The list computed calc(100vh - 75px) on its own. The header is 65px, and with
an announcement banner open DashboardLayout shrinks the row holding
PageContainer to calc(100vh - (headerHeight + bannerHeight)) -- so the list
asked for more height than its scroll container had and drifted with the
scroll instead of holding at the top.
It now takes the same figure Navigation and DashboardLayout use. That arrives
through a CSS variable rather than an inline height, which keeps the
breakpoint in CSS: the value is always a length, so the height cannot degrade
to auto and bring back the stretch that stopped it sticking in the first
place. bannerHeight is defaulted because useAnnouncement is a bare useContext
with an empty default, and NaNpx would invalidate the calc.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The sidebar's height came from useIsLg, and react-responsive reports false
during SSR and the first client render. Until the query resolved the list fell
back to height auto, and as a flex item under the default align-items: stretch
that means it grows to the full content height -- so a sticky element as tall
as its own containing block, with nowhere to stick. The sidebar scrolled away
with the content on every load until the query landed, which made it look
intermittent.
Reproduced outside the app: with a fixed height the list holds at the top of
the scroll container through a scroll of 800px; with height auto it measures
the full 1500px content height and its offset tracks the scroll exactly.
h-auto lg:h-[calc(100vh_-_75px)] is correct from the first paint and drops the
hook from the component.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The padding sat on Tabs.List, outside the ScrollArea, so the Root's box ended
flush with the items and the scrollbar -- absolute, bottom-0, 10px tall -- had
nowhere to sit but on top of them. It now lives on the inner flex row, with
pb-3 clearing the track, which also means the leading gap travels with the
content instead of framing it.
The fade is back alongside the scrollbar rather than in place of it, 64px wide
and stopping short of the track. Its observers hang off the Radix viewport,
which is the element that actually scrolls; on Tabs.List they would have
measured nothing once ScrollArea went in.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Drops no-scrollbar and the hand-rolled edge fades in favour of ScrollArea,
which is what the rest of the app uses for this -- Tabs.tsx already wraps its
horizontal list the same way. That removes the ResizeObserver, the
MutationObserver and the scroll listener that existed only to stand in for a
scrollbar nobody could see.
The horizontal strip also gets a 1px gap between items.
Root and Viewport are display:contents on lg, so on desktop they leave the
layout entirely and the tab column sits directly in the list, keeping the
sticky sidebar and its calc height untouched. Doing it in CSS rather than
branching on useIsLg matters: react-responsive reports false during SSR, so a
structural branch would render the mobile strip on desktop first and then swap.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Below lg the tab list is a horizontal strip carrying no-scrollbar, so there
was nothing to say the tabs continue past the edge. A fade now sits at
whichever end still has tabs behind it, and neither is shown when everything
fits.
The state comes from the element's own scroll metrics. A ResizeObserver covers
the initial measurement, which also keeps setState out of the effect body and
so out of the way of react-hooks/set-state-in-effect. A MutationObserver
covers a permission-gated trigger appearing later, which changes scrollWidth
without resizing the element. The setter returns the previous object when
nothing moved, so a measurement caused by our own render cannot loop.
The fades need a positioned parent, which the list cannot be while it is
scrolling its own content, so the wrapper is lg:contents -- on desktop it
leaves the layout entirely and the list stays the flex item it was.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
PageContainer is the scroll container, so the tab list scrolled away with the
tab content: on a long Settings tab the list was gone by the time you reached
the bottom. It is now pinned to the top of that container on lg and up.
Pinning alone would trade one problem for another, because the list carries
overflow-y-hidden and a fixed height: a list taller than the viewport was
previously reachable by scrolling the page, and pinned it would just be
clipped. It gets lg:overflow-y-auto so it scrolls on its own when it has to.
Mobile is untouched, where the list is a horizontal row rather than a sidebar.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
It was a settings tab of its own, which gave a small table its own page and
its own breadcrumbs. It is now a section of the Authentication tab, below MFA,
behind a separator like MFA's own: label, description, and an Add button on
the right.
The description reads "Users from these domains can join your account." and
Learn more now points at the page that documents it rather than at the docs
root.
