mirror of
https://github.com/netbirdio/netbird.git
synced 2026-04-16 15:26:40 +00:00
eb578146e4
Remove duplicate authorization data from Zitadel IdP. NetBird now stores all authorization data (account membership, invite status, roles) locally, while Zitadel only stores identity information (email, name, credentials). Changes: - Add PendingInvite field to User struct to track invite status locally - Simplify IdP Manager interface: remove metadata methods, add GetAllUsers - Update cache warming to match IdP users against NetBird DB - Remove addAccountIDToIDPAppMeta and all wt_* metadata writes - Delete legacy IdP managers (Auth0, Azure, Keycloak, Okta, Google Workspace, JumpCloud, Authentik, PocketId) - only Zitadel supported
189 lines
6.9 KiB
Bash
189 lines
6.9 KiB
Bash
## Most settings are being done automatically with the sourced variables from setup.env, but you can edit if you need some customization
|
|
|
|
# Management API
|
|
|
|
# Management API endpoint address, used by the Dashboard (Caddy handles TLS)
|
|
NETBIRD_MGMT_API_ENDPOINT=${NETBIRD_HTTP_PROTOCOL:-https}://$NETBIRD_DOMAIN
|
|
# By default Management single account mode is enabled and domain set to $NETBIRD_DOMAIN, you may want to set this to your user's email domain
|
|
NETBIRD_MGMT_SINGLE_ACCOUNT_MODE_DOMAIN=$NETBIRD_DOMAIN
|
|
NETBIRD_MGMT_DNS_DOMAIN=${NETBIRD_MGMT_DNS_DOMAIN:-netbird.selfhosted}
|
|
NETBIRD_MGMT_DISABLE_DEFAULT_POLICY=${NETBIRD_MGMT_DISABLE_DEFAULT_POLICY:-false}
|
|
|
|
# Signal
|
|
NETBIRD_SIGNAL_PROTOCOL=${NETBIRD_HTTP_PROTOCOL:-https}
|
|
NETBIRD_SIGNAL_PORT=${NETBIRD_SIGNAL_PORT:-443}
|
|
|
|
# Relay (internal port for Caddy reverse proxy)
|
|
NETBIRD_RELAY_INTERNAL_PORT=${NETBIRD_RELAY_INTERNAL_PORT:-80}
|
|
NETBIRD_RELAY_ENDPOINT=${NETBIRD_RELAY_ENDPOINT:-${NETBIRD_RELAY_PROTO:-rels}://$NETBIRD_DOMAIN:${NETBIRD_RELAY_PORT:-443}}
|
|
# Relay auth secret
|
|
NETBIRD_RELAY_AUTH_SECRET=
|
|
|
|
# Turn
|
|
TURN_DOMAIN=${NETBIRD_TURN_DOMAIN:-$NETBIRD_DOMAIN}
|
|
|
|
NETBIRD_TURN_EXTERNAL_IP=${NETBIRD_TURN_EXTERNAL_IP}
|
|
|
|
# Turn credentials
|
|
# User
|
|
TURN_USER=self
|
|
# Password. If empty, the configure.sh will generate one with openssl
|
|
TURN_PASSWORD=
|
|
# Min port
|
|
TURN_MIN_PORT=${TURN_MIN_PORT:-49152}
|
|
# Max port
|
|
TURN_MAX_PORT=${TURN_MAX_PORT:-65535}
|
|
|
|
VOLUME_PREFIX="netbird-"
|
|
MGMT_VOLUMESUFFIX="mgmt"
|
|
SIGNAL_VOLUMESUFFIX="signal"
|
|
LETSENCRYPT_VOLUMESUFFIX="letsencrypt"
|
|
|
|
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
|
|
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=${NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE:-$NETBIRD_AUTH_AUDIENCE}
|
|
NETBIRD_AUTH_DEVICE_AUTH_SCOPE=${NETBIRD_AUTH_DEVICE_AUTH_SCOPE:-openid}
|
|
NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=${NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN:-false}
|
|
|
|
|
|
NETBIRD_DISABLE_ANONYMOUS_METRICS=${NETBIRD_DISABLE_ANONYMOUS_METRICS:-false}
|
|
NETBIRD_TOKEN_SOURCE=${NETBIRD_TOKEN_SOURCE:-accessToken}
|
|
|
|
# PKCE authorization flow
|
|
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS=${NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS:-"53000"}
