The client no longer keeps the bundle on the peer when a self-hosted deployment
publishes no destination: netbirdio/netbird now falls back to the upload service
NetBird runs for every deployment, so the field's help text described behaviour
that is not there.
A debug bundle carries peer logs, routes, DNS and firewall state, and until now
every client path that uploads one without a human picking a destination sent it
to the service NetBird runs, with no way for a self-hosted operator to point it
elsewhere. netbirdio/netbird publishes the destination to peers from the account
settings; this exposes that setting.
Empty keeps the current behaviour for cloud accounts and, for a self-hosted
deployment, makes the peers keep the bundle locally instead. The URL is
validated as https-with-host on the client too, matching what the API accepts:
the peer fetches an upload URL from this endpoint and then PUTs the bundle to
whatever comes back, so a plaintext hop would expose both.
A refused save closed the modal anyway, throwing away the key just typed — and
the API never returns one. Both paths now stop before closing. The failure was
also reported twice and, because notify() only reddens through its promise path,
both times as a success.
Load and submit now spin, say what they are waiting on, and stop taking clicks;
dismissal is refused mid-save, since the write lands regardless and would
otherwise close a session reopened in the meantime.
Discovery carries the record id and the form's URL together, so changing an
endpoint no longer demands the key back. A 422 from it was reported as
unreachable rather than unsupported — useApiCall rejects with { code, message }
and the hook read status, leaving the catalog fallback unreachable.
Discovered models arrived at zero: 0/0 was hardcoded for anything the catalog
lacked by exact id, which stopped being true once discovery returned real rates.
Bedrock felt all of it — its geography-prefixed ids never match by string.
A Playwright spec covers the refusal end to end.
* Add Agent Network Admin and Usage Viewer roles, gate Agent Network per submodule
The management server now ships two delegated roles (agent_network_admin,
usage_viewer) and reports agent_network submodule permissions
(agent_network.providers, .policies, .usage, .logs, .settings, ...) in
/users/current. The dashboard still gated the whole Agent Network section
on services.read, so the new roles saw either everything or nothing.
- register the agent_network module keys so PermissionsProvider fills
denied defaults and typed lookups work
- gate the Agent Network sidebar and pages per submodule: providers,
policies, usage (usage or logs read), configuration (settings)
- show the section when any child is permitted instead of services.read
- add both roles to the role selector, user/invite tables and badges
* Gate Usage and Clusters tabs by their own permissions
A caller holding only agent_network.logs.read landed on the Usage tab it
cannot read, and one holding only agent_network.usage.read could open
Access Logs. Show each tab only with its matching read permission and
fall back to the first permitted tab on deep links.
The Clusters tab is a reverse-proxy surface: its table and controls run
on the services permission, so agent_network.settings alone (e.g.
agent_network_admin) no longer surfaces it.
* Fall back to a known configuration tab for unknown query values
An unknown ?tab= value selected no content pane and left the
configuration page blank; unknown or unauthorized values now fall back
to Global Limits.
* Derive the configuration tab from the URL query
The ?tab= query was mirrored into local state through an effect, which
can lag a render behind the URL and duplicates the source of truth.
Derive the active tab from the query directly; trigger clicks already
push the query themselves, and onChange keeps pushing it for Radix's
keyboard navigation, which fires without a click.
* Derive the usage tab from the URL query
Same treatment as the configuration page: the ?tab= query was mirrored
into local state through an effect, duplicating the source of truth.
Derive the active tab from the query; onTabChange keeps pushing it so
clicks, deep links and back/forward all resolve the same way.
* Group user roles into General and Agent Network tabs
Tab the role dropdown by product surface, gate the Agent Network
roles and tab on the Agent Network surface being available, and
disable the role field for the owner unless the caller is an owner.
* Point agent network learn-more links at their docs pages
* Skip the domains lookup when the role can't read it
* Flatten the role selector and add a caller-scoped My Setup page
The role dropdown split General and Agent Network roles into tabs,
which reads as two products inside one field. Return to the single
flat list from main, keeping the surface gate (Agent Network roles
hidden when the surface is unavailable) and the owner protections.
Regular users had no way to see which providers and models their
policies allow or where to point their tools. Add
/agent-network/my-setup backed by the caller-scoped me/setup and
me/consumption endpoints: the endpoint with copy, per-provider
available models, the Configure Your Agent instructions flattened
inline from the connect modal, and the caller's own usage counters.
The sidebar surfaces it for any role — limited view included —
whenever the caller's setup is configured, and stays hidden when
not, which is indistinguishable from no access by design.
* Fix delegated-role API errors and reuse the usage overview for My Usage
Field testing surfaced three problems. The policy and budget modals'
group selector fetched /networks/resources unconditionally, so an
agent_network_admin without the networks permission got a 403 and an
error toast on the policies page; gate the fetch on networks read.
Restricted users got no navigation at all, so the limited view could
never reach My Setup; render the sidebar for restricted users when
their setup is configured or their role reads an agent_network surface.
Roles below account admin also cannot read the account feature flag
(accounts read), so holding an explicit agent_network grant now counts
as proof the surface exists, while callers with accounts read keep the
flag as the source of truth.
My Usage rendered raw per-window counter rows, nothing like the admin
usage view; render it with the same chart-and-table component as the
admin overview, fed from the caller-scoped me/usage/overview endpoint
that returns the identical bucket shape filtered to the current user.
* Reuse the providers-page agent config on My Setup and self-scope Usage & Logs
My Setup now presents the endpoint exactly like the providers page — the
API Base URL badge with Copy and Agent Config opening the same modal
(provider ids come from the caller's me/setup answer instead of the
admin-permissioned provider context) — and drops the My Usage tab: the
regular Usage & Logs page now serves callers without the account-wide
grants too, showing their own data (the server pins the filters to them),
with the identity and provider filters trimmed since they'd be overridden.
usage_viewer gets working filters: the feature-flag fallback moves into
useAgentNetworkMode, AIProvidersProvider gates each fetch on its
submodule read grant so partially-granted roles don't fire 403s, and
GroupsProvider serves restricted roles that hold the groups read grant.
The limited view also gains the Peers link (the add-your-device page).
* Hide provider write actions from read-only viewers
usage_viewer now reads the provider list, but the page still offered every
write flow: Connect Provider, row-click edit, and the enable/disable/delete
menu. Clicking any of them opened the wizard, which - unable to read the
settings row - warned that Agent Network isn't set up even on configured
accounts. Each action is now gated on its own operation grant: the connect
button needs providers create, row-click edit needs update, and the menu
items need update/delete respectively (no menu at all without either).
* Restore the grouped role selector tabs
Bring back the General and Agent Network tabs in the role dropdown
from 3fbeb1e, undoing the flattening: the tabbed grouping keeps the
list readable as more surfaces ship their own delegated roles. The
surface gate (Agent Network roles hidden when the surface is
unavailable) and the owner protections are unchanged.
* Offer the provider and model filters to self-scoped callers
The providers endpoint now self-scopes on the server, so a configured
plain user fetches it too and the caller's own authorized providers back
the Provider and Model filter options on the self-scoped Usage & Logs
view. The identity filters stay hidden — the server pins user and group
to the caller regardless.
* Give the agent config a single home on Connect Agent
The endpoint card carried an Agent Config action on both the providers
page and the caller-scoped self-service page, so the same connect
snippets had two entry points. EndpointBadge now renders it only when
the caller passes providerIds, which is just the self-service page; the
providers page keeps the URL and Copy. The context-backed
AgentConnectModal wrapper is then unused, so it goes.
Rename that page from My Setup to Connect Agent in the sidebar,
breadcrumb and heading: My Setup was the only first-person label in the
navigation, and Connect Agent stays clear of the Configuration sibling.