SignInDomainsTab.tsx is gone with the tab, and the visibility rule it held --
cloud, a private account domain, settings read -- moves to
useCanViewSignInDomains so the Authentication tab can gate the separator on
the same condition.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The list polled every 15s for as long as the tab was open, even when every
domain was verified and nothing could change. It now polls only while a domain
is still pending its DNS challenge, which is the only state that moves on its
own.
RequestOptions.refreshInterval takes SWR's function form so the decision can
read the current data. The function is memoised because SWR's polling effect
keys on it, and a fresh closure each render would tear the timer down and
re-arm it continuously.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The tooltip named the connection, but that name is a generated slug like
con_7MhvKP27KnKDJbXS, so it told the customer nothing about where to go and
put an internal identifier in front of them. It now points at the integration,
matching the wording the service returns for the same refusal.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Follows the routes the auth service now exposes, and reworks the tab to
match the other settings tabs.
- Adding a domain happens in a modal, built like the rename-group modal,
instead of an inline field above the table. The Add button sits in the tab
header where the other tabs keep Save Changes.
- The tab decides whether to show itself from the login token's domain
category rather than from GET /accounts, so its trigger paints with the
rest of the tab list instead of appearing a moment later and pushing the
list down. useDomainCategory now decodes the token synchronously, since
useJwt decodes in an effect and so reports no claims on first render.
- The table's loading state is one placeholder row rendered through the real
table, so the header, row height and padding are identical to a loaded
table and nothing shifts when the first domain arrives.
- An unreachable service dims the panel and disables its controls, the same
treatment the MFA panel uses, rather than saying anything about the service
behind it. The skeleton covers the whole request, so the empty state is
only shown when the account really has no domains.
- The delete button is icon-only and always present: the primary domain gets
it disabled with a tooltip saying why, rather than no control at all.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Remove the unreachable FirewallGPT module and the abandoned traffic-event
detail prototypes, along with the dependencies they were the sole consumers of.
FirewallGPT was disabled in 9d8d9ee4 by removing its trigger button, leaving
the modal mounted but impossible to open. TrafficEventDetails was never
imported anywhere, and it was the only consumer of TrafficEventChart.
Dependency changes:
- Drop @faker-js/faker, whose only usage was mock chart data in the removed
TrafficEventChart. This also resolves GHSA-qxc2-j82w-r537 without needing
the 9 -> 10 major upgrade.
- Drop react-confetti-explosion, only used by the removed
FirewallGPTSuccessModal.
- Bump @types/node to 20.19.43 so it satisfies the peer range of the vite
version pulled in by vitest, silencing an ERESOLVE warning on install.
Stays on the 20.x line to match the Node 20 used in CI.
- Add an allowScripts deny policy for the four packages with install scripts.
Both @axa-fr postinstalls are bare echo statements, fsevents ships a
prebuilt binary, and the unrs-resolver postinstall only verifies a binding
that optionalDependencies already installs.
Surfaces the two bundle parameters added to the management API: an
anonymization level (Default/Strict, shown when anonymization is enabled)
and an optional upload service URL that overrides the default upload
server. The upload URL is validated as an https URL before the job can be
submitted; both fields are omitted from the request when left at their
defaults so the peer applies its own.
Stabilize the flaky Control Center and agentgateway e2e specs (#788)
Three separate causes behind the recent e2e failures.
The group view ranked every group in the account by peer count to decide what
to display, so with two workers it could land on a group another spec had just
created. openGroupView() selects the group by name instead.
Management now checks a provider's upstream URL when the provider is saved and
rejects it unless the URL returns a model list, so the agentgateway spec's
placeholder host stopped working. The test environment runs a stub that answers
the check.
The Backspace test blurred the group panel's search input before that input had
taken focus, so it reclaimed focus and swallowed the key.
The peer view matched policies only by source group membership, so a
policy whose source is the peer itself never appeared in that peer's
view. There was no group fallback either: a rule carrying a
sourceResource has its sources nulled on save, so the group check could
only ever return false for exactly these policies.
Such policies are reachable from the canvas itself, since dragging a
connection off a peer node writes a sourceResource rather than a group.
A user could create a peer-sourced policy, deploy it, drill into that
same peer and not see it.
Match rule.sourceResource against the peer id alongside the group check.
The rendering side needs no change, as select-peer-node is the peer and
its edge to the policy is drawn unconditionally. Draft mode is fixed
transitively: useDraft harvests visible policies from the live view's
nodes, and already draws a sourceResource peer as a source card.
