Bump browser ssh versions for ssh rewrite

.github/pull_request_template.md

@@ -1,19 +0,0 @@
-## Issue ticket number and link
-
-## Documentation
-Select exactly one:
-
-- [ ] I added/updated documentation for this change
-- [ ] Documentation is **not needed** for this change (explain why)
-
-### Docs PR URL (required if "docs added" is checked)
-Paste the PR link from https://github.com/netbirdio/docs here:
-
-https://github.com/netbirdio/docs/pull/__
-
-## E2E tests
-Optional: override the image tags used by the Playwright e2e workflow.
-Defaults to `main` when omitted.
-
-management-cloud-tag: main
-reverse-proxy-tag: main

.github/workflows/build_and_push.yml

@@ -2,31 +2,25 @@ name: build and push
 on:
   push:
     branches:
+      - "feature/**"
       - main
     tags:
       - "**"
   pull_request:
 
-# Cancel in-progress runs on the same ref (PR or branch) when a new commit
-# arrives, so we don't waste CI building superseded commits.
-concurrency:
-  group: build-and-push-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 env:
-  DOCKERHUB_IMAGE: netbirdio/dashboard
-  GHCR_IMAGE: ghcr.io/netbirdio/dashboard-cloud
+  IMAGE_NAME: netbirdio/dashboard
 
 jobs:
   build_n_push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v3
 
       - name: setup-node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v3
         with:
-          node-version: '20'
+          node-version: '18'
           cache: 'npm'
 
       - name: Install dependencies
@@ -61,58 +55,29 @@ jobs:
           fileName: "ironrdp_web_bg.wasm"
           out-file-path: 'public/ironrdp-pkg'
 
-      - name: Get version from tag
-        id: version
-        run: |
-          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
-            echo "version=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-          else
-            echo "version=development" >> $GITHUB_OUTPUT
-          fi
-
       - name: Build
         run: npm run build
-        env:
-          NEXT_PUBLIC_DASHBOARD_VERSION: ${{ steps.version.outputs.version }}
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v2
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v4
         with:
-          images: |
-            ${{ env.DOCKERHUB_IMAGE }}
-            ${{ env.GHCR_IMAGE }}
-          flavor: |
-            latest=false
-          tags: |
-            type=schedule
-            type=ref,event=branch
-            type=ref,event=tag
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
-            type=ref,event=pr
-            type=sha
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+          images: ${{ env.IMAGE_NAME }}
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.NB_DOCKER_USER }}
           password: ${{ secrets.NB_DOCKER_TOKEN }}
-
-      - name: Log in to the GitHub Container registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+      -
+        name: Docker build and push
+        uses: docker/build-push-action@v3
         with:
           context: .
           file: docker/Dockerfile
@@ -120,7 +85,3 @@ jobs:
           platforms: linux/amd64,linux/arm64,linux/arm
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-      - run: |
-          echo '### Pushed tags' >> $GITHUB_STEP_SUMMARY
-          echo '${{ steps.meta.outputs.tags }}' >> $GITHUB_STEP_SUMMARY

.github/workflows/docs-ack.yml

@@ -1,105 +0,0 @@
-name: Docs Acknowledgement
-
-on:
-  pull_request:
-    types: [opened, edited, synchronize]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  docs-ack:
-    name: Require docs PR URL or explicit "not needed"
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Read PR body
-        id: body
-        shell: bash
-        run: |
-          set -euo pipefail
-          BODY_B64=$(jq -r '.pull_request.body // "" | @base64' "$GITHUB_EVENT_PATH")
-          {
-            echo "body_b64=$BODY_B64"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Validate checkbox selection
-        id: validate
-        shell: bash
-        env:
-          BODY_B64: ${{ steps.body.outputs.body_b64 }}
-        run: |
-          set -euo pipefail
-          if ! body="$(printf '%s' "$BODY_B64" | base64 -d)"; then
-            echo "::error::Failed to decode PR body from base64. Data may be corrupted or missing."
-            exit 1
-          fi
-
-          added_checked=$(printf '%s' "$body" | grep -Ei '^[[:space:]]*-\s*\[x\]\s*I added/updated documentation' | wc -l | tr -d '[:space:]' || true)
-          noneed_checked=$(printf '%s' "$body" | grep -Ei '^[[:space:]]*-\s*\[x\]\s*Documentation is \*\*not needed\*\*' | wc -l | tr -d '[:space:]' || true)
-
-          total=$((added_checked + noneed_checked))
-          if [ "$total" -ne 1 ]; then
-            echo "::error::You must check exactly one docs option in the PR template (either 'docs added' OR 'not needed')."
-            exit 1
-          fi
-
-          if [ "$added_checked" -eq 1 ]; then
-            echo "mode=added" >> "$GITHUB_OUTPUT"
-          else
-            echo "mode=noneed" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Extract docs PR URL (when 'docs added')
-        if: steps.validate.outputs.mode == 'added'
-        id: extract
-        shell: bash
-        env:
-          BODY_B64: ${{ steps.body.outputs.body_b64 }}
-        run: |
-          set -euo pipefail
-          body="$(printf '%s' "$BODY_B64" | base64 -d)"
-
-          # Strictly require HTTPS and that it's a PR in netbirdio/docs
-          # e.g., https://github.com/netbirdio/docs/pull/1234
-          url="$(printf '%s' "$body" | grep -Eo 'https://github\.com/netbirdio/docs/pull/[0-9]+' | head -n1 || true)"
-
-          if [ -z "${url:-}" ]; then
-            echo "::error::You checked 'docs added' but didn't include a valid HTTPS PR link to netbirdio/docs (e.g., https://github.com/netbirdio/docs/pull/1234)."
-            exit 1
-          fi
-
-          pr_number="$(printf '%s' "$url" | sed -E 's#.*/pull/([0-9]+)$#\1#')"
-          {
-            echo "url=$url"
-            echo "pr_number=$pr_number"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Verify docs PR exists (and is open or merged)
-        if: steps.validate.outputs.mode == 'added'
-        uses: actions/github-script@v7
-        id: verify
-        env:
-          PR_NUMBER: ${{ steps.extract.outputs.pr_number }}
-        with:
-          script: |
-            const prNumber = parseInt(process.env.PR_NUMBER, 10);
-            const { data } = await github.rest.pulls.get({
-              owner: 'netbirdio',
-              repo: 'docs',
-              pull_number: prNumber
-            });
-
-            // Allow open or merged PRs
-            const ok = data.state === 'open' || data.merged === true;
-            core.setOutput('state', data.state);
-            core.setOutput('merged', String(!!data.merged));
-            if (!ok) {
-              core.setFailed(`Docs PR #${prNumber} exists but is neither open nor merged (state=${data.state}, merged=${data.merged}).`);
-            }
-          result-encoding: string
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: All good
-        run: echo "Documentation requirement satisfied ✅"