* Simplify Bedrock config
* Inline the agent config on the Connect page
Drop the Agent Config modal: its snippets now render inline under the
endpoint card, so AgentConnectModal is just AgentConnectTabs and
EndpointBadge is back to the URL and Copy. Move the route to
/agent-network/connect and swap the hand-rolled provider list for the
standard DataTable. Follow the backend rename of me/setup to
agent-config.
* Show a policy's allowed models in the policies table
A policy's model restrictions live on the guardrails attached to it, so
the new Models column unions the enabled model allowlists: one chip for
a single model, a count with the names on hover past that, and a
Restrict badge opening the guardrails tab when nothing narrows the
policy. Clicking the column lands on that tab too.
Chip the models on the Connect Agent table instead of comma-joining
them, and capitalize the model counts across all three tables to match
the "2 Groups" chips on Peers.
* Point the Kimi e2e config assertions at the Connect Agent page
The Kimi-gated config surfaces moved: the Agent Config modal is gone and
the snippets render inline on /agent-network/connect, so the spec stopped
finding the button it used to click on the providers page. Navigate to the
Connect page instead.
That page's answer is caller-scoped — it only offers providers the
caller's own policies authorize — so the spec now grants the owner the
freshly connected provider through a dedicated group + policy, torn down
again (group detached from the owner first) before and after the run. The
backing GET /agent-network/agent-config ships with newer management
builds; on builds that predate it the suite skips, same as the existing
catalog and settings-bootstrap probes.
* Hand the agent config to every account member
The agent-config answer withheld the endpoint from callers no policy
covers, so "account not set up" and "you have no access" were the same
shape. The dashboard shows every user the same connection config, so
Configured now tracks the account: once it has an endpoint every member
gets it, with an empty providers list for those no policy covers. That
list stays caller-scoped, and the endpoint authorizes nothing on its own
since the gateway still refuses every request no policy permits.
Rename the files and symbols the endpoint outgrew when it became
/agent-network/agent-config: me_handler.go, setup.go and types/setup.go
become agent_config.go, GetSetupForUser becomes GetAgentConfigForUser,
and the AgentNetworkMeSetup schema becomes AgentNetworkAgentConfig.
Regenerating types.gen.go from the untouched spec first reproduced it
byte for byte, so the generated diff is only these renames.
* Let the surface switch decide the Agent Network section
Connect Agent and Usage & Logs were visible on the caller's own setup
alone, so a deployment with Agent Network off still showed them, and the
route tree then 404d the links the nav had just rendered. The switch now
decides first.
The caller's agent config still stands in for the switch, but only for
callers who cannot read the config themselves - otherwise an account
holding an endpoint kept the surface on for its owner regardless.
* Collapse the two User types the merge left behind
Both sides of the merge declared a User type, in different regions of the
helper, so the merge took both without ever reporting a conflict and
Playwright refused to parse the file. One type now carries the union of
the fields the /users answer returns.
* Fix SNAPSHOT version display
* Fix e2e tests
* Fix e2e tests
* Fix version display
* Fix e2e
* Fix e2e
* Fix e2e
---------
Co-authored-by: braginini <bangvalo@gmail.com>
* Add multi-select bulk deletion for Access Control groups
* Add indeterminate group selection and permission-safe column visibility
* Background rule for checkbox component
* Better show when disabled
The generated Docker command used --rm, which removes the container on
stop. Combined with -d, the NetBird client would not survive a host
reboot despite the persistent netbird-client volume. Replace with
--restart=unless-stopped so the client reconnects automatically.
* Fix typo in PeerExpirationToggle component
* Fix the same typo in PeerActionCell
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add a workflow bumping the WASM client on netbird releases
* Cover the pinned WASM client with an instantiation test
* Connect the pinned WASM client to management in the e2e suite
* Validate the dispatched tag before it reaches the shell and satisfy lint
* Sort the spec imports
* Clean up the registered peer even when the connect test fails
* Drive the dashboard's own remote-access flow instead of the client directly
* Mint the flow test's target peer by exposing a service
* Limit the wasm check to what the test environment can prove
* Give the wasm download and compile a realistic budget
* Hold the wasm client to the dashboard's initialization deadline
Loading a provider's models merged anything the catalog did not already carry
by exact id, and hardcoded both rates to zero on the way in. The comment gave
the reason: the discovery response carried no prices. That stopped being true
when the endpoint began returning the same rates the proxy bills with.
Bedrock feels all of it. Its listing returns geography-prefixed ids —
eu.anthropic.claude-opus-4-7 — while the catalog holds the bare
anthropic.claude-opus-4-7, so no Bedrock model ever matches by string and every
one of them takes this branch. Selecting one filled its row with $0, and the
form then warned that the model had no cost set, while the API had reported a
rate for it. Usage against it records nothing.
Exact-id matching stays. Collapsing a geography-prefixed id onto its catalog
entry would hand back the bare form, and only the prefixed one is invocable at
AWS.
The model picker only offered NetBird's compiled-in catalog, which goes stale as
vendors retire models and cannot reflect what an account is actually entitled to.
Adds a "Load models from provider" action backed by
`POST /agent-network/catalog/providers/models` (netbirdio/netbird#7246). Editing a
saved provider reuses the stored credential, so the masked key never reaches the
browser; creating a new one sends the key being typed. Discovered models merge into
the catalog options, with catalog entries winning a collision because they carry
pricing. A model the backend reports as unpriced is flagged and needs confirmation
before saving, so nothing is registered at a silent zero.
Two implementation notes: the unpriced warning renders once at list level rather
than per row, and the hook uses `ignoreError: true` so a provider-specific failure
is reported inline in the modal instead of as a global toast.
The HubSpot form behind the self-hosted Agent Network signup now has a
required company-scoped Country/Region field, so submissions without it
are rejected. Adds a searchable Country dropdown to the signup step and
includes the value as an objectTypeId 0-2 field.
Uses a static country list instead of /locations/countries since the
geolocation database may be absent on self-hosted deployments and the
HubSpot property expects full country names, not ISO codes.
The desktop client reworked its UI in v0.75: the management server is now
asked for on the first-run "Set up NetBird" screen and lives under
Settings > General, so the "Settings > Advanced Settings" path the Windows
and macOS tabs described no longer exists. Move the copy into a shared
ManagementUrlStep, cover the already-installed case, and say "menu bar"
instead of "system tray" on macOS.
Fixes#732
* Remove unnecessary comment
Alpine 3.14 reached end of life in May 2023 and has received no security
fixes for roughly three years. nginx is installed from the Alpine repos
rather than pinned, so the base bump also moves nginx 1.20.2 -> 1.30.4,
certbot 1.16.0 -> 5.6.0 and supervisor 4.2.2 -> 4.3.0.
Alpine 3.24 carries security support until June 2028.
Verified by building and running this Dockerfile on 3.14, 3.23 and 3.24 and
comparing: the served index.html is byte-identical across all three, the CSP
response header hashes identically, `nginx -t` passes on the existing config,
and supervisord reaches the same state. /etc/crontabs/root and
/etc/nginx/http.d/ still exist on 3.24, so the `rm /etc/crontabs/root` step and
the config COPY paths are unaffected. Every certbot flag used by init_cert.sh
is still accepted by certbot 5.x.
Certificate issuance itself could not be exercised without a real domain, so
the certbot 1.x -> 5.x jump should get one staging issuance before rollout.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: upgrade to Next.js 16.3
Turbopack is now the default for both `next dev` and `next build`, so the
separate `turbo` script is redundant and has been dropped.
`next build` rewrites tsconfig `moduleResolution` to "bundler", which Next 16
expects.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* chore: migrate ESLint to flat config
`next lint` was removed in Next 16, so `npm run lint` had been failing with
"Invalid project directory provided, no such directory: ./lint" since that
upgrade. eslint-config-next 16 also ships flat config only, which the old
.eslintrc.json could not consume.