A refused save closed the modal anyway, throwing away the key just typed — and
the API never returns one. Both paths now stop before closing. The failure was
also reported twice and, because notify() only reddens through its promise path,
both times as a success.
Load and submit now spin, say what they are waiting on, and stop taking clicks;
dismissal is refused mid-save, since the write lands regardless and would
otherwise close a session reopened in the meantime.
Discovery carries the record id and the form's URL together, so changing an
endpoint no longer demands the key back. A 422 from it was reported as
unreachable rather than unsupported — useApiCall rejects with { code, message }
and the hook read status, leaving the catalog fallback unreachable.
Discovered models arrived at zero: 0/0 was hardcoded for anything the catalog
lacked by exact id, which stopped being true once discovery returned real rates.
Bedrock felt all of it — its geography-prefixed ids never match by string.
A Playwright spec covers the refusal end to end.
Adds a Sign-in Domains tab to Settings, backed by the auth service's
account domain endpoints (GET/POST /service/account/domains, POST
/domains/:id/verify, DELETE /domains/:id).
The tab lists the account's domains with their verification status, and
lets an admin add one, verify ownership through the existing DNS TXT
record modal, and remove one. Adding a domain opens the verification
modal straight away unless the service returns it already verified,
which it does when the domain matches the caller's own email address.
The list polls while it is on screen, since verification finishes
server-side seconds to minutes after it starts and nothing pushes the
new status.
Remove mirrors the two cases the service refuses: the account's own
primary domain has no Remove button at all, and a domain still matched
by an SSO connection has it disabled with the connections named. When
the list cannot be loaded the section is disabled rather than showing an
empty state, so an admin never adds against a list they cannot see.
The tab is cloud-only and limited to accounts on a private email domain,
matching where the auth service adopts the account domain.
Supporting changes:
- DomainVerificationModal took a connectionId and resolved the verify
call itself, which only worked for connection domains. It now takes an
onVerify callback; the four existing call sites pass the same
connection-scoped verify as before.
- DomainValidationStatus, SignInDomain and DomainConnection live in
Account.ts, since sign-in domains belong to the account rather than to
an identity provider.
- NoResults gained an optional hideIcon prop.
- Settings tab headings that sit in a flex row next to an action button
rendered 4px lower than the ones that do not: flex items do not
margin-collapse, so the h1's my-1 no longer folds into the
breadcrumb's mb-6. Offset it so every tab heading lines up.
- Shorter one-line descriptions for Authentication, Notifications and
Metrics.
* Add Agent Network Admin and Usage Viewer roles, gate Agent Network per submodule
The management server now ships two delegated roles (agent_network_admin,
usage_viewer) and reports agent_network submodule permissions
(agent_network.providers, .policies, .usage, .logs, .settings, ...) in
/users/current. The dashboard still gated the whole Agent Network section
on services.read, so the new roles saw either everything or nothing.
- register the agent_network module keys so PermissionsProvider fills
denied defaults and typed lookups work
- gate the Agent Network sidebar and pages per submodule: providers,
policies, usage (usage or logs read), configuration (settings)
- show the section when any child is permitted instead of services.read
- add both roles to the role selector, user/invite tables and badges
* Gate Usage and Clusters tabs by their own permissions
A caller holding only agent_network.logs.read landed on the Usage tab it
cannot read, and one holding only agent_network.usage.read could open
Access Logs. Show each tab only with its matching read permission and
fall back to the first permitted tab on deep links.
The Clusters tab is a reverse-proxy surface: its table and controls run
on the services permission, so agent_network.settings alone (e.g.
agent_network_admin) no longer surfaces it.
* Fall back to a known configuration tab for unknown query values
An unknown ?tab= value selected no content pane and left the
configuration page blank; unknown or unauthorized values now fall back
to Global Limits.
* Derive the configuration tab from the URL query
The ?tab= query was mirrored into local state through an effect, which
can lag a render behind the URL and duplicates the source of truth.
Derive the active tab from the query directly; trigger clicks already
push the query themselves, and onChange keeps pushing it for Radix's
keyboard navigation, which fires without a click.
* Derive the usage tab from the URL query
Same treatment as the configuration page: the ?tab= query was mirrored
into local state through an effect, duplicating the source of truth.