.github/workflows/e2e-test.yml

@@ -1,162 +0,0 @@
-name: Playwright E2E Tests
-on:
-  push:
-    branches: [main]
-  pull_request:
-    # `edited` is included so that updating the PR description (e.g. to set
-    # `management-cloud-tag: <tag>` or `reverse-proxy-tag: <tag>`) re-triggers
-    # the e2e run with the new tag.
-    types: [opened, synchronize, reopened, edited]
-  workflow_dispatch:
-    inputs:
-      management-cloud-tag:
-        description: 'Management Cloud image tag'
-        required: true
-        type: string
-        default: 'main'
-      reverse-proxy-tag:
-        description: 'Reverse Proxy image tag'
-        required: true
-        type: string
-        default: 'main'
-
-env:
-  REGISTRY: ghcr.io
-
-jobs:
-  playwright-run:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.ref }}
-          fetch-depth: 0
-
-      - name: setup-node
-        uses: actions/setup-node@v5
-        with:
-          node-version: '20'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
-
-      - name: Log in to the Container registry
-        uses: docker/login-action@v4
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.CI_DOCKER_PULL_GITHUB_TOKEN }}
-
-      - run: echo '{}' > .local-config.json
-
-      - name: Install jq
-        run: sudo apt-get install jq
-
-      - name: Resolve management-cloud image tag
-        id: management_tag
-        env:
-          INPUT_TAG: ${{ inputs.management-cloud-tag }}
-          PR_BODY: ${{ github.event.pull_request.body }}
-        run: |
-          # Use workflow_dispatch input if provided, otherwise parse PR body.
-          # Falls back to `main` when not specified.
-          if [ -n "$INPUT_TAG" ]; then
-            TAG="$INPUT_TAG"
-          else
-            TAG=$(printf '%s' "$PR_BODY" \
-              | grep -iE '^[[:space:]]*management-cloud-tag:[[:space:]]*[A-Za-z0-9._-]+[[:space:]]*$' \
-              | head -n1 \
-              | sed -E 's/^[[:space:]]*[Mm]anagement-cloud-tag:[[:space:]]*([A-Za-z0-9._-]+)[[:space:]]*$/\1/' \
-              || true)
-            if [ -z "$TAG" ]; then
-              TAG="main"
-            fi
-          fi
-          echo "Using management-cloud tag: $TAG"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-
-      - name: Resolve reverse-proxy image tag
-        id: reverse_proxy_tag
-        env:
-          INPUT_TAG: ${{ inputs.reverse-proxy-tag }}
-          PR_BODY: ${{ github.event.pull_request.body }}
-        run: |
-          if [ -n "$INPUT_TAG" ]; then
-            TAG="$INPUT_TAG"
-          else
-            TAG=$(printf '%s' "$PR_BODY" \
-              | grep -iE '^[[:space:]]*reverse-proxy-tag:[[:space:]]*[A-Za-z0-9._-]+[[:space:]]*$' \
-              | head -n1 \
-              | sed -E 's/^[[:space:]]*[Rr]everse-proxy-tag:[[:space:]]*([A-Za-z0-9._-]+)[[:space:]]*$/\1/' \
-              || true)
-            if [ -z "$TAG" ]; then
-              TAG="main"
-            fi
-          fi
-          echo "Using reverse-proxy tag: $TAG"
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-
-      - name: Setup test environment
-        env:
-          MANAGEMENT_IMAGE_TAG: ${{ steps.management_tag.outputs.tag }}
-          REVERSE_PROXY_IMAGE_TAG: ${{ steps.reverse_proxy_tag.outputs.tag }}
-        run: cd ./e2e/environment && bash create-test-env.sh
-
-      - name: Run Playwright tests
-        id: playwright
-        run: |
-          set -o pipefail
-          npm run test:ci 2>&1 | tee playwright-output.log
-
-      - name: Append Playwright summary to job summary
-        if: always() && hashFiles('e2e/test-results/results.json') != ''
-        run: |
-          if [ -f e2e/test-results/results.json ]; then
-            passed=$(jq '.stats.expected // 0' e2e/test-results/results.json)
-            failed=$(jq '.stats.unexpected // 0' e2e/test-results/results.json)
-            skipped=$(jq '.stats.skipped // 0' e2e/test-results/results.json)
-            duration=$(jq '.stats.duration // 0' e2e/test-results/results.json)
-            {
-              echo '### Playwright results'
-              echo ''
-              echo "| Passed | Failed | Skipped | Duration |"
-              echo "|--------|--------|---------|----------|"
-              echo "| $passed | $failed | $skipped | ${duration}ms |"
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      - name: Collect container logs
-        if: failure()
-        run: |
-          cd e2e/environment
-          docker compose logs management --tail=500 --no-color > management.log 2>&1 || true
-          docker compose logs reverse-proxy --tail=500 --no-color > reverse-proxy.log 2>&1 || true
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ !cancelled() }}
-        with:
-          name: playwright-report
-          path: e2e/playwright-report/
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ failure() }}
-        with:
-          name: playwright-traces
-          path: e2e/test-results/
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ failure() }}
-        with:
-          name: management-logs
-          path: e2e/environment/management.log
-
-      - uses: actions/upload-artifact@v7
-        if: ${{ failure() }}
-        with:
-          name: reverse-proxy-logs
-          path: e2e/environment/reverse-proxy.log

