New /help/recording-a-har-file how-to under Troubleshooting > Report a
bug, covering HAR capture in Chrome, Edge, Firefox, and Safari with the
"preserve log" gotcha and a security warning about tokens in HAR files.
Nest Community/NetBird Support under the Report a bug "Overview" item so
the new page reads as a sibling of the reporting cluster rather than a
fourth flat peer. Cross-link the HAR page from the two support pages and
the Report bugs overview, next to the existing debug-bundle mention.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* docs: lazy connections are no longer experimental
Lazy connections have graduated from experimental status. Remove the
"experimental" framing from the feature guide, the zero-trust use case,
and the CLI flag reference.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* remove outdated routing peer limitation
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document the community.ansible_netbird collection for managing NetBird
resources (users, groups, setup keys, policies, networks, DNS, posture
checks) declaratively via the REST API. Adds a new Infrastructure as
Code subsection under Self-Host NetBird with room for future entries.
Cross-links from the Automated Setup PAT bootstrap page since the
collection is the natural next step after obtaining the first token.
Enable Next `output: 'standalone'` and rewrite the Dockerfile to package only the traced standalone server + .next/static + public on node:20-slim (glibc, matching the runner), running `node server.js`. No in-image npm ci, no full source or dependency tree. Cuts the image ~52%, so docker push and the server pull get much faster.
Also fixes a latent entrypoint bug (${VAR:"none"} -> ${VAR:-"none"}) that busybox sh tolerated but Debian dash (node:20-slim /bin/sh) rejects, which would otherwise crash the container on boot.
Smoke-tested via isolated build + docker run: boots in 37ms, all routes 200, redirects still bundled (/slack-url -> 307), static + public assets served, DocSearch env-injection intact.
Move `npm run build` out of the Docker image onto the runner, where actions/cache persists .next/cache across runs (the in-Docker build discarded it every time). The image now just packages the prebuilt .next and serves it with `next start`; runtime and the DocSearch entrypoint injection are unchanged.
Also: checkout full history (fetch-depth: 0) so per-page dates are correct, guard buildGitDateMap against shallow clones (correct-or-absent, never wrong), modernise the Docker actions (build-push-action v6, provenance: false), and add a path-filtered pull_request trigger so pipeline changes are validated before merge.
Smoke-tested via isolated build + docker run: serves /, /introduction, /api, sitemap, static assets (200); DocSearch placeholder injection intact.
Switch pr-build and the Docker image from `npm install` to `npm ci` (`npm ci --omit=dev` in the image), and enable setup-node's npm cache. Deterministic installs from the committed lockfile; CI now fails fast on an out-of-sync lockfile.
Depends on the lockfile being tracked (PR #838) — npm ci requires a committed package-lock.json.
Stop gitignoring the lockfile and commit a freshly regenerated one so CI and Docker builds install a pinned dependency tree instead of re-resolving `^` ranges on every run. Fresh resolution matches the versions already building (no version changes). Document the convention in CLAUDE.md. Enables `npm ci` as a follow-up.
Replace ~314 `git log` spawns per gen script with a single `git log --name-only` pass, memoised per process. Cuts gen:last-updated + gen:sitemap from ~15s to ~1.5s.
Output is byte-identical to the per-file version; still degrades to no-dates when git is unavailable (e.g. the Docker image).
* docs: add routing peer sizing guide
Add a Sizing Routing Peers page under Networks covering the four-step
sizing method, a per-peer capacity table, the tuning levers that matter,
and how to scale out by sharding load across identical Networks.
Cross-link it from How Routing Peers Work (HA note + related tile) and
the Networks overview, and add it to the docs navigation.
* docs: refine wording in routing peer sizing guide
Generalize the Acme example to remote users, correct the encrypt/decrypt
framing and reach the local network rather than the datacenter, use
'routing peer' instead of 'gateway', and rename the recap to Summary.
* docs: tighten and correct HA behavior in routing peer sizing guide
Correct the high-availability description: a single Network does not
balance load across its peers — different metrics give failover (one
peer carries all), equal metrics give latency-based nearest-peer
selection, which splits traffic by geography but never evenly. Shard
into more Networks to split load deterministically.
Also collapse redundant restatements, drop the secondary worked
example (the capacity table covers it), and slim the commodity-hardware
guidance.
* docs: add 1- and 2-vCPU rows to the routing peer capacity table
Extend the capacity table down to 1 and 2 vCPUs, drop the 'or more' from
the interface column, and adjust the methodology note so the interface
column reads uniformly as the minimum NIC to pair with each size.
* docs: add userspace WireGuard table and when-to-use cases
Add a userspace-mode capacity table showing wireguard-go does not scale
across cores (download plateaus ~6.8 Gbps, only ~4-5 cores used), and
the cases where a routing peer runs userspace: missing/broken/conflicting
kernel module, no TUN device (netstack, incl. rootless Docker), non-Linux
peers, and forcing userspace to capture policy IDs and blocked traffic
events. Name the exact benchmark CPU (Xeon Platinum 8375C).
* docs: replace 'sharding' with plain wording in sizing guide
Rename the Scaling out heading and reword the body, description, and
recap to talk about splitting load across more Networks instead of
sharding. Update the in-page anchor link to match the new heading.