Derive the active tab from the query; onTabChange keeps pushing it so
clicks, deep links and back/forward all resolve the same way.
* Group user roles into General and Agent Network tabs
Tab the role dropdown by product surface, gate the Agent Network
roles and tab on the Agent Network surface being available, and
disable the role field for the owner unless the caller is an owner.
* Point agent network learn-more links at their docs pages
* Skip the domains lookup when the role can't read it
* Flatten the role selector and add a caller-scoped My Setup page
The role dropdown split General and Agent Network roles into tabs,
which reads as two products inside one field. Return to the single
flat list from main, keeping the surface gate (Agent Network roles
hidden when the surface is unavailable) and the owner protections.
Regular users had no way to see which providers and models their
policies allow or where to point their tools. Add
/agent-network/my-setup backed by the caller-scoped me/setup and
me/consumption endpoints: the endpoint with copy, per-provider
available models, the Configure Your Agent instructions flattened
inline from the connect modal, and the caller's own usage counters.
The sidebar surfaces it for any role — limited view included —
whenever the caller's setup is configured, and stays hidden when
not, which is indistinguishable from no access by design.
* Fix delegated-role API errors and reuse the usage overview for My Usage
Field testing surfaced three problems. The policy and budget modals'
group selector fetched /networks/resources unconditionally, so an
agent_network_admin without the networks permission got a 403 and an
error toast on the policies page; gate the fetch on networks read.
Restricted users got no navigation at all, so the limited view could
never reach My Setup; render the sidebar for restricted users when
their setup is configured or their role reads an agent_network surface.
Roles below account admin also cannot read the account feature flag
(accounts read), so holding an explicit agent_network grant now counts
as proof the surface exists, while callers with accounts read keep the
flag as the source of truth.
My Usage rendered raw per-window counter rows, nothing like the admin
usage view; render it with the same chart-and-table component as the
admin overview, fed from the caller-scoped me/usage/overview endpoint
that returns the identical bucket shape filtered to the current user.
* Reuse the providers-page agent config on My Setup and self-scope Usage & Logs
My Setup now presents the endpoint exactly like the providers page — the
API Base URL badge with Copy and Agent Config opening the same modal
(provider ids come from the caller's me/setup answer instead of the
admin-permissioned provider context) — and drops the My Usage tab: the
regular Usage & Logs page now serves callers without the account-wide
grants too, showing their own data (the server pins the filters to them),
with the identity and provider filters trimmed since they'd be overridden.
usage_viewer gets working filters: the feature-flag fallback moves into
useAgentNetworkMode, AIProvidersProvider gates each fetch on its
submodule read grant so partially-granted roles don't fire 403s, and
GroupsProvider serves restricted roles that hold the groups read grant.
The limited view also gains the Peers link (the add-your-device page).
* Hide provider write actions from read-only viewers
usage_viewer now reads the provider list, but the page still offered every
write flow: Connect Provider, row-click edit, and the enable/disable/delete
menu. Clicking any of them opened the wizard, which - unable to read the
settings row - warned that Agent Network isn't set up even on configured
accounts. Each action is now gated on its own operation grant: the connect
button needs providers create, row-click edit needs update, and the menu
items need update/delete respectively (no menu at all without either).
* Restore the grouped role selector tabs
Bring back the General and Agent Network tabs in the role dropdown
from 3fbeb1e, undoing the flattening: the tabbed grouping keeps the
list readable as more surfaces ship their own delegated roles. The
surface gate (Agent Network roles hidden when the surface is
unavailable) and the owner protections are unchanged.
* Offer the provider and model filters to self-scoped callers
The providers endpoint now self-scopes on the server, so a configured
plain user fetches it too and the caller's own authorized providers back
the Provider and Model filter options on the self-scoped Usage & Logs
view. The identity filters stay hidden — the server pins user and group
to the caller regardless.
* Give the agent config a single home on Connect Agent
The endpoint card carried an Agent Config action on both the providers
page and the caller-scoped self-service page, so the same connect
snippets had two entry points. EndpointBadge now renders it only when
the caller passes providerIds, which is just the self-service page; the
providers page keeps the URL and Copy. The context-backed
AgentConnectModal wrapper is then unused, so it goes.
Rename that page from My Setup to Connect Agent in the sidebar,
breadcrumb and heading: My Setup was the only first-person label in the
navigation, and Connect Agent stays clear of the Configuration sibling.