.gitignore

@@ -36,14 +36,7 @@ yarn-error.log*
 next-env.d.ts
 
 # config
-.local*config*.json
-.test-config.json
-e2e/playwright.env.json
-e2e/fixtures/auth/*.json
-e2e/test-results/
-e2e/playwright-report/
-/test-results/
-/playwright-report/
+.local-config.json
 .configs/.local-config.zitadel.json
 .configs/.staging-config.json
 .configs/.temp-config.json

AUTHORS

@@ -1,3 +1,3 @@
 Mikhail Bragin (https://github.com/braginini)
 Maycon Santos (https://github.com/mlsmaycon)
-NetBird GmbH
+Wiretrustee UG (haftungsbeschränkt)

CONTRIBUTOR_LICENSE_AGREEMENT.md

@@ -1,7 +1,7 @@
 ##  Contributor License Agreement
 
 This Contributor License Agreement (referred to as the "Agreement") is entered into by the individual 
-submitting this Agreement and NetBird GmbH, Brunnenstraße 196, 10119 Berlin, Germany, 
+submitting this Agreement and NetBird GmbH, c/o Max-Beer-Straße 2-4 Münzstraße 12 10178 Berlin, Germany, 
 referred to as "NetBird" (collectively, the "Parties"). The Agreement outlines the terms and conditions 
 under which NetBird may utilize software contributions provided by the Contributor for inclusion in 
 its software development projects. By submitting this Agreement, the Contributor confirms their acceptance 

README.md

@@ -10,7 +10,6 @@ See [NetBird repo](https://github.com/netbirdio/netbird)
 
 The purpose of this project is simple - make it easy to manage VPN built with [NetBird](https://github.com/netbirdio/netbird).
 The dashboard makes it possible to:
-
 - track the status of your peers
 - remove peers
 - manage Setup Keys (to authenticate new peers)
@@ -18,10 +17,10 @@ The dashboard makes it possible to:
 - define access controls
 
 ## Some Screenshots
-
 <img src="./src/assets/screenshots/peers.png" alt="peers"/>
 <img src="./src/assets/screenshots/add-peer.png" alt="add-peer"/>
 
+
 ## Technologies Used
 
 - NextJS
@@ -34,9 +33,8 @@ The dashboard makes it possible to:
 - Let's Encrypt
 
 ## How to run
-
 Disclaimer. We believe that proper user management system is not a trivial task and requires quite some effort to make it right. Therefore we decided to
-use Auth0 service that covers all our needs (user management, social login, JWT for the management API).
+use Auth0 service that covers all our needs (user management, social login, JTW for the management API).
 Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
 
 1. Install [Docker](https://docs.docker.com/get-docker/)
@@ -45,9 +43,9 @@ Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
 
    `AUTH0_DOMAIN` `AUTH0_CLIENT_ID` `AUTH0_AUDIENCE`
 
-   To obtain these, please use [Auth0 React SDK Guide](https://auth0.com/docs/quickstart/spa/react) up until "Configure Allowed Web Origins"
+   To obtain these, please use [Auth0 React SDK Guide](https://auth0.com/docs/quickstart/spa/react/01-login#configure-auth0) up until "Configure Allowed Web Origins"
 