Ignores .claude/ so stray worktree copies of the repo are not linted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: replace ip-cidr with ip-address to clear CVE advisories
ip-cidr pulled a vulnerable ip-address (GHSA-mwp4-54f8-5fhr, high: leading-zero
octets decoded as decimal while resolvers read them as octal, enabling SSRF;
GHSA-v2v4-37r5-5v8g, moderate: XSS in Address6 HTML methods). npm reported "no
fix available" because even the latest ip-cidr pins ip-address ^9.0.5, still
inside the vulnerable range.
ip-address 10.x was already a direct dependency and covers every use: its
isValid rejects leading-zero octets and validates mask ranges natively, and
isInSubnet replaces the one `new cidr().contains()` call site.
The new validators were differential-tested against the real ip-cidr over a
67-input corpus (134 checks) before removal, with no divergences; containment
was checked across 14 v4/v6/boundary/cross-family cases. `npm audit` now
reports 0 vulnerabilities.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor: replace next-themes with an in-repo ThemeProvider
next-themes renders an inline <script> to set the theme before paint. It was
loaded through dynamic(ssr: false), so that script rendered on the client, where
React 19 never executes script tags and warns:
Encountered a script tag while rendering React component.
Upgrading would not have helped; 0.4.6 still renders the script
unconditionally. The script was also useless here: injected after hydration, it
could not prevent a flash, and postbuild.js hoists inline scripts out of the
export anyway.
The replacement keeps the same `netbird-theme` storage key and three-mode
support, and sets the theme class on <html> in the layout instead, so the
static export ships the correct theme in its first byte with no script at all.
Dropping the dynamic(ssr: false) wrapper removed an implicit prerender bailout
for the whole provider tree, which exposed isNetBirdCloud() reading
window.location during the build-time render; it is now guarded. The exported
HTML is byte-identical either way, since the page already bails to client
rendering.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: key the router children slot in the dashboard layout
React logged "Each child in a list should have a unique key prop. Check the
render method of DashboardPageContent." The App Router's segment element for
`children` arrives with a null key, which React flags once it is reconciled
alongside the Navigation sibling. Wrapping it in a keyed Fragment resolves it.
Verified in the browser both ways: with the Fragment the console is clean,
without it the warning returns.
Also applies the pending simple-import-sort fix for this file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: match IPv4-mapped IPv6 hosts against IPv4 CIDRs
Regression from replacing ip-cidr. Its contains() normalised an IPv4-mapped
IPv6 address to the embedded v4 before the subnet check, so
contains("::ffff:10.0.0.5") on 10.0.0.0/24 returned true; isHostInCIDR returned
false. Verified against ip-cidr@3.1.0 directly.
This is reachable: isValidIP accepts "::ffff:10.0.0.5", so a mapped host entered
in ReverseProxyAddressInput against an IPv4 resource CIDR was wrongly rejected.
An IPv6 network still rejects a mapped host, so families do not leak. Checked
across 20 cases (6 mapped-host, 14 pre-existing), with the mapped expectations
taken from measured ip-cidr output.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: derive skeleton colors from the resolved theme
SkeletonTheme had the dark palette hardcoded, so a light theme would render
dark skeletons. The light values are the ones already defined on the
feature-light-theme branch rather than new invented colors.
resolvedTheme is tracked in state and updated from the existing apply(), so the
palette also follows the OS preference under "system".
Latent today, since DarkModeToggle disables both Light and System.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: center icons in collapsed navigation rail
Nav items have 24px of left padding (px-3 on the li plus px-3 on the
button), so with 16px icons the icon center lands at 32px. The 70px rail
centered at 35px, leaving icons 3px off. Narrow the rail to 64px so the
two line up, and match the content offset in PageContainer.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: use one plus icon across network tab Add buttons
The Resources and Routing Peers Add buttons used tabler's IconCirclePlus
while the Services tab used lucide's PlusCircle. Both were size 16, but
the two icon sets draw at different inner scales, so the glyphs read as
different sizes. Standardize on lucide.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adopts the new Agent Network settings contract:
- The management API replaced the implicit settings bootstrap — a
`bootstrap_cluster` hint on the first provider create — with an
explicit POST /agent-network/settings carrying the proxy cluster
address. The settings response now carries endpoint +
proxy_address + dedicated instead of cluster + subdomain.
- The provider wizard keeps its UX (auto-picking a validated cluster,
gating the first create on having one) but now bootstraps the
settings row with the explicit POST right before the first provider
create. A bootstrap failure keeps the wizard open and surfaces the
error — previously a failed bootstrap was swallowed server-side and
the account silently ended up with a provider but no endpoint. A 409
(concurrent bootstrap won) is treated as success, since the row
exists either way.
- Types updated accordingly; bootstrapAgentNetworkSettings is exposed
on the providers context. The onboarding provider step reuses the
same wizard, so it is covered by the same change.
Without this, the dashboard against a new management silently stops
bootstrapping accounts: provider create succeeds (the old hint is an
ignored unknown field), but no endpoint is ever assigned.
Self-hosted management versions can carry a numeric build suffix
(e.g. 0.76.3-31256681241) that overflows the sidebar box. Show the
semver only and move the full string into the hover tooltip alongside
the latest version. Pre-release labels like -rc.1 are preserved.
The onboarding survey opened a HubSpot booking modal for accounts with
50+ planned users. Removes the modal, its onboarding-call experiment
variants, the trigger in Onboarding.tsx, and the now-unused avatar.
Keeps src/cloud/cloud-hooks/useExperiment.ts, which this was the only
consumer of, for a future experiment.
* Handle agent-network settings defaults response
The management API now answers the settings GET with a defaults object
before the account is bootstrapped (empty cluster/subdomain/endpoint)
instead of a JSON null body. Normalize that shape to the existing null
settings signal so every consumer keeps a single not-bootstrapped check,
while still tolerating the null body and 404 from older backends.
* Pin the settings wire-shape normalization in a Playwright spec
The providers page must render the connect-first empty state for every
unbootstrapped settings shape the management API has answered with over
time (defaults object with an empty endpoint, JSON null body, 404) and
the endpoint badge once bootstrapped. The settings route is mocked per
test so the spec is independent of the backend build and of account
state left behind by other suites.
* Address review: no stale settings on 404, close context on setup failure
useFetchApi keeps the previous SWR data alongside the error, so a later
404 could expose stale settings through the memo; it now yields null
when the error is a 404 while still riding out transient failures on
the kept data. The wire-shapes spec closes its browser context when a
setup step throws before the close callback is handed to the test.
Zypper ignores the gpgkey= entry of a .repo file, so the yum snippet would
leave the repository key uninstalled on openSUSE. The new distro entry adds
the repository with GPG checking enabled and imports the key on refresh.
* Cover RPM-based distros and desktop app dependencies in the Linux tab
The manual-install section of the add-peer modal only covered Ubuntu via
APT. Replace the single Ubuntu accordion with a distro selector covering
Debian/Ubuntu (APT), Fedora (DNF), RHEL/AlmaLinux/Rocky (DNF), and Amazon
Linux (YUM).
The desktop app links GTK 4.10+ and WebKitGTK 6.0 but the released
netbird-ui packages do not declare them, so each desktop-app install line
names the packages explicitly and a callout states the minimum release
(Ubuntu 24.04, Debian 13, Fedora 43, RHEL 10 with EPEL). Distros without
the required stack get CLI-only instructions.
* Add e2e coverage for the Linux distro selector
* Add Kimi (Moonshot AI) provider support to Agent Network UI
Pairs with the management catalog's new kimi_api entry:
- kimi_api in the AIProviderId union and the access-log provider-id
normalization list.
- Provider modal: api.moonshot.ai host placeholder, upstream-URL help
explaining the OpenAI-shape (/v1) vs Anthropic-shape (/anthropic)
path choice, sk-... key placeholder.