* Simplify Bedrock config
* Inline the agent config on the Connect page
Drop the Agent Config modal: its snippets now render inline under the
endpoint card, so AgentConnectModal is just AgentConnectTabs and
EndpointBadge is back to the URL and Copy. Move the route to
/agent-network/connect and swap the hand-rolled provider list for the
standard DataTable. Follow the backend rename of me/setup to
agent-config.
* Show a policy's allowed models in the policies table
A policy's model restrictions live on the guardrails attached to it, so
the new Models column unions the enabled model allowlists: one chip for
a single model, a count with the names on hover past that, and a
Restrict badge opening the guardrails tab when nothing narrows the
policy. Clicking the column lands on that tab too.
Chip the models on the Connect Agent table instead of comma-joining
them, and capitalize the model counts across all three tables to match
the "2 Groups" chips on Peers.
* Point the Kimi e2e config assertions at the Connect Agent page
The Kimi-gated config surfaces moved: the Agent Config modal is gone and
the snippets render inline on /agent-network/connect, so the spec stopped
finding the button it used to click on the providers page. Navigate to the
Connect page instead.
That page's answer is caller-scoped — it only offers providers the
caller's own policies authorize — so the spec now grants the owner the
freshly connected provider through a dedicated group + policy, torn down
again (group detached from the owner first) before and after the run. The
backing GET /agent-network/agent-config ships with newer management
builds; on builds that predate it the suite skips, same as the existing
catalog and settings-bootstrap probes.
* Hand the agent config to every account member
The agent-config answer withheld the endpoint from callers no policy
covers, so "account not set up" and "you have no access" were the same
shape. The dashboard shows every user the same connection config, so
Configured now tracks the account: once it has an endpoint every member
gets it, with an empty providers list for those no policy covers. That
list stays caller-scoped, and the endpoint authorizes nothing on its own
since the gateway still refuses every request no policy permits.
Rename the files and symbols the endpoint outgrew when it became
/agent-network/agent-config: me_handler.go, setup.go and types/setup.go
become agent_config.go, GetSetupForUser becomes GetAgentConfigForUser,
and the AgentNetworkMeSetup schema becomes AgentNetworkAgentConfig.
Regenerating types.gen.go from the untouched spec first reproduced it
byte for byte, so the generated diff is only these renames.
* Let the surface switch decide the Agent Network section
Connect Agent and Usage & Logs were visible on the caller's own setup
alone, so a deployment with Agent Network off still showed them, and the
route tree then 404d the links the nav had just rendered. The switch now
decides first.
The caller's agent config still stands in for the switch, but only for
callers who cannot read the config themselves - otherwise an account
holding an endpoint kept the surface on for its owner regardless.
* Collapse the two User types the merge left behind
Both sides of the merge declared a User type, in different regions of the
helper, so the merge took both without ever reporting a conflict and
Playwright refused to parse the file. One type now carries the union of
the fields the /users answer returns.
* Fix SNAPSHOT version display
* Fix e2e tests
* Fix e2e tests
* Fix version display
* Fix e2e
* Fix e2e
* Fix e2e
---------
Co-authored-by: braginini <bangvalo@gmail.com>
* Add multi-select bulk deletion for Access Control groups
* Add indeterminate group selection and permission-safe column visibility
* Background rule for checkbox component
* Better show when disabled
The generated Docker command used --rm, which removes the container on
stop. Combined with -d, the NetBird client would not survive a host
reboot despite the persistent netbird-client volume. Replace with
--restart=unless-stopped so the client reconnects automatically.
* Fix typo in PeerExpirationToggle component
* Fix the same typo in PeerActionCell
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add a workflow bumping the WASM client on netbird releases
* Cover the pinned WASM client with an instantiation test
* Connect the pinned WASM client to management in the e2e suite
* Validate the dispatched tag before it reaches the shell and satisfy lint
* Sort the spec imports
* Clean up the registered peer even when the connect test fails
* Drive the dashboard's own remote-access flow instead of the client directly
* Mint the flow test's target peer by exposing a service
* Limit the wasm check to what the test environment can prove
* Give the wasm download and compile a realistic budget
* Hold the wasm client to the dashboard's initialization deadline
Loading a provider's models merged anything the catalog did not already carry
by exact id, and hardcoded both rates to zero on the way in. The comment gave
the reason: the discovery response carried no prices. That stopped being true
when the endpoint began returning the same rates the proxy bills with.