-4. NetBird UI Dashboard uses NetBird's Management Service HTTP API, so setting `NETBIRD_MGMT_API_ENDPOINT` is required. Most likely it will be `http://localhost:33071` if you are hosting Management API on the same server.
+4. NetBird UI Dashboard uses NetBirds Management Service HTTP API, so setting `NETBIRD_MGMT_API_ENDPOINT` is required. Most likely it will be `http://localhost:33071` if you are hosting Management API on the same server.
 5. Run docker container without SSL (Let's Encrypt):
 
    ```shell
@@ -56,10 +54,9 @@ Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
      -e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \
      -e AUTH0_CLIENT_ID=<SET YOUR CLIENT ID> \
      -e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \
-     -e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \
+     -e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMETN API URL> \
      netbirdio/dashboard:main
    ```
-
 6. Run docker container with SSL (Let's Encrypt):
 
    ```shell
@@ -71,7 +68,7 @@ Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
      -e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \
      -e AUTH0_CLIENT_ID=<SET YOUR CLEITN ID> \
      -e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \
-     -e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \
+     -e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMETN API URL> \
      netbirdio/dashboard:main
    ```
 
@@ -87,11 +84,11 @@ Open [http://localhost:3000](http://localhost:3000) with your browser to see the
 You can start editing by modifying the code inside `src/..`  
 The page auto-updates as you edit the file.
 
-## How to migrate from old dashboard (v1)
+## How to migrate from old dashboard (v1) 
 
 The new dashboard comes with a new docker image `netbirdio/dashboard:main`.  
 To migrate from the old dashboard (v1) `wiretrustee/dashboard:main` to the new one, please follow the steps below.
 
 1. Stop the dashboard container `docker compose down dashboard`
 2. Replace the docker image name in your `docker-compose.yml` with `netbirdio/dashboard:main`
-3. Recreate the dashboard container `docker compose up -d --force-recreate dashboard`
+3. Recreate the dashboard container `docker compose up -d --force-recreate dashboard`

announcements.json

@@ -1,12 +0,0 @@
-[
-  {
-    "tag": "Preview",
-    "text": "The new NetBird desktop app is here - now available as a 0.75 release candidate.",
-    "link": "https://github.com/netbirdio/netbird/discussions/6483",
-    "linkText": "Learn more",
-    "variant": "important",
-    "isExternal": true,
-    "closeable": true,
-    "isCloudOnly": false
-  }
-]

build.sh

@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-#
-# Build the netbird-dashboard Docker image for linux/amd64 and export it as a
-# portable tarball that can be loaded and run on a remote server.
-#
-# The dashboard image is nginx serving a Next.js *static export*: the Dockerfile
-# only COPYs the pre-built out/ directory, so we build out/ on the host first
-# (the static files are arch-independent) and then assemble the amd64 image.
-#
-# Usage:
-#   ./build.sh                # build + export netbird-dashboard.tar.gz
-#   IMAGE_TAG=v1 ./build.sh   # override the image tag
-#   SKIP_BUILD=1 ./build.sh   # reuse an existing out/ (skip npm build)
-#
-set -euo pipefail
-
-# Always run relative to this script's directory (the project root).
-cd "$(dirname "$0")"
-
-IMAGE_NAME="${IMAGE_NAME:-netbird-dashboard}"
-IMAGE_TAG="${IMAGE_TAG:-amd64}"
-IMAGE="${IMAGE_NAME}:${IMAGE_TAG}"
-OUTPUT="${OUTPUT:-${IMAGE_NAME}.tar.gz}"
-
-# Build the static export (out/) unless told to reuse an existing one. Next 16
-# no longer runs ESLint during `next build`; types are checked by the build via
-# tsc (verify separately with `npx tsc --noEmit`).
-if [[ "${SKIP_BUILD:-0}" != "1" ]]; then
-  if [[ ! -d node_modules ]]; then
-    echo "==> Installing dependencies (npm ci)"
-    npm ci
-  fi
-  echo "==> Building static export (next build) into out/"
-  npx next build
-fi
-
-if [[ ! -d out ]]; then
-  echo "ERROR: out/ not found — the static export did not build." >&2
-  exit 1
-fi
-
-# The .dockerignore lives under docker/, but Docker reads it from the build
-# context root. Stage it for the duration of the build so node_modules/.next
-# don't get shipped into the build context.
-cleanup() { rm -f .dockerignore; }
-trap cleanup EXIT
-cp docker/.dockerignore .dockerignore
-
-echo "==> Building ${IMAGE} for linux/amd64"
-docker build \
-  --platform linux/amd64 \
-  -f docker/Dockerfile \
-  -t "${IMAGE}" \
-  .
-
-echo "==> Exporting ${IMAGE} to ${OUTPUT}"
-docker save "${IMAGE}" | gzip > "${OUTPUT}"
-
-echo "==> Done: ${OUTPUT} ($(du -h "${OUTPUT}" | cut -f1))"
-echo
-echo "Copy and run on the server:"
-echo "  scp ${OUTPUT} user@your-server:/tmp/"
-echo "  docker load < /tmp/${OUTPUT}"
-echo
-echo "Run (nginx serves on container port 80). Set the runtime env vars the"
-echo "dashboard templates at startup — for the Agent Network onboarding test,"
-echo "flip NETBIRD_AGENT_NETWORK_ONLY=true:"
-echo "  docker run -d --name ${IMAGE_NAME} --restart unless-stopped \\"
-echo "    -p 8080:80 \\"
-echo "    -e NETBIRD_MGMT_API_ENDPOINT=https://your-mgmt:443 \\"
-echo "    -e AUTH_AUTHORITY=https://your-idp/realms/netbird \\"
-echo "    -e AUTH_CLIENT_ID=netbird-dashboard \\"
-echo "    -e AUTH_AUDIENCE=netbird-dashboard \\"
-echo "    -e AUTH_SUPPORTED_SCOPES='openid profile email' \\"
-echo "    -e USE_AUTH0=false \\"
-echo "    -e NETBIRD_AGENT_NETWORK_ONLY=true \\"
-echo "    ${IMAGE}"

