled: false
      dataDir: ""
      domains: []
      email: ""
      awsRoute53: false

  # Shared secret for relay authentication (required when running local relay).
  # Can also be set via NB_AUTH_SECRET; a non-empty value overrides this field.
  authSecret: "your-secret-key-here"

  # Data directory for all services
  dataDir: "/var/lib/netbird/"

  # ============================================================================
  # External Service Overrides (optional)
  # Use these to point to external Signal, Relay, or STUN servers instead of
  # running them locally. When set, the corresponding local service is disabled.
  # ============================================================================

  # External STUN servers - disables local STUN server
  # stuns:
  #   - uri: "stun:stun.example.com:3478"
  #   - uri: "stun:stun.example.com:3479"

  # External relay servers - disables local relay server
  # relays:
  #   addresses:
  #     - "rels://relay.example.com:443"
  #   credentialsTTL: "12h"
  #   secret: "relay-shared-secret"

  # External signal server - disables local signal server
  # signalUri: "https://signal.example.com:443"

  # ============================================================================
  # Management Settings
  # ============================================================================

  # Metrics and updates
  disableAnonymousMetrics: false
  disableGeoliteUpdate: false

  # Embedded authentication/identity provider (Dex) configuration (always enabled)
  auth:
    # OIDC issuer URL - must be publicly accessible
    issuer: "https://example.com/oauth2"
    localAuthDisabled: false
    signKeyRefreshEnabled: false
    # MFA session settings (applies when TOTP is enabled for an account)
    # mfaSessionMaxLifetime: "24h"  # Max duration for an MFA session from creation
    # mfaSessionIdleTimeout: "1h"   # MFA session expires after this idle period
    # mfaSessionRememberMe: false   # Pre-check "remember me" on login so the MFA session persists across tabs/restarts
    # Optional AES key for encrypting embedded IdP session cookies. Can also be set via NB_IDP_SESSION_COOKIE_ENCRYPTION_KEY.
    # Must be 16/24/32 raw bytes or base64-encoded to one of those lengths (for example: openssl rand -hex 16).
    # sessionCookieEncryptionKey: ""
    # OAuth2 redirect URIs for dashboard
    dashboardRedirectURIs:
      - "https://app.example.com/nb-auth"
      - "https://app.example.com/nb-silent-auth"
    # OAuth2 redirect URIs for CLI
    cliRedirectURIs:
      - "http://localhost:53000/"
    # OAuth2 post-logout redirect URIs for dashboard (RP-initiated logout)
    # dashboardPostLogoutRedirectURIs:
    #   - "https://app.example.com/"
    # Optional initial admin user
    # owner:
    #   email: "admin@example.com"
    #   password: "initial-password"

  # Store configuration
  store:
    engine: "sqlite"  # sqlite or postgres
    dsn: ""  # Connection string for postgres
    # Store field encryption key. Can also be set via NB_STORE_ENCRYPTION_KEY;
    # a non-empty value overrides this field.
    encryptionKey: ""
    # file: ""  # Custom SQLite file path (optional, defaults to {dataDir}/store.db)

  # Activity events store configuration (optional, defaults to sqlite in dataDir)
  # activityStore:
  #   engine: "sqlite"  # sqlite or postgres
  #   dsn: ""  # Connection string for postgres
  #   file: ""  # Custom SQLite file path (optional, defaults to {dataDir}/events.db)

  # Reverse proxy access log store configuration (optional, follows the store engine:
  # sqlite uses its own file in dataDir, postgres reuses the store DSN with a separate pool)
  # accessLogStore:
  #   engine: "postgres"  # sqlite or postgres
  #   dsn: ""  # Connection string for a dedicated postgres database
  #   file: ""  # Custom SQLite file path (optional, defaults to {dataDir}/access_logs.db)

  # Auth (embedded IdP) store configuration (optional, defaults to sqlite3 in dataDir/idp.db)
  # authStore:
  #   engine: "sqlite3"  # sqlite3 or postgres
  #   dsn: ""  # Connection string for postgres (e.g., "host=localhost port=5432 user=postgres password=postgres dbname=netbird_idp sslmode=disable")
  #   file: ""  # Custom SQLite file path (optional, defaults to {dataDir}/idp.db)

  # Reverse proxy settings (optional)
  # reverseProxy:
  #   trustedHTTPProxies: []           # CIDRs of trusted reverse proxies (e.g. ["10.0.0.0/8"])
  #   trustedHTTPProxiesCount: 0       # Number of trusted proxies in front of the server (alternative to trustedHTTPProxies)
  #   trustedPeers: []                 # CIDRs of trusted peer networks (e.g. ["100.64.0.0/10"])
  #   accessLogRetentionDays: 7        # Days to retain HTTP access logs. 0 (or unset) defaults to 7. Negative values disable cleanup (logs kept indefinitely).
  #   accessLogCleanupIntervalHours: 24 # How often (in hours) to run the access-log cleanup job. 0 (or unset) is treated as "not set" and defaults to 24 hours; cleanup remains enabled. To disable cleanup, set accessLogRetentionDays to a negative value.

  # Agent network (LLM gateway) settings (optional)
  # agentNetwork:
  #   # Path to the YAML file holding the default LLM pricing table. A relative
  #   # path is resolved against dataDir, so a bare filename like "pricing.yaml"
  #   # lands in the data directory. When empty, {dataDir}/defaults_llm_pricing.yaml
  #   # is probed; if no file is present the compiled-in defaults are used.
  #   # Schema: surface ("openai"/"anthropic"/"bedrock") -> model -> rates in USD
  #   # per 1k tokens (input_per_1k, output_per_1k, and the optional
  #   # cached_input_per_1k / cache_read_per_1k / cache_creation_per_1k). The file
  #   # is re-read periodically (mtime poll). An explicitly configured path that
  #   # fails to load fails startup; runtime reload errors keep the previous table.
  #   pricingDefaultsFile: "pricing.yaml"