Bedrock feels all of it. Its listing returns geography-prefixed ids —
eu.anthropic.claude-opus-4-7 — while the catalog holds the bare
anthropic.claude-opus-4-7, so no Bedrock model ever matches by string and every
one of them takes this branch. Selecting one filled its row with $0, and the
form then warned that the model had no cost set, while the API had reported a
rate for it. Usage against it records nothing.
Exact-id matching stays. Collapsing a geography-prefixed id onto its catalog
entry would hand back the bare form, and only the prefixed one is invocable at
AWS.
The model picker only offered NetBird's compiled-in catalog, which goes stale as
vendors retire models and cannot reflect what an account is actually entitled to.
Adds a "Load models from provider" action backed by
`POST /agent-network/catalog/providers/models` (netbirdio/netbird#7246). Editing a
saved provider reuses the stored credential, so the masked key never reaches the
browser; creating a new one sends the key being typed. Discovered models merge into
the catalog options, with catalog entries winning a collision because they carry
pricing. A model the backend reports as unpriced is flagged and needs confirmation
before saving, so nothing is registered at a silent zero.
Two implementation notes: the unpriced warning renders once at list level rather
than per row, and the hook uses `ignoreError: true` so a provider-specific failure
is reported inline in the modal instead of as a global toast.
The HubSpot form behind the self-hosted Agent Network signup now has a
required company-scoped Country/Region field, so submissions without it
are rejected. Adds a searchable Country dropdown to the signup step and
includes the value as an objectTypeId 0-2 field.
Uses a static country list instead of /locations/countries since the
geolocation database may be absent on self-hosted deployments and the
HubSpot property expects full country names, not ISO codes.
The desktop client reworked its UI in v0.75: the management server is now
asked for on the first-run "Set up NetBird" screen and lives under
Settings > General, so the "Settings > Advanced Settings" path the Windows
and macOS tabs described no longer exists. Move the copy into a shared
ManagementUrlStep, cover the already-installed case, and say "menu bar"
instead of "system tray" on macOS.
Fixes#732
* Remove unnecessary comment
Alpine 3.14 reached end of life in May 2023 and has received no security
fixes for roughly three years. nginx is installed from the Alpine repos
rather than pinned, so the base bump also moves nginx 1.20.2 -> 1.30.4,
certbot 1.16.0 -> 5.6.0 and supervisor 4.2.2 -> 4.3.0.
Alpine 3.24 carries security support until June 2028.
Verified by building and running this Dockerfile on 3.14, 3.23 and 3.24 and
comparing: the served index.html is byte-identical across all three, the CSP
response header hashes identically, `nginx -t` passes on the existing config,
and supervisord reaches the same state. /etc/crontabs/root and
/etc/nginx/http.d/ still exist on 3.24, so the `rm /etc/crontabs/root` step and
the config COPY paths are unaffected. Every certbot flag used by init_cert.sh
is still accepted by certbot 5.x.
Certificate issuance itself could not be exercised without a real domain, so
the certbot 1.x -> 5.x jump should get one staging issuance before rollout.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade to Next.js 16.3
Turbopack is now the default for both `next dev` and `next build`, so the
separate `turbo` script is redundant and has been dropped.
`next build` rewrites tsconfig `moduleResolution` to "bundler", which Next 16
expects.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: migrate ESLint to flat config
`next lint` was removed in Next 16, so `npm run lint` had been failing with
"Invalid project directory provided, no such directory: ./lint" since that
upgrade. eslint-config-next 16 also ships flat config only, which the old
.eslintrc.json could not consume.
Ignores .claude/ so stray worktree copies of the repo are not linted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: replace ip-cidr with ip-address to clear CVE advisories
ip-cidr pulled a vulnerable ip-address (GHSA-mwp4-54f8-5fhr, high: leading-zero
octets decoded as decimal while resolvers read them as octal, enabling SSRF;
GHSA-v2v4-37r5-5v8g, moderate: XSS in Address6 HTML methods). npm reported "no
fix available" because even the latest ip-cidr pins ip-address ^9.0.5, still
inside the vulnerable range.
ip-address 10.x was already a direct dependency and covers every use: its
isValid rejects leading-zero octets and validates mask ranges natively, and
isInSubnet replaces the one `new cidr().contains()` call site.
