mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-23 17:01:29 +02:00
8e05834384
Make getting-started.sh the single entry point for all self-hosted deployments. The wizard now asks two independent questions - identity provider (built-in vs standalone OIDC) and architecture (combined netbird-server vs separate management/signal/relay containers) - and renders the matching Docker Compose deployment with full reverse-proxy parity (built-in Traefik, external Traefik, Nginx, NPM, Caddy, manual). Highlights: - setup.env contract: every wizard answer is persisted; --non-interactive re-renders idempotently from the file (IaC), --render-only generates without starting services. Secrets are generated once and appended so re-renders never rotate them. - Split architecture renders a modern management.json (embedded Dex or external OIDC via PKCE), drops coturn entirely (the relay container serves STUN via NB_ENABLE_STUN), and optionally adds a PostgreSQL container when the postgres engine is selected without a DSN. - The standalone-IdP path is framed around its real differentiator: multi-account support. The built-in IdP supports external SSO connectors but enforces single account mode. - configure.sh, getting-started-with-dex.sh and getting-started-with-zitadel.sh print deprecation banners; their templates are frozen pending removal. - New tests/test-render.sh validates all 8 combos (JSON validity, compose config, idempotent re-render, combined+external rejection) and runs in CI as the test-render-matrix job.
112 lines
4.4 KiB
Plaintext
112 lines
4.4 KiB
Plaintext
# NetBird deployment configuration - example file
|
|
#
|
|
# Copy to setup.env, fill in the values, and render the deployment with:
|
|
# ./getting-started.sh --non-interactive
|
|
#
|
|
# Running ./getting-started.sh without flags starts an interactive wizard that
|
|
# writes this file for you. Re-rendering from the same file is idempotent, so
|
|
# it is safe to keep setup.env under configuration management (IaC).
|
|
#
|
|
# NOTE: the legacy configure.sh variable set (NETBIRD_TURN_DOMAIN, coturn,
|
|
# per-service ports, NETBIRD_DISABLE_LETSENCRYPT, ...) is deprecated together
|
|
# with configure.sh. See https://docs.netbird.io/selfhosted/selfhosted-guide
|
|
|
|
# Your NetBird domain, e.g. netbird.mydomain.com (required)
|
|
NETBIRD_DOMAIN=""
|
|
|
|
# Deployment architecture:
|
|
# combined - single netbird-server container (management + signal + relay + STUN)
|
|
# split - separate management, signal and relay containers (for scale-out,
|
|
# required when using your own OIDC provider)
|
|
NETBIRD_ARCHITECTURE="combined"
|
|
|
|
# Identity provider:
|
|
# embedded - built-in IdP with local users (simplest)
|
|
# external - your own OIDC provider (requires NETBIRD_ARCHITECTURE=split)
|
|
NETBIRD_IDP_MODE="embedded"
|
|
|
|
# -------------------------------------------
|
|
# External OIDC provider (NETBIRD_IDP_MODE=external)
|
|
# See https://docs.netbird.io/selfhosted/identity-providers
|
|
# -------------------------------------------
|
|
# e.g. https://keycloak.example.com/realms/netbird/.well-known/openid-configuration
|
|
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT=""
|
|
# OAuth client ID registered for NetBird, e.g. netbird
|
|
NETBIRD_AUTH_CLIENT_ID=""
|
|
# Client secret, only if your IdP requires one (e.g. Google Workspace)
|
|
NETBIRD_AUTH_CLIENT_SECRET=""
|
|
# JWT audience; defaults to the client ID when empty
|
|
NETBIRD_AUTH_AUDIENCE=""
|
|
# Scopes requested from the IdP
|
|
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email"
|
|
# Set to true only for Auth0
|
|
NETBIRD_USE_AUTH0="false"
|
|
# Token the dashboard sends to the management API: accessToken or idToken
|
|
# (Okta and GitLab benefit from idToken)
|
|
NETBIRD_TOKEN_SOURCE="accessToken"
|
|
|
|
# Device authorization flow for headless clients (optional)
|
|
#NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
|
|
|
|
# IdP management API for user/group sync (optional)
|
|
# eg. zitadel, auth0, azure, keycloak
|
|
#NETBIRD_MGMT_IDP=""
|
|
#NETBIRD_IDP_MGMT_CLIENT_ID=""
|
|
#NETBIRD_IDP_MGMT_CLIENT_SECRET=""
|
|
|
|
# -------------------------------------------
|
|
# Reverse proxy
|
|
# -------------------------------------------
|
|
# 0 = built-in Traefik (automatic TLS via Let's Encrypt)
|
|
# 1 = existing Traefik instance (labels)
|
|
# 2 = Nginx (config template is generated)
|
|
# 3 = Nginx Proxy Manager (advanced config is generated)
|
|
# 4 = external Caddy (Caddyfile snippet is generated)
|
|
# 5 = other/manual
|
|
NETBIRD_REVERSE_PROXY_TYPE="0"
|
|
# Let's Encrypt notification email (required for type 0)
|
|
NETBIRD_TRAEFIK_ACME_EMAIL=""
|
|
# Settings for an existing Traefik instance (type 1)
|
|
NETBIRD_TRAEFIK_EXTERNAL_NETWORK=""
|
|
NETBIRD_TRAEFIK_ENTRYPOINT="websecure"
|
|
NETBIRD_TRAEFIK_CERTRESOLVER=""
|
|
# Bind container ports to 127.0.0.1 only (types 2-5)
|
|
NETBIRD_BIND_LOCALHOST_ONLY="true"
|
|
# Docker network of your reverse proxy, if it runs in Docker (types 2-4)
|
|
NETBIRD_EXTERNAL_PROXY_NETWORK=""
|
|
|
|
# -------------------------------------------
|
|
# NetBird Proxy and CrowdSec
|
|
# (combined architecture with built-in Traefik only)
|
|
# -------------------------------------------
|
|
NETBIRD_ENABLE_PROXY="false"
|
|
NETBIRD_ENABLE_CROWDSEC="false"
|
|
|
|
# -------------------------------------------
|
|
# Datastore
|
|
# -------------------------------------------
|
|
# sqlite or postgres. With postgres and an empty DSN a PostgreSQL container is
|
|
# added to the deployment (split architecture only).
|
|
NETBIRD_STORE_CONFIG_ENGINE="sqlite"
|
|
NETBIRD_STORE_ENGINE_POSTGRES_DSN=""
|
|
NETBIRD_POSTGRES_PASSWORD=""
|
|
|
|
# -------------------------------------------
|
|
# Secrets
|
|
# Generated automatically on first run and appended to setup.env.
|
|
# Keep them stable across re-renders or peers will lose connectivity.
|
|
# -------------------------------------------
|
|
NETBIRD_RELAY_AUTH_SECRET=""
|
|
NETBIRD_DATASTORE_ENC_KEY=""
|
|
|
|
# -------------------------------------------
|
|
# Docker image overrides (optional)
|
|
# -------------------------------------------
|
|
#DASHBOARD_IMAGE="netbirdio/dashboard:latest"
|
|
#NETBIRD_SERVER_IMAGE="netbirdio/netbird-server:latest"
|
|
#MANAGEMENT_IMAGE="netbirdio/management:latest"
|
|
#SIGNAL_IMAGE="netbirdio/signal:latest"
|
|
#RELAY_IMAGE="netbirdio/relay:latest"
|
|
#POSTGRES_IMAGE="postgres:16-alpine"
|
|
#TRAEFIK_IMAGE="traefik:v3.6"
|