Eduard GertandClaude Opus 5
84c491a722
The page at /peer/assistant-access read its peer, WireGuard key and rules from the URL and, once the forced sign-in came back, granted temporary SSH access without asking anything further. The sign-in proves a person is present; it does not prove they meant to grant that key access to that machine. A link mailed to an admin was therefore enough: click, sign in to a prompt you recognise, and a key you have never seen lands on the network. Two checks close it, both before the sign-in so a link never gets to borrow an identity provider's credibility: The opener now mints a nonce into sessionStorage before calling window.open, and the page refuses to grant anything without it. A window opened from the panel inherits a copy of that storage; a window reached by following a link does not. It is spent before the POST, so a reload or a Back inside the window cannot grant twice, and dropped on every path that settles the request. The rules are checked against the set this flow may ask for rather than passed through as given — tcp/3389 would be RDP, not SSH. A test drives the executor across its version thresholds and asserts every rule it produces is one the page accepts, since the two halves live in different files and drift either way is silent. Also drops the "eve" codename from assistant comments and test names, and removes an eslint ignore for an assistant/ directory and CI workflow that no longer exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
NetBird Dashboard
This project is the UI for NetBird's Management service.
Hosted version: https://app.netbird.io/
See NetBird repo
Why?
The purpose of this project is simple - make it easy to manage VPN built with NetBird. The dashboard makes it possible to:
- track the status of your peers
- remove peers
- manage Setup Keys (to authenticate new peers)
- list users
- define access controls
Some Screenshots
Technologies Used
- NextJS
- ReactJS
- Tailwind CSS
- React Flow for the Control Center
- Auth0
- Nginx
- Docker
- Let's Encrypt
How to run
Disclaimer. We believe that proper user management system is not a trivial task and requires quite some effort to make it right. Therefore we decided to use Auth0 service that covers all our needs (user management, social login, JWT for the management API). Auth0 so far is the only 3rd party dependency that can't be really self-hosted.
-
Install Docker
-
Register Auth0 account
-
Running NetBird UI Dashboard requires the following Auth0 environmental variables to be set (see docker command below):
AUTH0_DOMAINAUTH0_CLIENT_IDAUTH0_AUDIENCETo obtain these, please use Auth0 React SDK Guide up until "Configure Allowed Web Origins"
-
NetBird UI Dashboard uses NetBird's Management Service HTTP API, so setting
NETBIRD_MGMT_API_ENDPOINTis required. Most likely it will behttp://localhost:33071if you are hosting Management API on the same server. -
Run docker container without SSL (Let's Encrypt):
docker run -d --name netbird-dashboard \ --rm -p 80:80 -p 443:443 \ -e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \ -e AUTH0_CLIENT_ID=<SET YOUR CLIENT ID> \ -e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \ -e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \ netbirdio/dashboard:main -
Run docker container with SSL (Let's Encrypt):
docker run -d --name netbird-dashboard \ --rm -p 80:80 -p 443:443 \ -e NGINX_SSL_PORT=443 \ -e LETSENCRYPT_DOMAIN=<YOUR PUBLIC DOMAIN> \ -e LETSENCRYPT_EMAIL=<YOUR EMAIL> \ -e AUTH0_DOMAIN=<SET YOUR AUTH DOMAIN> \ -e AUTH0_CLIENT_ID=<SET YOUR CLEITN ID> \ -e AUTH0_AUDIENCE=<SET YOUR AUDIENCE> \ -e NETBIRD_MGMT_API_ENDPOINT=<SET YOUR MANAGEMENT API URL> \ netbirdio/dashboard:main
How to run local development
- Install Node
- Create and update the
.local-config.jsonfile. This file should contain values to be replaced fromconfig.json - Run
npm installto install dependencies - Run
npm run devto start the development server
Open http://localhost:3000 with your browser to see the result.
You can start editing by modifying the code inside src/..
The page auto-updates as you edit the file.
How to migrate from old dashboard (v1)
The new dashboard comes with a new docker image netbirdio/dashboard:main.
To migrate from the old dashboard (v1) wiretrustee/dashboard:main to the new one, please follow the steps below.
- Stop the dashboard container
docker compose down dashboard - Replace the docker image name in your
docker-compose.ymlwithnetbirdio/dashboard:main - Recreate the dashboard container
docker compose up -d --force-recreate dashboard