config.json

@@ -14,15 +14,5 @@
   "hotjarTrackID": "$NETBIRD_HOTJAR_TRACK_ID",
   "googleAnalyticsID": "$NETBIRD_GOOGLE_ANALYTICS_ID",
   "googleTagManagerID": "$NETBIRD_GOOGLE_TAG_MANAGER_ID",
-  "authServiceUrl": "$NETBIRD_AUTH_SERVICE_URL",
-  "wasmPath": "$NETBIRD_WASM_PATH",
-  "licensed": "$NETBIRD_LICENSED",
-  "cloud": "$NETBIRD_CLOUD",
-  "agentNetworkOnly": "$NETBIRD_AGENT_NETWORK_ONLY",
-  "agentNetworkEnabled": "$NETBIRD_AGENT_NETWORK_ENABLED",
-  "hubspotPortalId": "$NETBIRD_HUBSPOT_PORTAL_ID",
-  "hubspotSignupFormId": "$NETBIRD_HUBSPOT_SIGNUP_FORM_ID",
-  "hubspotOnboardingFormId": "$NETBIRD_HUBSPOT_ONBOARDING_FORM_ID",
-  "hubspotSurveyFormId": "$NETBIRD_HUBSPOT_SURVEY_FORM_ID",
-  "analyticsExcludedEmails": "$NETBIRD_ANALYTICS_EXCLUDED_EMAILS"
-}
+  "wasmPath": "$NETBIRD_WASM_PATH"
+}

cypress.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from "cypress";
+
+export default defineConfig({
+  e2e: {
+    baseUrl: "http://localhost:3000",
+  },
+  component: {
+    devServer: {
+      framework: "next",
+      bundler: "webpack",
+    },
+  },
+  viewportWidth: 1920,
+  viewportHeight: 1080,
+});

cypress/e2e/test.cy.ts

@@ -0,0 +1,13 @@
+describe("Click all tabs in peer modal", () => {
+  it("passes", () => {
+    cy.visit("/install");
+    cy.get("div").contains("Linux").click();
+    cy.get("[data-cy=copy-to-clipboard]").click();
+    cy.get("div").contains("Windows").click();
+    cy.get("[data-cy=copy-to-clipboard]").click();
+    cy.get("div").contains("Android").click();
+    cy.get("[data-cy=copy-to-clipboard]").click();
+    cy.get("div").contains("Docker").click();
+    cy.get("[data-cy=copy-to-clipboard]").click();
+  });
+});

cypress/fixtures/example.json

@@ -0,0 +1,5 @@
+{
+  "name": "Using fixtures to represent data",
+  "email": "hello@cypress.io",
+  "body": "Fixtures are a great way to mock data for responses to routes"
+}

cypress/support/commands.ts

@@ -0,0 +1,37 @@
+/// <reference types="cypress" />
+// ***********************************************
+// This example commands.ts shows you how to
+// create various custom commands and overwrite
+// existing commands.
+//
+// For more comprehensive examples of custom
+// commands please read more here:
+// https://on.cypress.io/custom-commands
+// ***********************************************
+//
+//
+// -- This is a parent command --
+// Cypress.Commands.add('login', (email, password) => { ... })
+//
+//
+// -- This is a child command --
+// Cypress.Commands.add('drag', { prevSubject: 'element'}, (subject, options) => { ... })
+//
+//
+// -- This is a dual command --
+// Cypress.Commands.add('dismiss', { prevSubject: 'optional'}, (subject, options) => { ... })
+//
+//
+// -- This will overwrite an existing command --
+// Cypress.Commands.overwrite('visit', (originalFn, url, options) => { ... })
+//
+// declare global {
+//   namespace Cypress {
+//     interface Chainable {
+//       login(email: string, password: string): Chainable<void>
+//       drag(subject: string, options?: Partial<TypeOptions>): Chainable<Element>
+//       dismiss(subject: string, options?: Partial<TypeOptions>): Chainable<Element>
+//       visit(originalFn: CommandOriginalFn, url: string, options: Partial<VisitOptions>): Chainable<Element>
+//     }
+//   }
+// }