|
|
NETBIRD_AUTH_PKCE_USE_ID_TOKEN=${NETBIRD_AUTH_PKCE_USE_ID_TOKEN:-false}
|
|
NETBIRD_AUTH_PKCE_DISABLE_PROMPT_LOGIN=${NETBIRD_AUTH_PKCE_DISABLE_PROMPT_LOGIN:-false}
|
|
NETBIRD_AUTH_PKCE_LOGIN_FLAG=${NETBIRD_AUTH_PKCE_LOGIN_FLAG:-0}
|
|
NETBIRD_AUTH_PKCE_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
|
|
|
|
# Dashboard
|
|
|
|
# The default setting is to transmit the audience to the IDP during authorization. However,
|
|
# if your IDP does not have this capability, you can turn this off by setting it to false.
|
|
NETBIRD_DASH_AUTH_USE_AUDIENCE=${NETBIRD_DASH_AUTH_USE_AUDIENCE:-true}
|
|
NETBIRD_DASH_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
|
|
|
|
# Store config
|
|
NETBIRD_STORE_CONFIG_ENGINE=${NETBIRD_STORE_CONFIG_ENGINE:-"sqlite"}
|
|
|
|
# Image tags
|
|
NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-"latest"}
|
|
NETBIRD_SIGNAL_TAG=${NETBIRD_SIGNAL_TAG:-"latest"}
|
|
NETBIRD_MANAGEMENT_TAG=${NETBIRD_MANAGEMENT_TAG:-"latest"}
|
|
COTURN_TAG=${COTURN_TAG:-"latest"}
|
|
NETBIRD_RELAY_TAG=${NETBIRD_RELAY_TAG:-"latest"}
|
|
|
|
# exports
|
|
export NETBIRD_DOMAIN
|
|
export NETBIRD_TURN_DOMAIN
|
|
export NETBIRD_AUTH_CLIENT_ID
|
|
export NETBIRD_AUTH_CLIENT_SECRET
|
|
export NETBIRD_AUTH_AUDIENCE
|
|
export NETBIRD_AUTH_AUTHORITY
|
|
export NETBIRD_USE_AUTH0
|
|
export NETBIRD_AUTH_SUPPORTED_SCOPES
|
|
export NETBIRD_AUTH_JWT_CERTS
|
|
export NETBIRD_LETSENCRYPT_EMAIL
|
|
export NETBIRD_MGMT_API_PORT
|
|
export NETBIRD_MGMT_API_ENDPOINT
|
|
export NETBIRD_LETSENCRYPT_DOMAIN
|
|
export NETBIRD_MGMT_API_CERT_FILE
|
|
export NETBIRD_MGMT_API_CERT_KEY_FILE
|
|
export NETBIRD_AUTH_DEVICE_AUTH_PROVIDER
|
|
export NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID
|
|
export NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT
|
|
export NETBIRD_AUTH_REDIRECT_URI
|
|
export NETBIRD_AUTH_SILENT_REDIRECT_URI
|
|
export TURN_DOMAIN
|
|
export TURN_USER
|
|
export TURN_PASSWORD
|
|
export TURN_MIN_PORT
|
|
export TURN_MAX_PORT
|
|
export VOLUME_PREFIX
|
|
export MGMT_VOLUMESUFFIX
|
|
export SIGNAL_VOLUMESUFFIX
|
|
export LETSENCRYPT_VOLUMESUFFIX
|
|
export NETBIRD_DISABLE_ANONYMOUS_METRICS
|
|
export NETBIRD_MGMT_SINGLE_ACCOUNT_MODE_DOMAIN
|
|
export NETBIRD_MGMT_DNS_DOMAIN
|
|
export NETBIRD_MGMT_IDP_SIGNKEY_REFRESH
|
|
export NETBIRD_SIGNAL_PROTOCOL
|
|
export NETBIRD_SIGNAL_PORT
|
|
export NETBIRD_AUTH_USER_ID_CLAIM
|
|
export NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE
|
|
export NETBIRD_TOKEN_SOURCE
|
|
export NETBIRD_AUTH_DEVICE_AUTH_SCOPE
|
|
export NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN
|
|
export NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT
|
|
export NETBIRD_AUTH_PKCE_USE_ID_TOKEN
|
|
export NETBIRD_AUTH_PKCE_DISABLE_PROMPT_LOGIN
|
|
export NETBIRD_AUTH_PKCE_LOGIN_FLAG
|
|
export NETBIRD_AUTH_PKCE_AUDIENCE
|
|
export NETBIRD_DASH_AUTH_USE_AUDIENCE
|
|