The new validators were differential-tested against the real ip-cidr over a
67-input corpus (134 checks) before removal, with no divergences; containment
was checked across 14 v4/v6/boundary/cross-family cases. `npm audit` now
reports 0 vulnerabilities.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: replace next-themes with an in-repo ThemeProvider
next-themes renders an inline <script> to set the theme before paint. It was
loaded through dynamic(ssr: false), so that script rendered on the client, where
React 19 never executes script tags and warns:
Encountered a script tag while rendering React component.
Upgrading would not have helped; 0.4.6 still renders the script
unconditionally. The script was also useless here: injected after hydration, it
could not prevent a flash, and postbuild.js hoists inline scripts out of the
export anyway.
The replacement keeps the same `netbird-theme` storage key and three-mode
support, and sets the theme class on <html> in the layout instead, so the
static export ships the correct theme in its first byte with no script at all.
Dropping the dynamic(ssr: false) wrapper removed an implicit prerender bailout
for the whole provider tree, which exposed isNetBirdCloud() reading
window.location during the build-time render; it is now guarded. The exported
HTML is byte-identical either way, since the page already bails to client
rendering.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: key the router children slot in the dashboard layout
React logged "Each child in a list should have a unique key prop. Check the
render method of DashboardPageContent." The App Router's segment element for
`children` arrives with a null key, which React flags once it is reconciled
alongside the Navigation sibling. Wrapping it in a keyed Fragment resolves it.
Verified in the browser both ways: with the Fragment the console is clean,
without it the warning returns.
Also applies the pending simple-import-sort fix for this file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: match IPv4-mapped IPv6 hosts against IPv4 CIDRs
Regression from replacing ip-cidr. Its contains() normalised an IPv4-mapped
IPv6 address to the embedded v4 before the subnet check, so
contains("::ffff:10.0.0.5") on 10.0.0.0/24 returned true; isHostInCIDR returned
false. Verified against ip-cidr@3.1.0 directly.
This is reachable: isValidIP accepts "::ffff:10.0.0.5", so a mapped host entered
in ReverseProxyAddressInput against an IPv4 resource CIDR was wrongly rejected.
An IPv6 network still rejects a mapped host, so families do not leak. Checked
across 20 cases (6 mapped-host, 14 pre-existing), with the mapped expectations
taken from measured ip-cidr output.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive skeleton colors from the resolved theme
SkeletonTheme had the dark palette hardcoded, so a light theme would render
dark skeletons. The light values are the ones already defined on the
feature-light-theme branch rather than new invented colors.
resolvedTheme is tracked in state and updated from the existing apply(), so the
palette also follows the OS preference under "system".
Latent today, since DarkModeToggle disables both Light and System.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: center icons in collapsed navigation rail
Nav items have 24px of left padding (px-3 on the li plus px-3 on the
button), so with 16px icons the icon center lands at 32px. The 70px rail
centered at 35px, leaving icons 3px off. Narrow the rail to 64px so the
two line up, and match the content offset in PageContainer.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use one plus icon across network tab Add buttons
The Resources and Routing Peers Add buttons used tabler's IconCirclePlus
while the Services tab used lucide's PlusCircle. Both were size 16, but
the two icon sets draw at different inner scales, so the glyphs read as
different sizes. Standardize on lucide.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adopts the new Agent Network settings contract:
- The management API replaced the implicit settings bootstrap — a
`bootstrap_cluster` hint on the first provider create — with an
explicit POST /agent-network/settings carrying the proxy cluster
address. The settings response now carries endpoint +
proxy_address + dedicated instead of cluster + subdomain.
- The provider wizard keeps its UX (auto-picking a validated cluster,
gating the first create on having one) but now bootstraps the
settings row with the explicit POST right before the first provider
create. A bootstrap failure keeps the wizard open and surfaces the
error — previously a failed bootstrap was swallowed server-side and
the account silently ended up with a provider but no endpoint. A 409
(concurrent bootstrap won) is treated as success, since the row
exists either way.
- Types updated accordingly; bootstrapAgentNetworkSettings is exposed
on the providers context. The onboarding provider step reuses the
same wizard, so it is covered by the same change.