cypress/support/e2e.ts

@@ -0,0 +1,20 @@
+// ***********************************************************
+// This example support/e2e.ts is processed and
+// loaded automatically before your test files.
+//
+// This is a great place to put global configuration and
+// behavior that modifies Cypress.
+//
+// You can change the location of this file or turn off
+// automatically serving support files with the
+// 'supportFile' configuration option.
+//
+// You can read more here:
+// https://on.cypress.io/configuration
+// ***********************************************************
+
+// Import commands.js using ES2015 syntax:
+import './commands'
+
+// Alternatively you can use CommonJS syntax:
+// require('./commands')

cypress/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "compilerOptions": {
+    "target": "es5",
+    "lib": ["es5", "dom"],
+    "baseUrl": "http://localhost:3000",
+    "types": ["cypress", "node"],
+  },
+  "include": ["**/*.ts"]
+}

docker/.dockerignore

@@ -1,12 +0,0 @@
-# The image only needs the pre-built static export (out/) and the docker/
-# config files. Keep the build context small by dropping everything heavy and
-# irrelevant — without this, `docker build .` ships node_modules and .next.
-node_modules
-.next
-.git
-.github
-e2e
-src
-public
-*.tar.gz
-*.tar

docker/default.conf

@@ -14,24 +14,14 @@ server {
 
     location / {
       try_files $uri $uri.html $uri/ =404;
-      add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
-      add_header X-Frame-Options "SAMEORIGIN" always;
-      add_header X-Content-Type-Options "nosniff" always;
-      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-      add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ws: wss: https:;" always;
-      add_header Last-Modified "";
+      add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
       expires off;
    }
 
    error_page 404 /404.html;
    location = /404.html {
       internal;
-      add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
-      add_header X-Frame-Options "SAMEORIGIN" always;
-      add_header X-Content-Type-Options "nosniff" always;
-      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-      add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ws: wss: https:;" always;
-      add_header Last-Modified "";
+      add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
       expires off;
    }
 }

docker/init_react_envs.sh

@@ -61,109 +61,12 @@ export NETBIRD_GOOGLE_ANALYTICS_ID=${NETBIRD_GOOGLE_ANALYTICS_ID}
 export NETBIRD_GOOGLE_TAG_MANAGER_ID=${NETBIRD_GOOGLE_TAG_MANAGER_ID}
 export NETBIRD_TOKEN_SOURCE=${NETBIRD_TOKEN_SOURCE:-accessToken}
 export NETBIRD_DRAG_QUERY_PARAMS=${NETBIRD_DRAG_QUERY_PARAMS:-false}
-export NETBIRD_AUTH_SERVICE_URL=${NETBIRD_AUTH_SERVICE_URL}
 export NETBIRD_WASM_PATH=${NETBIRD_WASM_PATH}
-export NETBIRD_CSP=${NETBIRD_CSP}
-export NETBIRD_LICENSED=${NETBIRD_LICENSED:-false}
-export NETBIRD_CLOUD=${NETBIRD_CLOUD:-false}
-export NETBIRD_AGENT_NETWORK_ONLY=${NETBIRD_AGENT_NETWORK_ONLY:-false}
-export NETBIRD_AGENT_NETWORK_ENABLED=${NETBIRD_AGENT_NETWORK_ENABLED:-false}
-export NETBIRD_HUBSPOT_PORTAL_ID=${NETBIRD_HUBSPOT_PORTAL_ID}
-export NETBIRD_HUBSPOT_SIGNUP_FORM_ID=${NETBIRD_HUBSPOT_SIGNUP_FORM_ID}
-export NETBIRD_HUBSPOT_ONBOARDING_FORM_ID=${NETBIRD_HUBSPOT_ONBOARDING_FORM_ID}
-export NETBIRD_HUBSPOT_SURVEY_FORM_ID=${NETBIRD_HUBSPOT_SURVEY_FORM_ID}
-export NETBIRD_ANALYTICS_EXCLUDED_EMAILS=${NETBIRD_ANALYTICS_EXCLUDED_EMAILS}
 
 echo "NetBird latest version: ${NETBIRD_LATEST_VERSION}"
 