export NETBIRD_DASH_AUTH_AUDIENCE
|
|
export NETBIRD_STORE_CONFIG_ENGINE
|
|
export NETBIRD_DASHBOARD_TAG
|
|
export NETBIRD_SIGNAL_TAG
|
|
export NETBIRD_MANAGEMENT_TAG
|
|
export COTURN_TAG
|
|
export NETBIRD_TURN_EXTERNAL_IP
|
|
export NETBIRD_RELAY_DOMAIN
|
|
export NETBIRD_RELAY_PORT
|
|
export NETBIRD_RELAY_ENDPOINT
|
|
export NETBIRD_RELAY_AUTH_SECRET
|
|
export NETBIRD_RELAY_TAG
|
|
export NETBIRD_MGMT_DISABLE_DEFAULT_POLICY
|
|
|
|
# Zitadel IdP Configuration
|
|
ZITADEL_TAG=${ZITADEL_TAG:-"v4.7.6"}
|
|
# Zitadel masterkey (32 bytes, auto-generated if not set)
|
|
ZITADEL_MASTERKEY=
|
|
# Zitadel admin credentials (auto-generated if not set)
|
|
ZITADEL_ADMIN_USERNAME=
|
|
ZITADEL_ADMIN_PASSWORD=
|
|
# Zitadel external configuration
|
|
ZITADEL_EXTERNALSECURE=${ZITADEL_EXTERNALSECURE:-true}
|
|
ZITADEL_EXTERNALPORT=${ZITADEL_EXTERNALPORT:-443}
|
|
ZITADEL_TLS_MODE=${ZITADEL_TLS_MODE:-external}
|
|
# Zitadel PAT expiration (1 year from startup)
|
|
ZITADEL_PAT_EXPIRATION=
|
|
# Zitadel management endpoint
|
|
ZITADEL_MANAGEMENT_ENDPOINT=${NETBIRD_HTTP_PROTOCOL:-https}://$NETBIRD_DOMAIN/management/v1
|
|
# HTTP protocol (http or https)
|
|
NETBIRD_HTTP_PROTOCOL=${NETBIRD_HTTP_PROTOCOL:-https}
|
|
# Caddy configuration
|
|
NETBIRD_CADDY_PORT=${NETBIRD_CADDY_PORT:-80}
|
|
CADDY_SECURE_DOMAIN=
|
|
|
|
# Zitadel OIDC endpoints
|
|
NETBIRD_AUTH_AUTHORITY=${NETBIRD_HTTP_PROTOCOL:-https}://$NETBIRD_DOMAIN
|
|
NETBIRD_AUTH_TOKEN_ENDPOINT=${NETBIRD_AUTH_AUTHORITY}/oauth/v2/token
|
|
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT=${NETBIRD_AUTH_AUTHORITY}/.well-known/openid-configuration
|
|
NETBIRD_AUTH_JWT_CERTS=${NETBIRD_AUTH_AUTHORITY}/.well-known/jwks.json
|
|
NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT=${NETBIRD_AUTH_AUTHORITY}/oauth/v2/authorize
|
|
NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT=${NETBIRD_AUTH_AUTHORITY}/oauth/v2/device_authorization
|
|
NETBIRD_AUTH_USER_ID_CLAIM=${NETBIRD_AUTH_USER_ID_CLAIM:-sub}
|
|
NETBIRD_AUTH_SUPPORTED_SCOPES=${NETBIRD_AUTH_SUPPORTED_SCOPES:-"openid profile email offline_access"}
|
|
|
|
# Zitadel exports
|
|
export ZITADEL_TAG
|
|
export ZITADEL_MASTERKEY
|
|
export ZITADEL_ADMIN_USERNAME
|
|
export ZITADEL_ADMIN_PASSWORD
|
|
export ZITADEL_EXTERNALSECURE
|
|
export ZITADEL_EXTERNALPORT
|
|
export ZITADEL_TLS_MODE
|
|
export ZITADEL_PAT_EXPIRATION
|
|
export ZITADEL_MANAGEMENT_ENDPOINT
|
|
export NETBIRD_HTTP_PROTOCOL
|
|
export NETBIRD_CADDY_PORT
|
|
export CADDY_SECURE_DOMAIN
|
|
export NETBIRD_AUTH_AUTHORITY
|
|
export NETBIRD_AUTH_TOKEN_ENDPOINT
|
|
export NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT
|
|
export NETBIRD_AUTH_JWT_CERTS
|
|
export NETBIRD_AUTH_PKCE_AUTHORIZATION_ENDPOINT
|
|
export NETBIRD_AUTH_DEVICE_AUTH_ENDPOINT
|
|
export NETBIRD_AUTH_USER_ID_CLAIM
|
|
export NETBIRD_AUTH_SUPPORTED_SCOPES
|
|
export NETBIRD_RELAY_INTERNAL_PORT
|