Alpine 3.14 reached end of life in May 2023 and has received no security
fixes for roughly three years. nginx is installed from the Alpine repos
rather than pinned, so the base bump also moves nginx 1.20.2 -> 1.30.4,
certbot 1.16.0 -> 5.6.0 and supervisor 4.2.2 -> 4.3.0.
Alpine 3.24 carries security support until June 2028.
Verified by building and running this Dockerfile on 3.14, 3.23 and 3.24 and
comparing: the served index.html is byte-identical across all three, the CSP
response header hashes identically, `nginx -t` passes on the existing config,
and supervisord reaches the same state. /etc/crontabs/root and
/etc/nginx/http.d/ still exist on 3.24, so the `rm /etc/crontabs/root` step and
the config COPY paths are unaffected. Every certbot flag used by init_cert.sh
is still accepted by certbot 5.x.
Certificate issuance itself could not be exercised without a real domain, so
the certbot 1.x -> 5.x jump should get one staging issuance before rollout.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(docker): reload nginx after patching CSP header
nginx is started by supervisord (priority 100) before init_react_envs.sh
(priority 201) and is never reloaded afterwards, so it keeps serving the
static default.conf CSP that has no connect-src. Over plain HTTP this blocks
OIDC discovery and the management API, breaking browser SSH/RDP auth.
Reload nginx at the end of the init script so the dynamically built CSP
header takes effect.
* Update docker/init_react_envs.sh
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(docker): log nginx -t output on failed CSP reload
When the reload never succeeds, run nginx -t before exiting so the logs show
whether the patched config is invalid or nginx never came up.
* conditionally emit `upgrade-insecure-requests` in CSP
---------
Co-authored-by: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
Brings the unified dashboard into the open-source repo. Premium features
ship in the open code, gated at runtime via NETBIRD_CLOUD and
NETBIRD_LICENSED, with upgrade prompts for unlicensed self-hosted
deployments. Adds the cloud-only feature areas (billing, integrations,
MSP, traffic events, notifications) and the Playwright e2e suite.
* Change icon size
* Remove integrations
* Add no cache header
* Add analytics event tracking
* Add small announcement improvements
* Remove peer approval setting
* Do not load countries when user has no permission
* Add tab query params to settings
* Decrease navigation font size
* Change order of providers
* Increase padding for modals
* Show page only when user is fully loaded and found
* Remove unused state
* Remove integrations page
On many IDP providers, the access token
is used to access the IDP's own API
With these changes, we allow users to define the proper token to be used for
management API calls
Cleans up config.json providing generic OIDC properties.
This allows for using other IDP providers besides Auth0.
The change is backward compatible with the previous versions.
Init scripts will remove ports for replacement when the user
provided default HTTP and HTTPS ports.
This was causing issues with trusted domain logic from the OIDC library.
Replacing Auth0's SDK with a more generic implementation of an OIDC client.
This will allow us to use other IDP providers that follow the OIDC standards.
Nicolas Frati
Eduard GertandClaude Opus 5
Maycon Santos
Misha Bragin
Max Bruch
Fabio Fantoni
Bethuel