-# Build CSP
-FIRST_PARTY_CSP="pkgs.netbird.io"
-FIRST_PARTY_CSP_CONNECT_SRC="wss://*.netbird.io"
-THIRD_PARTY_CSP="*.licdn.com *.linkedin.com *.vector.co *.sibforms.com *.hotjar.com *.hotjar.io *.redditstatic.com pixel-config.reddit.com *.clarity.ms c.bing.com *.microsoft.com googleads.g.doubleclick.net pagead2.googlesyndication.com www.google.com www.googleadservices.com *.google-analytics.com *.googletagmanager.com analytics.google.com *.hubapi.com *.hs-banner.com *.hubspot.com *.hubspot.net js.hs-analytics.com *.hsforms.net *.hscollectedforms.net *.hs-analytics.net *.hsforms.com track.hubspot.com *.hsadspixel.net static.hsappstatic.net"
-THIRD_PARTY_CSP_CONNECT_SRC="https://api.github.com/repos/netbirdio/netbird/releases/latest https://raw.githubusercontent.com/netbirdio/dashboard/ wss://ws.hotjar.com"
-THIRD_PARTY_CSP_SCRIPT_SRC="'sha256-7knV6EIjKUvCpYWE2rCYx8dYV2WCNb2bpTuitFXzBcA=' *.hs-scripts.com"
-
-CSP_DOMAINS=""
-CSP_DOMAINS_CONNECT_SRC=""
-
-if [[ -n "${NETBIRD_CSP}" ]]; then
-    CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_CSP"
-fi
-
-# Add AUTH_AUTHORITY to CSP
-if [[ -n "${AUTH_AUTHORITY}" ]]; then
-    CSP_DOMAINS="$CSP_DOMAINS $AUTH_AUTHORITY"
-    AUTH_AUTHORITY_ORIGIN=$(echo "$AUTH_AUTHORITY" | sed -E 's|^(https?://[^/]+).*|\1|')
-    CSP_DOMAINS="$CSP_DOMAINS $AUTH_AUTHORITY_ORIGIN"
-fi
-
-# Add AUTH_AUDIENCE to CSP
-if [[ -n "${AUTH_AUDIENCE}" && ("${AUTH_AUDIENCE}" == *"http://"* || "${AUTH_AUDIENCE}" == *"https://"*) ]]; then
-    CSP_DOMAINS="$CSP_DOMAINS $AUTH_AUDIENCE"
-fi
-
-# Add NETBIRD_AUTH_SERVICE_URL to CSP
-if [[ -n "${NETBIRD_AUTH_SERVICE_URL}" ]]; then
-    CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_AUTH_SERVICE_URL"
-fi
-
-# Add NETBIRD_MGMT_API_ENDPOINT to CSP
-if [[ -n "${NETBIRD_MGMT_API_ENDPOINT}" ]]; then
-    MGMT_DOMAIN=$(echo "$NETBIRD_MGMT_API_ENDPOINT" | sed -E 's|https?://||' | cut -d'/' -f1 | cut -d':' -f1)
-    if [[ -n "$MGMT_DOMAIN" ]]; then
-        if [[ "$NETBIRD_MGMT_API_ENDPOINT" == https://* ]]; then
-            CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_MGMT_API_ENDPOINT"
-            CSP_DOMAINS_CONNECT_SRC="$CSP_DOMAINS_CONNECT_SRC wss://$MGMT_DOMAIN"
-        elif [[ "$NETBIRD_MGMT_API_ENDPOINT" == http://* ]]; then
-            CSP_DOMAINS="$CSP_DOMAINS $NETBIRD_MGMT_API_ENDPOINT"
-            CSP_DOMAINS_CONNECT_SRC="$CSP_DOMAINS_CONNECT_SRC ws://$MGMT_DOMAIN"
-        fi
-    fi
-fi
-
-# Add LETSENCRYPT_DOMAIN to CSP
-if [[ -n "${LETSENCRYPT_DOMAIN}" ]]; then
-    if [[ "$LETSENCRYPT_DOMAIN" == *"localhost"* ]]; then
-        CSP_DOMAINS="$CSP_DOMAINS http://$LETSENCRYPT_DOMAIN"
-        CSP_DOMAINS_CONNECT_SRC="$CSP_DOMAINS_CONNECT_SRC ws://$LETSENCRYPT_DOMAIN"
-    else
-        CSP_DOMAINS="$CSP_DOMAINS https://$LETSENCRYPT_DOMAIN"
-        CSP_DOMAINS_CONNECT_SRC="$CSP_DOMAINS_CONNECT_SRC wss://$LETSENCRYPT_DOMAIN"
-    fi
-fi
-
-CSP_CONNECT_SRC="$CSP_DOMAINS $CSP_DOMAINS_CONNECT_SRC $FIRST_PARTY_CSP $FIRST_PARTY_CSP_CONNECT_SRC $THIRD_PARTY_CSP $THIRD_PARTY_CSP_CONNECT_SRC"
-CSP_FRAME_SRC="$CSP_DOMAINS $FIRST_PARTY_CSP $THIRD_PARTY_CSP"
-CSP_SCRIPT_SRC="$CSP_DOMAINS $FIRST_PARTY_CSP $THIRD_PARTY_CSP $THIRD_PARTY_CSP_SCRIPT_SRC"
-
-# Remove duplicates
-CSP_CONNECT_SRC=$(echo $CSP_CONNECT_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
-CSP_FRAME_SRC=$(echo $CSP_FRAME_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
-CSP_SCRIPT_SRC=$(echo $CSP_SCRIPT_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
-
-# upgrade-insecure-requests tells the browser to rewrite every http subresource,
-# fetch and WebSocket to https/wss. That is correct for https deployments but breaks
-# plain-http ones (e.g. local or self-hosted over http), where it would rewrite the
-# working http/ws endpoints to unreachable https/wss. Emit it only when the backend
-# is served over https, matching the ws:// vs wss:// scheme logic above.
-CSP_UPGRADE_INSECURE=" upgrade-insecure-requests;"
-if [[ "$NETBIRD_MGMT_API_ENDPOINT" == http://* || "$AUTH_AUTHORITY" == http://* ]]; then
-    CSP_UPGRADE_INSECURE=""
-fi
-
-# Update CSP in nginx config
-CSP_POLICY="default-src 'none'; connect-src 'self' $CSP_CONNECT_SRC; frame-src 'self' $CSP_FRAME_SRC; script-src 'self' 'wasm-unsafe-eval' $CSP_SCRIPT_SRC; font-src 'self'; img-src * data:; manifest-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';$CSP_UPGRADE_INSECURE"
-CSP_HEADER="add_header Content-Security-Policy \"$CSP_POLICY\" always;"
-
-echo "CSP header: $CSP_HEADER"
-
-# Replace CSP header in nginx config
-sed -i "s|add_header Content-Security-Policy \"[^\"]*\" always;|$CSP_HEADER|g" /etc/nginx/http.d/default.conf || {
-    echo "Failed to replace CSP header"
-}
-
 # replace ENVs in the config
-ENV_STR="\$\$USE_AUTH0 \$\$AUTH_AUDIENCE \$\$AUTH_AUTHORITY \$\$AUTH_CLIENT_ID \$\$AUTH_CLIENT_SECRET \$\$AUTH_SUPPORTED_SCOPES \$\$NETBIRD_MGMT_API_ENDPOINT \$\$NETBIRD_MGMT_GRPC_API_ENDPOINT \$\$NETBIRD_HOTJAR_TRACK_ID \$\$NETBIRD_GOOGLE_ANALYTICS_ID \$\$NETBIRD_GOOGLE_TAG_MANAGER_ID \$\$AUTH_REDIRECT_URI \$\$AUTH_SILENT_REDIRECT_URI \$\$NETBIRD_TOKEN_SOURCE \$\$NETBIRD_DRAG_QUERY_PARAMS \$\$NETBIRD_AUTH_SERVICE_URL \$\$NETBIRD_WASM_PATH \$\$NETBIRD_LICENSED \$\$NETBIRD_CLOUD \$\$NETBIRD_AGENT_NETWORK_ONLY \$\$NETBIRD_AGENT_NETWORK_ENABLED \$\$NETBIRD_HUBSPOT_PORTAL_ID \$\$NETBIRD_HUBSPOT_SIGNUP_FORM_ID \$\$NETBIRD_HUBSPOT_ONBOARDING_FORM_ID \$\$NETBIRD_HUBSPOT_SURVEY_FORM_ID \$\$NETBIRD_ANALYTICS_EXCLUDED_EMAILS"
+ENV_STR="\$\$USE_AUTH0 \$\$AUTH_AUDIENCE \$\$AUTH_AUTHORITY \$\$AUTH_CLIENT_ID \$\$AUTH_CLIENT_SECRET \$\$AUTH_SUPPORTED_SCOPES \$\$NETBIRD_MGMT_API_ENDPOINT \$\$NETBIRD_MGMT_GRPC_API_ENDPOINT \$\$NETBIRD_HOTJAR_TRACK_ID \$\$NETBIRD_GOOGLE_ANALYTICS_ID \$\$NETBIRD_GOOGLE_TAG_MANAGER_ID \$\$AUTH_REDIRECT_URI \$\$AUTH_SILENT_REDIRECT_URI \$\$NETBIRD_TOKEN_SOURCE \$\$NETBIRD_DRAG_QUERY_PARAMS \$\$NETBIRD_WASM_PATH"
 