* docs: clarify download/upload direction bullets in sizing guide
Lead each direction bullet with Download:/Upload: and say the routing
peer encrypts/decrypts, tying the pulling/pushing distinction to the
capacity table's column names.
* docs: replace 'shard' with plain wording in HA note
* docs: add jumbo frames section to routing peer sizing guide
* docs: align jumbo upload figure with capacity table, mark 16-vCPU line-rate as projection
* docs: use consistent numerals for MTU byte sizes
Adds the how-to under the reorganized /use-cases/remote-access group
(stacked on the Use Cases reorg). Walks through the decision ladder for
two sites sharing one internal IP, ending with the per-site TCP proxy
pattern on each routing peer.
* docs: consolidate scenario guides under /use-cases with redirects
Move 11 pages: feature-nested use cases from manage/networks,
manage/network-routes, manage/reverse-proxy, and the Kubernetes
integration into /use-cases/remote-access, /use-cases/cloud, and
/use-cases/security; the site-to-site decision page becomes
/use-cases/remote-access; the MikroTik guide becomes an install
guide at /get-started/install/mikrotik.
Add one redirect per moved page and flatten existing redirect
chains so every legacy URL resolves in a single hop. The
deprecated Routes site-to-site recipe stays put.
* docs: rebuild sidebar navigation for use-cases reorg
Remove the four nested Use Cases sublists from Manage NetBird;
keep the deprecated Routes recipe as a direct 'Site-to-Site
(legacy)' link. Rebuild USE CASES with Remote Access, Cloud &
Kubernetes, Security groups and a flat Homelab link. Add MikroTik
to Get Started > Platforms.
* docs: rebuild use-case index pages and refresh feature landing links
Turn /use-cases into an "I want to..." scenario finder. Retitle
the site-to-site decision page to Remote Access and point its
links at the new sibling URLs. Add the Kubernetes service and
private-proxy guides to the cloud and security indexes, refresh
the homelab landing links, and update the Networks, Routes,
Reverse Proxy, and Kubernetes landing pages to the new use-case
URLs.
* docs: update internal links to new use-case URLs
Point cross-links across the docs at the consolidated
/use-cases URLs. Links to the deprecated Routes site-to-site
recipe and all image paths under public/docs-static are left
unchanged.
* docs: shorten sidebar label to Site-to-Site
* docs: move Kubernetes into its own Use Cases section
Pull the entire Kubernetes integration out of Manage > Integrations
into a dedicated Kubernetes group under Use Cases at /use-cases/
kubernetes, and move the two Kubernetes cloud guides there too.
Rename the Cloud group (was 'Cloud & Kubernetes'); Integrations
keeps the MDM deployment pages. Add redirects for every moved page
and flatten existing chains.
* docs: drop 'NetBird on' prefix from cloud sidebar labels
* docs: alphabetize Remote Access use cases in sidebar
* ❯ add mikrotik to install index
* docs: fix duplicated word in remote-access link label on TV install pages
---------
Co-authored-by: Brandon Hopkins <brandon@techhut.tv>
* docs: recommend Linux routing peers for file-share workloads
Add performance guidance to the Active Directory use case (Step 1
placement choice) and a performance trade-off note to Reach Services
on the Routing Peer: Windows/macOS peers process the data path in
userspace, and self-access delivery is slowest for reads, so a
dedicated Linux routing peer is the fast default for SMB/DFS.
* docs: platform-split the self-access performance note
Linux kernel-mode service hosts deliver to their own LAN IP at full
speed; the read-direction penalty is specific to Windows/macOS
userspace hosts.
* docs: scope the AD self-access caveat to Windows file servers
* docs: drop read-direction specifics from performance notes
The directional asymmetry is a suspected client defect under
engineering escalation, not durable documented behavior. Keep only
the kernel-vs-userspace guidance.
* docs: address review — dedupe performance guidance, fix note placement
- AD page: performance point stated once (Step 1 note, linking
how-routing-peers-work for the mechanism); bullets and recap trimmed;
Step 1 bullet now carries the Windows qualifier
- reach-services: note compressed to consequence + links, moved below
The scenario where LAN IP and the shape are defined
* Add OpenWRT install steps
* Add images
* Fixes and caveats
* minor fixes
* docs: call it "the NetBird client", not "the NetBird client (agent)"
---------
Co-authored-by: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com>
Document running a BYOP proxy in private mode with no public inbound
ports by disabling proxy ACME, issuing the wildcard TLS certificate
externally over DNS-01, and serving it as a static certificate that the
proxy hot-reloads on renewal.
Adds the page under reverse-proxy/use-cases with a new Use Cases nav
group, plus cross-links from the Bring Your Own Proxy page (port-443
prerequisite + TLS table) and the Reverse Proxy overview (static cert
mode).
* docs: add 'Choosing a pattern' overview to K8s getting started
Add a decision table and rules of thumb covering routing peer vs client
sidecar vs API server proxy vs Gateway API, so readers can pick the right
operator pattern. Clarifies that a sidecar (not a routing peer) is the
answer when a pod needs its own identity or to originate traffic onto the
overlay.
* docs: name the NetworkRouter CRD and clarify its DNS zone in the pattern table
Viktor Liu
Bruno Mercier CostaandClaude Opus 4.8
netbirddev
Maycon Santos
Eduard GertandClaude Opus 4.8
Jack Carter
Brandon Hopkins
Kent Ross
Misha Bragin
PizzaLovingNerd