- Configure Your Agent: Kimi backend option in the Claude Code tab
(JSON + shell modes), a Kimi variant in the Codex tab using
wire_api="chat", and a new Kimi CLI tab with the ~/.kimi/config.toml
provider setup. All Kimi surfaces render only when a kimi_api
provider is connected, and pre-select themselves when Kimi is the
only provider of its shape.
- Onboarding defaults to the Claude Code tab for Kimi providers.
* Add Kimi provider e2e spec
Walks the Kimi lifecycle against the real backend: select kimi_api from
the catalog (prefilled host, catalog model pricing), connect it, then
assert the Kimi-gated Configure Your Agent surfaces (Kimi CLI tab,
Claude Code kimi-k3 config, Codex wire_api=chat variant) and clean up
via new agent-network API helpers. Skips when the management build
under test has no kimi_api catalog entry, so it can merge ahead of the
backend and activate once the management-cloud image carries it.
* Remove Codex option for Kimi and align Claude Code config with Moonshot guide
Codex has no clear support against Moonshot's upstream, so the Kimi
variant is dropped from the Codex tab. The Claude Code Kimi snippet now
pins all default model tiers and the subagent model to kimi-k3 and
disables tool search, per Moonshot's Claude Code guide.
* Carry the /anthropic shape prefix in the agent base URL for Kimi
The Kimi provider keeps its default https://api.moonshot.ai upstream;
Claude Code and Kimi CLI select the Anthropic shape by appending
/anthropic to the endpoint base URL, which rides through to Moonshot.
One provider now serves both API shapes.
* Kimi CLI uses the bare endpoint base URL
Only Claude Code carries the /anthropic prefix; Kimi CLI's anthropic
provider type points at the bare endpoint.
* Kimi tooltip
* Make the Claude Code provider dropdown width flexible and tidy Kimi notes
* Make the Claude Code provider dropdown width flexible and tidy Kimi notes
* Restored the note on the Kimi CLI tab
---------
Co-authored-by: braginini <bangvalo@gmail.com>
When creating a network resource and adding a policy with a single peer
(sourceResource) as the source, the payload included both an empty
`sources: []` array and `sourceResource`, causing the backend to reject
it with "specify either sources or source resources not both".
`createPolicyForResource` always computed `sources` as an array while the
`...rule` spread carried `sourceResource` through. This mirrors the
existing destinations handling: gate `sources` on `rule.sourceResource`
so it becomes undefined (and is dropped during serialization) when a
source resource is set.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Make Agent Network menu available via dashboard_features.agent_network
Wire the new dashboard_features account setting into the dashboard at the API
level: add it to the Account settings interface (so settings updates round-trip
it) and have useAgentNetworkMode treat dashboard_features.agent_network === true
as enabling the Agent Network menu alongside the full dashboard. Unlike
agent_network_only it does not focus the dashboard, and it does not trigger the
onboarding flow. No settings-menu UI yet; the field is set via the API.
* Add e2e coverage for dashboard_features.agent_network menu availability
* Set dashboard_features for existing netbird.ai accounts
The signup-source flow only handled new accounts (agent_network_only) and
discarded the source for existing accounts, so nothing set dashboard_features.
Branch on account existence: new accounts get the focused view, existing
accounts get the Agent Network menu made available via
dashboard_features.agent_network. Adds e2e coverage for the existing-account
write.
* Also enable Agent Network menu for new netbird.ai accounts
New accounts got agent_network_only (focused) but not
dashboard_features.agent_network, so turning the focused view off later would
remove the Agent Network menu entirely. Set both on new accounts so disabling
focus degrades to menu-available rather than losing access.
* Match badged nav labels by substring in dashboard_features e2e
* Treat agent network deployment config as a floor over account setting
* Add agent network env x signup-source e2e matrix with a config override
Accounts that sign up through netbird.ai are focused on the Agent Network
surface and taken through the Agent Network onboarding. Reversible by the user
and a no-op for every other account.
- Capture ?signup_source=netbird.ai pre-auth (survives the OIDC redirect); once
authenticated, mark new accounts with settings.agent_network_only, awaiting
/accounts revalidation before clearing the source so the view never flips.
- useAgentNetworkMode() resolves the mode with nullish semantics: an explicit
account setting (true or false) wins over deployment config; when absent, a
pending netbird.ai signup or NETBIRD_AGENT_NETWORK_ONLY/_ENABLED decides.
Purely additive — unchanged behavior when the setting is absent.
- Navigation, the agent-network route guard, control-center, and fetch gates
read the resolver instead of the config flags.
- Onboarding: the form is chosen from signup_source synchronously, so netbird.ai
arrivals see the Agent Network signup form (now shown on cloud) and never the
regular form, even under a slow backend.
- Client Settings gains an "Agent Network focused view" opt-out toggle.
- E2E coverage for focused-view menu/routes and onboarding form selection.
* feat: default billing to EUR only, preserve USD for active subscribers
Removes the USD/EUR currency selector from Plans & Billing. New
subscriptions, MSP tenants, and distributor customers now default to
EUR; any existing active USD subscription keeps its real currency so
its price stays accurate.
Also fixes a latent bug where MSP/distributor per-tenant pricing was
computed off the admin's own account currency instead of each
tenant's, pins AWS Marketplace checkout to USD since it's a separate
billing rail, and removes an unused dead TotalCost stub from the MSP
Tenants table.
* move currency helper into provider
* force usd for aws
* fix flaky setup key test
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Show management API request id in error notifications
Newer management servers return an X-Request-Id header on every response,
including errors. Surface it in the error toast so it can be quoted in
support tickets.
- api.tsx: read X-Request-Id from the response and attach it to the
rejected ErrorResponse (both the JSON-body and status-text paths).
- Notification.tsx: render a copyable "Request ID" line whenever an error
carries one, covering the promise-based mutation notifications.
- ErrorBoundary.tsx: thread the request id through for GET/fetch errors.
The line is only shown when the header is present, so older servers that
do not send it are unaffected. Adds an e2e spec covering both cases.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* docs: add request-id error toast screenshots for PR
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* test: expose X-Request-Id via CORS in e2e mock
The dashboard reads the request id from a cross-origin response, so the
browser only surfaces the header to JS when the response lists it in
Access-Control-Expose-Headers. Mirror a CORS-enabled management server in
the mock so the test exercises the dashboard logic rather than the header
being filtered out cross-origin.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016B2yLBeDK3kvX2FvhqcWk8
* test: assert error toast via data-testid instead of text
Add a notification-title testid to the toast and target it with
getByTestId in the request-id spec, following the repo convention of
selecting by data-testid rather than brittle visible text.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Add Metrics settings tab with metrics push toggle
Add a dedicated Metrics tab to Settings with a toggle for enabling
anonymous performance metrics collection. Moves metrics out of the
Clients tab into its own tab with description and docs link.
* Update docs link
* fix(docker): reload nginx after patching CSP header
nginx is started by supervisord (priority 100) before init_react_envs.sh
(priority 201) and is never reloaded afterwards, so it keeps serving the
static default.conf CSP that has no connect-src. Over plain HTTP this blocks
OIDC discovery and the management API, breaking browser SSH/RDP auth.
Reload nginx at the end of the init script so the dynamically built CSP
header takes effect.
* Update docker/init_react_envs.sh
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* fix(docker): log nginx -t output on failed CSP reload
When the reload never succeeds, run nginx -t before exiting so the logs show
whether the patched config is invalid or nginx never came up.