 OIDC_TRUSTED_DOMAINS="/usr/share/nginx/html/OidcTrustedDomains.js"
 envsubst "$ENV_STR" < "$OIDC_TRUSTED_DOMAINS".tmpl > "$OIDC_TRUSTED_DOMAINS"
@@ -171,25 +74,4 @@ for f in $(grep -R -l AUTH_SUPPORTED_SCOPES /usr/share/nginx/html); do
     cp "$f" "$f".copy
     envsubst "$ENV_STR" < "$f".copy > "$f"
     rm "$f".copy
-done
-
-# Reload nginx so the patched CSP header takes effect.
-# supervisord starts nginx (priority 100) before this script (priority 201) and
-# never reloads it, so without this nginx keeps serving the static default.conf
-# CSP that has no connect-src, breaking OIDC discovery over plain HTTP.
-reloaded=false
-for i in $(seq 1 10); do
-    if nginx -s reload 2>/dev/null; then
-        echo "Reloaded nginx to apply updated CSP configuration"
-        reloaded=true
-        break
-    fi
-    echo "Waiting for nginx to be ready before reload (attempt $i)..."
-    sleep 1
-done
-
-if [[ "$reloaded" != true ]]; then
-    echo "Failed to reload nginx after patching CSP header" >&2
-    nginx -t || true
-    exit 1
-fi
+done