Without this, the dashboard against a new management silently stops
bootstrapping accounts: provider create succeeds (the old hint is an
ignored unknown field), but no endpoint is ever assigned.
Self-hosted management versions can carry a numeric build suffix
(e.g. 0.76.3-31256681241) that overflows the sidebar box. Show the
semver only and move the full string into the hover tooltip alongside
the latest version. Pre-release labels like -rc.1 are preserved.
The onboarding survey opened a HubSpot booking modal for accounts with
50+ planned users. Removes the modal, its onboarding-call experiment
variants, the trigger in Onboarding.tsx, and the now-unused avatar.
Keeps src/cloud/cloud-hooks/useExperiment.ts, which this was the only
consumer of, for a future experiment.
* Handle agent-network settings defaults response
The management API now answers the settings GET with a defaults object
before the account is bootstrapped (empty cluster/subdomain/endpoint)
instead of a JSON null body. Normalize that shape to the existing null
settings signal so every consumer keeps a single not-bootstrapped check,
while still tolerating the null body and 404 from older backends.
* Pin the settings wire-shape normalization in a Playwright spec
The providers page must render the connect-first empty state for every
unbootstrapped settings shape the management API has answered with over
time (defaults object with an empty endpoint, JSON null body, 404) and
the endpoint badge once bootstrapped. The settings route is mocked per
test so the spec is independent of the backend build and of account
state left behind by other suites.
* Address review: no stale settings on 404, close context on setup failure
useFetchApi keeps the previous SWR data alongside the error, so a later
404 could expose stale settings through the memo; it now yields null
when the error is a 404 while still riding out transient failures on
the kept data. The wire-shapes spec closes its browser context when a
setup step throws before the close callback is handed to the test.
Zypper ignores the gpgkey= entry of a .repo file, so the yum snippet would
leave the repository key uninstalled on openSUSE. The new distro entry adds
the repository with GPG checking enabled and imports the key on refresh.
* Cover RPM-based distros and desktop app dependencies in the Linux tab
The manual-install section of the add-peer modal only covered Ubuntu via
APT. Replace the single Ubuntu accordion with a distro selector covering
Debian/Ubuntu (APT), Fedora (DNF), RHEL/AlmaLinux/Rocky (DNF), and Amazon
Linux (YUM).
The desktop app links GTK 4.10+ and WebKitGTK 6.0 but the released
netbird-ui packages do not declare them, so each desktop-app install line
names the packages explicitly and a callout states the minimum release
(Ubuntu 24.04, Debian 13, Fedora 43, RHEL 10 with EPEL). Distros without
the required stack get CLI-only instructions.
* Add e2e coverage for the Linux distro selector
NetBird Dashboard is NetBirds Management server UI. It allows users to signin, view setup keys and manage peers. This image is **not ready** for production use.
## Tags
```latest``` ```vX.X.X``` not available yet.
```main``` built on every PR being merged to the repository
NetBird Dashboard is NetBird's management server UI.
## Tags
Each published image tag also has a rootless variant with the `-rootless`
suffix. For example, `main` is also published as `main-rootless`.
## How to use this image
HTTP run:
HTTP:
```shell
docker run -d --rm -p 80:80 wiretrustee/dashboard:main
docker run -d --rm -p 80:80 netbirdio/dashboard:main
```
Using SSL certificate from Let's Encrypt®:
Using an SSL certificate from Let's Encrypt:
```shell
docker run -d --rm -p 80:80 -p 443:443 \
-e LETSENCRYPT_DOMAIN=app.mydomain.com \
-e LETSENCRYPT_EMAIL=hello@mydomain.com \
netbirdio/dashboard:main
```
> For SSL generation, you need to run this image in a server with proper public IP and a domain name pointing to it.
For certificate generation, the server needs a public IP and a domain name
pointing to it.
### Rootless and OpenShift
The rootless image listens on port `8080`, runs as UID `10001` by default, and
supports OpenShift's arbitrary UID when the container retains GID `0`:
Loaded 20 of 387 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Eduard GertandClaude Opus 5
Nicolas Frati
Maycon Santos
Daneyon Hansen
Brandon Hopkins
Shaban Mohammedsaani Hassan
Viktor Liu
Jack Carter
Brad Ison
Bethuel Mmbaga
Zoltan Papp