* conditionally emit `upgrade-insecure-requests` in CSP
---------
Co-authored-by: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
Gate premium endpoints so the open-source dashboard stops calling
endpoints the open-source management server does not serve:
- MSP/Distributor: only fetch /integrations/msp, /integrations/msp/switcher
and /integrations/msp/reseller on NetBird Cloud
- EDR bypass: only fetch /peers/edr/bypassed when licensed
- Event Streaming: gate /integrations/event-streaming GETs on the license
in addition to the existing permission check
- useIsLicensed: cache the licensed-only probe result (per API origin, 1h
TTL) so it no longer re-fires on every page load
- Team > Users: show the Identity Provider Sync tile in open-source mode so
IdP sync remains discoverable
Brings the unified dashboard into the open-source repo. Premium features
ship in the open code, gated at runtime via NETBIRD_CLOUD and
NETBIRD_LICENSED, with upgrade prompts for unlicensed self-hosted
deployments. Adds the cloud-only feature areas (billing, integrations,
MSP, traffic events, notifications) and the Playwright e2e suite.
* feat: private service expose
Dashboard surface for the netbird private-service feature: the
reverse-proxy modal gains a Private toggle and the target modal gains
a Direct-upstream option with custom upstream host, both feeding the
backend's Service.private + target.direct_upstream / target.host
fields. The Proxy Events page wraps its table in PeersProvider so
peer-name fallback resolution works for tunnel-peer callers.
Reverse-proxy modal changes (ReverseProxyModal.tsx):
- Private toggle that pivots the modal between standalone and cluster
target types and auto-injects the cluster target.
Reverse-proxy target modal changes:
- Direct upstream toggle (target dials via the host stack instead of
the embedded NetBird client).
- Custom upstream host input revealed when Direct upstream is on.
- New ReverseProxyClusterTargetSelector + ReverseProxyAddressInput.
- useReverseProxyTargetOptions updated for the new option shape.
Proxy Events table:
- Reuses across the reverse-proxy events surface; UserCell falls back
to the peer name when no user is attached to the call.
* feat(reverse-proxy): move NetBird-only access to auth tab + access groups
Restructures the Private (NetBird-only) flow so the auth model is
clearer:
- Removes the 'Private (NetBird-only)' toggle from the Service main
page. Service mode is the only primary choice now.
- Adds a 'NetBird-only access' toggle on the Authentication tab, gated
on serviceMode=HTTP and selectedDomain.supports_private===true. When
the cluster doesn't support it, the toggle is disabled with an
inline note explaining why.
- Adds an Access Groups picker (PeerGroupSelector) inline on the auth
tab when NetBird-only is on. Replaces the previous bearer-auth
distribution_groups overload — these groups go on the new
service.access_groups field on the wire.
- When NetBird-only is enabled, all other auth modes (SSO, password,
PIN, headers, link) are hidden — the inbound peer's WireGuard
identity is the only auth path.
- Adds a 'Direct upstream' toggle to the Advanced settings tab,
gated on isPrivate + cluster supports private. The toggle is
service-level in the UI; on save it patches the (single) cluster
target's options.direct_upstream.
- togglePrivate now also clears bearer/password/pin/header/link
state when entering private mode (strict mutual exclusivity).
* fix(reverse-proxy): tighten NetBird-only flow per review
Five fixes from the first cut:
1. Auth-tab design mismatch. The NetBird-only block was an inline
FancyToggleSwitch + inline PeerGroupSelector. It now follows the
same SettingCard.Item pattern as SSO/Password/PIN/Headers: a
clickable row showing enabled state that opens a dedicated modal
(AuthNetBirdOnlyModal) where the access groups are picked.
2. Trimmed wordy NetBird-only description down to one line.
3. Trimmed wordy Direct upstream help text.
4. Removed the per-target Direct upstream toggle from the target
modal. Direct upstream now lives only at the service level (under
Advanced settings) for private services. Cluster targets still
imply direct_upstream via the existing sanitizeTargets path, so
the wire stays correct.
5. togglePrivate no longer drops the user's existing targets when
entering private mode. The previous behavior silently dropped any
non-cluster targets the operator had configured, leaving the
targets list empty and the Save button disabled. Now: targets
stay put, canSaveService gates on 'all targets are cluster type'
so the Save button accurately reflects what the backend will
accept, and an inline warning explains what to fix when the
constraint isn't met.
The AuthNetBirdOnlyModal requires at least one access group before
Enable becomes clickable, mirroring the SSO modal's pattern.
* fix(reverse-proxy): allow any target type on private services
The cluster-target restriction was a holdover from the previous
auth-by-bearer-groups model where only cluster targets exposed a
proxy peer that could host the ACL. With the new access_groups path
the ACL is server-side and works regardless of how the proxy reaches
the upstream.
- Drop the inline 'Private services only support cluster targets'
warning.
- canSaveService no longer requires all targets to be cluster type.
- Service-level Direct upstream now applies to every target (cluster,
peer, host, domain) when private, so the operator can mix target
types and still control the dial path globally.
- Tightened NetBird-only description to '...connected peers in the
selected NetBird groups.' (per review).
- Tightened Direct upstream help to '...reachable without a Wireguard
connection.' (per review).
A future iteration may add a dedicated cluster-only mode with its own
guided flow; for now the operator picks whatever target types suit
their topology.
* fix(reverse-proxy): count NetBird-only access as protection
The 'No Protection Configured' popup fired even on private services
because isUnprotected only checked the password/PIN/bearer/header/link
auth modes. NetBird-only access is also a form of protection (tunnel
identity + access groups), so include isPrivate in the gate.
* fix(reverse-proxy): show NetBird-only auth and resolve access group names
Two display bugs for private services:
- ReverseProxyModal seeded accessGroups with {id}-only stubs, which
made useGroupHelper skip its ID→Group resolution and render empty
pills in the NetBird-only modal when editing an existing service.
Pass the raw string[] so useGroupHelper resolves full Group objects
with names against the GroupsProvider.
- ReverseProxyAuthCell only inspected password/pin/bearer/headers
auth flags, so a NetBird-only service displayed "No Auth" in the
services table. Add a NetBird-only entry that counts toward the
auth badge, renders as "NetBird Only" with the CircleUser icon
when it's the single auth, and lists the access groups (name +
user count) in the hover.
* feat(reverse-proxy): unify proxy-cluster target into the peer/resource selector
Operators picking a target for a service now see Proxy Clusters as a
third tab alongside Peers and Resources, gated on at least one cluster
advertising supports_private. When the service already has a proxy
cluster the tab lists only that cluster; when it doesn't, picking a
cluster commits it as the service's domain. The dedicated private-mode
cluster picker is removed in favour of this unified flow.
Selecting a cluster target now also auto-flips the service to
NetBird-only, since cluster targets are only reachable over the
WireGuard overlay and SSO/password/PIN advertise an auth path no
public client could exercise. The Access Control tab carries a note
explaining that an allow rule for the account's NetBird network range
is applied automatically alongside any operator-configured rules.
PeerGroupSelector gains opt-in showClusters/clusters/selectedCluster/
onClusterChange props plus a Proxy Clusters tab in its TabsList; the
tabOrder union widens to include "clusters". All call sites that don't
pass showClusters render unchanged.
* fix(reverse-proxy): polish private-service copy and lock Direct Upstream for cluster targets
Title-case NetBird-Only Access and Direct Upstream so the labels read
consistently across the auth tab, the dedicated modal, and the
services-table auth cell.
Cluster targets are reached via the embedded proxy's host network
stack and have no WireGuard endpoint to fall back to, so toggling
Direct Upstream off would silently break them. When any target is a
cluster the toggle is forced on, the FancyToggleSwitch is disabled,
and the helper text explains why. The save path writes the locked-on
value to every target's options.direct_upstream so the persisted
state matches what the UI shows.
* fix(reverse-proxy): support dynamic placeholder and restrict input to IPv4 or IPv6 when required
* fix(reverse-proxy): rename "Agent" to "Peer" in events user cell tooltip
* feat(reverse-proxy): gate NetBird-Only + Direct Upstream on cluster capability
When the selected cluster doesn't have at least one connected embedded
proxy (`netbird proxy`), the NetBird-Only Access and Direct Upstream
controls are visually disabled with a tooltip explaining why, instead of
silently no-op (NetBird-Only) or hidden (Direct Upstream).
- ReverseProxyCluster interface gains the optional `private` flag that
the management API now exposes on /api/reverse-proxies/clusters.
- ClustersFeaturesCell renders a new "Private" badge for clusters whose
`private === true`, matching the other capability badges.
- SettingCard.Item gains a `disabled` prop: opacity-50 + cursor-not-allowed,
click/keyboard guarded, Add/Edit button greyed out. No visual change
for existing usages (default false).
- ReverseProxyModal:
- NetBird-Only Access card is now wrapped in a FullTooltip that
activates only when the cluster lacks support; the SettingCard.Item
is rendered with `disabled` in that case. Description text stops
switching based on cluster state — the tooltip explains the gate.
- Direct Upstream toggle is no longer hidden when supports_private is
false; it stays visible and disabled (alongside the existing
hasClusterTarget locked-on case), wrapped in a tooltip explaining
the cluster requirement. Existing private services whose cluster
lost the capability now show the control disabled rather than
vanishing.
* disable button when no group were selected
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Feature/private service expose update (#651)
* feat(reverse-proxy): refine UI state and copy for NetBird-Only and Direct Upstream controls
- Default `Direct Upstream` to `false` for peer/resource targets; enhance tooltip descriptions.
- Improve conditional rendering of `NetBird-Only Access` setting with appropriate tooltips for unsupported clusters.
- Add cluster badge interaction in `PeerGroupSelector` and dynamic placeholder handling.
- Simplify `ReverseProxyTargetSelector` messaging for proxy forwarding options.
- Enhance `ClustersFeaturesCell` with richer description for the "Private" badge.
* refactor(reverse-proxy): improve tooltip and modal text for clarity
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Splits the Peers sidebar entry into User Devices (/peers/users) and Servers (/peers/servers), with /peers redirecting to User Devices and a shared kind filter splitting peers
by whether the owner is a real user vs a service/no-user. The Servers page description and an inline link replace what was the old "Setup Keys" sidebar item under Peers.
* feat(reverse-proxy): rebuild self-hosted page as Clusters with type + features
The Self-Hosted Proxies page was account-only by design but the
underlying API already returned every cluster the account could see.
Lifting that filter and renaming the page surfaces shared clusters
too — operators can see what NetBird-deployed clusters are reachable
alongside their own self-hosted ones, with online status and feature
support visible per row.
ReverseProxyCluster matches the new backend shape: `type`
(account/shared), `online`, and the three capability flags. The
`isSelfHostedCluster` provider hook now compares against `type ===
account` instead of a deprecated boolean.
Page folder renamed self-hosted-proxies → clusters (history-preserving
git mv). Table columns: Cluster (with an EphemeralPeerIndicator-style
icon next to the name marking account vs shared and a colored dot for
online status), Connected Proxies (plain numeric), Features (one
tooltip-backed badge per supported capability), Actions (Delete only
on account-owned rows; shared clusters render an empty action cell).
Empty state shows when the list is fully empty with a doc link in the
page header. Sidebar entry restored under Reverse Proxy.
* Update record in modal, update doc link, update modal title
* update reverse proxy documentation links to latest anchors
* update cluster modal description to "proxy cluster" instead of "self-hosted cluster"
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Add new pull request template + enforce documentation acknowledgement in new workflow
* fix docs-ack workflow: pass PR number via env and simplify checkbox validation
* Add layer 4 proto support
* Fix initialResource fallback and UDP session_idle_timeout
* Fix tlsResourceId init for resource-driven create flows, UDP timeout label
* Address PR review: ServiceMode enum, resource init fix, modal title, a11y
* Add L4 protocol values to ReverseProxyTargetProtocol, remove unsafe double cast
* Add aria-labels to L4 port/host inputs
* Unify domain input for all service modes including L4
* Support L4 proxy events
* Fix custom port reset on edit and show port in L4 service link
* Remove redundant listen port from L4 target cell
* Show link only for HTTP/TLS services, copy-on-click for TCP/UDP
* Move mode badge before domain and use fixed width for alignment
* Fix HTTP services to open as link instead of copy
* Hide old proxy clusters from L4 domain selector
* Move service type inside modal
* Update auth cell
* Add target selector component
* Extract into separate components
* hide services types for not supported clusters
* Remove advanced settings tab in http targetmodal and use accordion instead
* Update advanced settings
* Update target device row
* Update text
* Add type cell
* Fix flat target name cell
* Update modal title
* Fix edit target in flat table
* Remove unused proxycluster interface
* Move proxy type icon into type component
* sync cloud
* use emptyrow
* fix l4 type
* fix duplicate error notification
* Set the correct target type
* Fix subnet host editable
* Fix subnet host editable
* hide selector when initial resource or peer
* Rename dropdown
* Update text
* update status cell
* merge cloud
* Update tooltips
* Address coderabbit comments
* Fix skeleton device card
* Update listen port tooltip
* Adjust padding
* update package-lock.json
* bump next to 16.1.7
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* [dashboard] feat: add auto_update_always toggle to client settings
Add "Always Update" toggle to the Clients settings tab that controls
whether updates are installed automatically in the background or require
user interaction from the UI. Includes a warning icon and caution callout
when enabled to highlight the risk of disrupting active connections.
* [dashboard] fix: improve auto-update UI clarity and toggle label
Clarify that automatic updates require user interaction by updating the
description. Rename "Always Update" to "Force Automatic Updates" for
clarity. Move warning callout below the toggle switch instead of inside it.
* Update src/modules/settings/ClientSettingsTab.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Add acl tooltips
* Adjust resource modal and add tooltips
* Prevent nextjs navigation trigger on tab change
* Update wording
* add acl into resource
* Refactor resource policies
* Add prop to hide group edit and disable redirect
* Add skeleton loader to network page
* Create policy for new resources
* Show existing policies if groups are matching
* Add confirm dialog after creating resource without policy
* Add dialog if user edits policy that is used in multiple resources
* Add callout when selecting resource groups containing policies
* Add dialog if deleting policies containing resources
* Fix stale policies and new group creation in resource modal
* Remove whitespace
* Fix sort
* Cleanup
* Address coderabbit comments
* Fix policy alignment
* Fix initial resource
* disable selector if user did not select resource groups
* Consider current resource when editing / deleting policy
* Remove unused mutate
* Fix dot position
* Remove ask for policy
* Fix policy index
* Fix multiple resource confirm dialog on policy cell
* add draft
* add reverse proxy activities
* move peer expose settings into client settings tab and fix activity descriptions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* prevent false positive group report
* add docs link
* allow save when groups are added to the setting
* Add loading skeleton to client settings, update icon, use grouphelper to allow creating new groups, remove .patch
* mv expose settings from extra settings
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Remove architecture info tooltip for MacOS
Previously, this tooltip helped users determine which binary to download. Since #501, there is only one universal binary download link, so keeping the tooltip explaining how to determine the CPU architecture is unnecessary.
* fix: Remove unused imports
* implement debug ui
* update job ui
* Add type cell, show tooltip if peer is offline, add copy to clipboard for upload key, show error reason in tooltip
* update job event description
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Redirect /setup to /peers if not setup is required
* Fix bad state while redirect
* Prevent redirect to /setup if already on /setup
* Fix loading state
* Add user creation with password copy
* Add initial identity provider view
* Add IdP logos
* Add IdP id to user
* Add IdP logo to user obj
* Fix okta icon
* Return callback URL when creating an IdP
* Create user for self-hosted
* Clear up password from the state
* Show IdPs and create user when enabled
* Fetch IdPs only when embedded idp is enabled
* Update src/app/(dashboard)/settings/page.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/app/(dashboard)/settings/page.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProvidersTab.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProviderModal.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProvidersTab.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Update src/modules/settings/IdentityProviderModal.tsx
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Rename IdentityProvider to SSOIdentityProvider
* Fix build and extract icons
* Fix initial onboarding
* Add icons
* Move name to the top
* Fix setup wizard background color
* Update instance setup ui
* Update instance setup ui
* Use input component
* Move idp label and icons
* Fix setup wizard width
* Add authentik and keycloak
* Add idp hints
* Handle idp permissions
* Consider selfhosted instances when checking if netbird is hosted
* Update redirect
* Add max retries to redirect
* Require new secret when clientid changed
* Add callback URL on the idp creation step
* Add idp activity events
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* move our group membership from the settings menu, into the Team menu
* add action to the table and new group page
* update group page and return group settings to settings menu
* new update
* fix bug
* group action: add peer to group
* group action: add user to group
* Update wording, redirect to group page after creation
* Add better table loading skeleton
* Adjust group name cell
* Update wording
* Update sort order
* Refactor
* Merge main
* Fix button height
* Fix resources table
* Adjust table loading skeleton
* Adjust table loading skeleton
* Add loading to tab triggers
* Update meta
* Update group location
* Fix rename
* Refactor group details
* Fix linked peers
* Fix group usage
* Fix incrementing peer count
* Prevent renaming to already existing group
* Fix group name click
* Update group nav
* Make group table cells clickable
* Fix breadcrumbs
* Update wording
* Add confirmation before removing users from group
* Add permissions
* Add initial group for network routes
* Add acl and routing peer groups
---------
Co-authored-by: aliamerj <aliamer19ali@gmail.com>
* fix: add multi-group support for JWT allow groups with tag system
* Update src/modules/settings/GroupsTab.tsx to use the Badge component
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* chore(GroupsTab): import Badge components
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
implements a "Sync with cloud" functionality that includes various UI improvements, code refactoring, and component extractions. The changes focus on enhancing the user interface, improving code organization, and adding new features for remote access and activity tracking.
- Refactors inline components into reusable shared components
- Adds new activity tracking for group operations
- Updates remote access configuration and UI components
- Enhances styling and layout for better user experience
implements a user approval feature that allows administrators to manually approve new users before they can access the system. The feature adds approval workflow controls and error handling for blocked/pending users.
Adds user approval toggle in authentication settings
Implements approve/reject actions for pending users in the users table
Creates error page for blocked/pending approval scenarios
* Add display of ID if user does not have email
* Update PeerNameCell.tsx
* Add more possible id parameters
* Hide user if there is nothing
* change id order
* Keep default behavior
* Add resource description, add single resource for acl, add icons for group badges, add inactivity expiration
* Add extra dns labels, remove routing restriction
* display serial number on peer information and on peers table
* add serial on peers list (included in OS information to minimize informations)
* permit a lookup via serial number
* add serial on peer information
* Update os icon to match existing one and hide serial if it does not exist
---------
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
* Fix wrong ui state for routing peer modal in networks
* Add confirmation dialog when blocking users
* Keep peer sort order when switching pages
* Update sidebar navigation order and remove deprecation notice
* Fix issue when hovering over truncated text in a group badge closes the multiple groups popover
* Update group text in network resource modal
* Update networks page text
* Fix line height
* Add search to resource table
* Switch networks flow to create first resources and then add routers
* Add enabled toggle to routing peers
* Add enabled toggle to network resources
* Add resource group modal and adjust tables
* Clarify networks
* Fix not properly aligned horizontal scroll bar
* Add option to install netbird after creating a setup key
* Fix text for install netbird modal
* Show resources count in group settings
* Fix "no results" and "no routing peers" text showing at the same time
* Fix wording
* Fix resource policy count
* Hide resource count when selection source groups
* Extend networks routing peer modal with option to create a setup key and install netbird
* Add option for horizontal stepper
* Generate setup key when installing netbird from routing peer modal
* Add confirm dialog to let the user know a one-off setup-key will be created. This avoids accidental clicking and later confusion on the setup keys page
---------
Co-authored-by: Misha Bragin <bangvalo@gmail.com>
* Add admin-url to the add-peer dialogue
* Missed "let" from defining the variable
* Update netbird.ts
Fix isNetBirdHosted check
---------
Co-authored-by: Eduard Gert <eduard@netbird.io>
* Update axa oidc library and package.json
* Update ACL port state to show correct value
* Filter user groups by unique groups only
* Add peer multiselect, optimize dropdown performance for peer selection, remove 'all' group from some dropdowns, various ui / ux optimizations
* Add peer multiselect, optimize dropdown performance for peer selection, remove 'all' group from some dropdowns, various ui / ux optimizations
* Add try catch block for global search
* Add fallback for group name
* Add fallback for setup key name
* Do not load setup key modal if it's not open
* Check if auto_groups actually exists for the setup keys
* Add fallback for group names in setup keys table
* Add fallback for group names in peers table
* Change icon size
* Remove integrations
* Add no cache header
* Add analytics event tracking
* Add small announcement improvements
* Remove peer approval setting
* Do not load countries when user has no permission
* Add tab query params to settings
* Decrease navigation font size
* Change order of providers
* Increase padding for modals
* Show page only when user is fully loaded and found
* Remove unused state
* Remove integrations page
* Fix group badge icon size
* Fix copy icon size
* Add region information to peer table and single peer view
* Push to docker
* Change login expired icon size
* Fix country flag in single peer view
* Change country flag size in peer table
* Disable revalidation for countries
* Fix icon size on peer detail view
* Rollback workflow
* Revert login expiration
---------
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
support to routes with peer group
updated the view logic to support the new type
updated peer view as well
for now, we are supporting a single group, but that can be extended
echo "::error::You checked 'docs added' but didn't include a valid HTTPS PR link to netbirdio/docs (e.g., https://github.com/netbirdio/docs/pull/1234)."
exit 1
fi
pr_number="$(printf '%s' "$url" | sed -E 's#.*/pull/([0-9]+)$#\1#')"
{
echo "url=$url"
echo "pr_number=$pr_number"
} >> "$GITHUB_OUTPUT"
- name:Verify docs PR exists (and is open or merged)
This Contributor License Agreement (referred to as the "Agreement") is entered into by the individual
submitting this Agreement and NetBird GmbH, Brunnenstraße 196, 10119 Berlin, Germany,
referred to as "NetBird" (collectively, the "Parties"). The Agreement outlines the terms and conditions
under which NetBird may utilize software contributions provided by the Contributor for inclusion in
its software development projects. By submitting this Agreement, the Contributor confirms their acceptance
of the terms and conditions outlined below. The Contributor further represents that they are authorized to
complete this process as described herein.
## 1 Preamble
In order to clarify the IP Rights situation with regard to Contributions from any person or entity, NetBird
must have a contributor license agreement on file to be signed by each Contributor, containing the license
terms below. This license serves as protection for both the Contributor as well as NetBird and its software users;
it does not change Contributor’s rights to use his/her own Contributions for any other purpose.
## 2 Definitions
2.1 “IP Rights” shall mean all industrial and intellectual property rights, whether registered or not registered, whether created by Contributor or acquired by Contributor from third parties, and similar rights, including (but not limited to) semiconductor property rights, design rights, copyrights (including in the form of database rights and rights to software), all neighbouring rights (Leistungsschutzrechte), trademarks, service marks, titles, internet domain names, trade names and other labelling rights, rights deriving from corresponding applications and registrations of such rights as well as any licenses (Nutzungsrechte) under and entitlements to any such intellectual and industrial property rights.
2.2 "Contribution" shall mean any original work of authorship, including any modifications or additions to an existing work, that is or previously has been intentionally Submitted by Contributor to NetBird for inclusion in, or documentation of any Work.
2.3 "Contributor" shall mean the copyright owner or legal entity authorized by the copyright owner that is concluding this Agreement with NetBird. For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
2.4 "Submitted" shall mean any form of electronic, verbal, or written communication sent to NetBird or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, NetBird for the purpose of discussing and improving the Work, but excluding communication that is marked or otherwise designated in writing by Contributor as "Not a Contribution".
2.5 "Work" means any of the products owned or managed by NetBird, in particular, but not exclusively, software.
## 3 Licenses
3.1 Subject to the terms and conditions of this agreement, Contributor hereby grants to NetBird and to recipients of software distributed by NetBird a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce by any means and in any form, in whole or in part, permanently or temporarily, the Contributions (including loading, displaying, executing, transmitting or storing works for the purpose of executing and processing data or transferring them to video, audio and other data carriers), including the right to distribute, display and present such Contributions and make them available to the public (e.g. via the internet) and to transmit and display such Contributions by any means. The license also includes the right to modify, translate, adapt, edit and otherwise alter the Contributions and to use these results in the same manner as the original Contributions and derivative works. Except for licenses in patents acc. to Sec. 3, such license refers to any IP Rights in the Contributions and derivative works. The Contributor acknowledges that NetBird is not required to credit them by name for their Contribution and agrees to waive any moral rights associated with their Contribution in relation to NetBird or its sublicensees.
3.2 Subject to the terms and conditions of this agreement, Contributor hereby grants to NetBird and to recipients of software distributed by NetBird a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license in the Contributions to make, have made, use, sell, offer to sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by the Contributor which are necessarily infringed by Contributor‘s Contribution(s) alone or by combination of Contributor’s Contribution(s) with the Work to which such Contribution(s) was Submitted.
3.3 NetBird hereby accepts such licenses.
## 4 Contributor’s Representations
4.1 Contributor represents that Contributor is legally entitled to grant the above license. If Contributor’s employer has IP Rights to Contributor’s Contributions, Contributor represent that he/she has received permission to make Contributions on behalf of such employer, that such employer has waived such IP Rights to the Contributions of Contributor to NetBird, or that such employer has executed a separate contributor license agreement with NetBird.
4.2 Contributor represents that any Contribution is his/her original creation.
4.3 Contributor represents to his/her best knowledge that any Contribution does not violate any third party IP Rights.
4.4 Contributor represents that any Contribution submission includes complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which Contributor is personally aware and which are associated with any part of the Contribution.
4.5 The Contributor represents that their Contribution does not include any work distributed under a copyleft license.
## 5 Information obligation
Contributor agrees to notify NetBird of any facts or circumstances of which Contributor become aware that would make these representations inaccurate in any respect.
## 6 Submission of Third-Party works
Should Contributor wish to submit work that is not Contributor’s original creation, Contributor may submit it to NetBird separately from any Contribution, identifying the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which Contributor are personally aware, and conspicuously marking the work as "Submitted on behalf of a third-party: [named here]".
## 7 No Consideration
Unless compensation is mandatory under statutory law, no compensation for any license under this agreement shall be payable.
## 8 Final Provisions
8.1 Laws. This Agreement is governed by the laws of the Federal Republic of Germany.
8.2 Venue. Place of jurisdiction shall, to the extent legally permissible, be Berlin, Germany.
8.3 Severability. If any provision in this agreement is unlawful, invalid or ineffective, it shall not affect the enforceability or effectiveness of the remainder of this agreement. The parties agree to replace any unlawful, invalid or ineffective provision with a provision that comes as close as possible to the commercial intent and purpose of the original provision. This section also applies accordingly to any gaps in the contract.
8.4 Variations. Any variations, amendments or supplements to this Agreement must be in writing. This also applies to any variation of this Section 8.4.
- [React Flow](https://reactflow.dev/) for the Control Center
- Auth0
- Nginx
- Docker
- Let's Encrypt
## How to run
Disclaimer. We believe that proper user management system is not a trivial task and requires quite some effort to make it right. Therefore we decided to
use Auth0 service that covers all our needs (user management, social login, JTW for the management API).
use Auth0 service that covers all our needs (user management, social login, JWT for the management API).
Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
3. Running Wiretrustee UI Dashboard requires the following Auth0 environmental variables to be set (see docker command below):
3. Running NetBird UI Dashboard requires the following Auth0 environmental variables to be set (see docker command below):
`AUTH0_DOMAIN``AUTH0_CLIENT_ID``AUTH0_AUDIENCE`
To obtain these, please use [Auth0 React SDK Guide](https://auth0.com/docs/quickstart/spa/react/01-login#configure-auth0) up until "Configure Allowed Web Origins"
To obtain these, please use [Auth0 React SDK Guide](https://auth0.com/docs/quickstart/spa/react) up until "Configure Allowed Web Origins"
4.Wiretrustee UI Dashboard uses Wiretrustee Management Service HTTP API, so setting `NETBIRD_MGMT_API_ENDPOINT` is required. Most likely it will be `http://localhost:33071` if you are hosting Management API on the same server.
4.NetBird UI Dashboard uses NetBird's Management Service HTTP API, so setting `NETBIRD_MGMT_API_ENDPOINT` is required. Most likely it will be `http://localhost:33071` if you are hosting Management API on the same server.
5. Run docker container without SSL (Let's Encrypt):
```shell
docker run -d --name wiretrustee-dashboard \
docker run -d --name netbird-dashboard \
--rm -p 80:80 -p 443:443 \
-e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \
-e AUTH0_CLIENT_ID=<SET YOUR CLIENT ID> \
-e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \
-e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMETN API URL> \
wiretrustee/dashboard:main
-e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \
netbirdio/dashboard:main
```
6. Run docker container with SSL (Let's Encrypt):
```shell
docker run -d --name wiretrustee-dashboard \
docker run -d --name netbird-dashboard \
--rm -p 80:80 -p 443:443 \
-e NGINX_SSL_PORT=443 \
-e LETSENCRYPT_DOMAIN=<YOUR PUBLIC DOMAIN> \
@@ -67,12 +71,27 @@ Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
-e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \
-e AUTH0_CLIENT_ID=<SET YOUR CLEITN ID> \
-e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \
-e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMETN API URL> \
wiretrustee/dashboard:main
-e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \
netbirdio/dashboard:main
```
## How to run local development
1. Install node 16
2. create and update the `src/.local-config.json` file. This file should contain values to be replaced from `src/config.json`
3. run `npm install`
4. run `npm run start dev`
1. Install [Node](https://nodejs.org/)
2. Create and update the `.local-config.json` file. This file should contain values to be replaced from `config.json`
3. Run `npm install` to install dependencies
4. Run `npm run dev` to start the development server
Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
You can start editing by modifying the code inside `src/..`
The page auto-updates as you edit the file.
## How to migrate from old dashboard (v1)
The new dashboard comes with a new docker image `netbirdio/dashboard:main`.
To migrate from the old dashboard (v1) `wiretrustee/dashboard:main` to the new one, please follow the steps below.
1. Stop the dashboard container `docker compose down dashboard`
2. Replace the docker image name in your `docker-compose.yml` with `netbirdio/dashboard:main`
3. Recreate the dashboard container `docker compose up -d --force-recreate dashboard`
Loaded 20 of 2039 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
riccardom
Maycon Santos
Nicolas Frati
Daneyon Hansen
Brandon Hopkins
Eduard Gert
Shaban Mohammedsaani Hassan
Viktor Liu
Jack Carter
Brad Ison
Bethuel Mmbaga
Zoltan Papp
Pascal Fischer
Max Bruch
Max
raghvendra
shuuri-labs
Aaron Dewes
dependabot[bot]
Ali AmerandEduard Gert
Yanis64andEduard Gert
hakansa
Vladislav Tropnikov
Edouard VanbelleandEduard Gert
Jon "The Nice Guy" Spriggs
Tom Hubrecht
juliaroesschen
amplitudes
Fabio Fantoni
Sarooj bukhariandbraginini