netbird

docker-compose.yml:

services:
  #UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    container_name: NetBird-Dashboard
    restart: unless-stopped
    #ports:
    #  - 80:80
    #  - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:443
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:443
      # OIDC
      - AUTH_AUDIENCE=redacted
      - AUTH_CLIENT_ID=redacted
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://authelia.example.com
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=
    networks:
      - proxynet
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Signal
  signal:
    image: netbirdio/signal:latest
    container_name: NetBird-Signal
    restart: unless-stopped
    volumes:
      - /mnt/user/appdata/netbird/signal:/var/lib/netbird
    #ports:
    #  - 443:80
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    networks:
      - proxynet
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Management
  management:
    image: netbirdio/management:latest
    container_name: NetBird-Management
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - /mnt/user/appdata/netbird/mgmt:/var/lib/netbird
      - /mnt/user/appdata/netbird/management.json:/etc/netbird/management.json
    #ports:
    #  - 443:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.example.com",
      "--dns-domain=netbird.selfhosted"
      ]
    networks:
      - proxynet
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Coturn
  coturn:
    image: coturn/coturn:latest
    container_name: NetBird-Coturn
    restart: unless-stopped
    domainname: netbird.example.com
    volumes:
      - /mnt/user/appdata/netbird/turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

networks:
  proxynet:
    external: true


configuration.yml (Authelia)

##
## Identity Providers
##
identity_providers:

  ##
  ## OpenID Connect (Identity Provider)
  ##
  ## It's recommended you read the documentation before configuration of this section:
  ## https://www.authelia.com/c/oidc
  oidc:
    ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
    ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
    hmac_secret: 'redacted'

    ## The JWK's issuer option configures multiple JSON Web Keys. It's required that at least one of the JWK's
    ## configured has the RS256 algorithm. For RSA keys (RS or PS) the minimum is a 2048 bit key.
    jwks:
      ## Key ID embedded into the JWT header for key matching. Must be an alphanumeric string with 7 or less characters.
      ## This value is automatically generated if not provided. It's recommended to not configure this.
      - key_id: 'authelia-key'

      ## The key algorithm used with this key.
        algorithm: 'RS256'

      ## The key use expected with this key. Currently only 'sig' is supported.
        use: 'sig'

      ## Required Private Key in PEM DER form.
        key: |
          -----BEGIN RSA PRIVATE KEY-----
          redacted
          -----END RSA PRIVATE KEY-----

      ## Optional matching certificate chain in PEM DER form that matches the key. All certificates within the chain
      ## must be valid and current, and from top to bottom each certificate must be signed by the subsequent one.
      # certificate_chain: |
        # -----BEGIN CERTIFICATE-----
        # ...
        # -----END CERTIFICATE-----
        # -----BEGIN CERTIFICATE-----
        # ...
        # -----END CERTIFICATE-----

    ## Enables additional debug messages.
    enable_client_debug_messages: false

    ## SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged.
    minimum_parameter_entropy: 8

    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
    ## for security reasons.
    enforce_pkce: 'public_clients_only'

    ## SECURITY NOTICE: It's not recommended changing this option. We encourage you to read the documentation and fully
    ## understanding it before enabling this option.
    enable_jwt_access_token_stateless_introspection: false

    ## The signing algorithm used for signing the discovery and metadata responses. An issuer JWK with a matching
    ## algorithm must be available when configured. Most clients completely ignore this and it has a performance cost.
    discovery_signed_response_alg: 'none'

    ## The signing key id used for signing the discovery and metadata responses. An issuer JWK with a matching key id
    ## must be available when configured. Most clients completely ignore this and it has a performance cost.
    discovery_signed_response_key_id: ''

    ## Authorization Policies which can be utilized by clients. The 'policy_name' is an arbitrary value that you pick
    ## which is utilized as the value for the 'authorization_policy' on the client.
    authorization_policies:
      policy_name:
        default_policy: 'two_factor'
        rules:
          - policy: 'one_factor'
            subject: 'group:services'

    ## The lifespans configure the expiration for these token types in the duration common syntax. In addition to this
    ## syntax the lifespans can be customized per-client.
    lifespans:
      ## Configures the default/fallback lifespan for given token types. This behaviour applies to all clients and all
      ## grant types but you can override this behaviour using the custom lifespans.
      access_token: '1 hour'
      authorize_code: '1 minute'
      id_token: '1 hour'
      refresh_token: '90 minutes'

    ## Cross-Origin Resource Sharing (CORS) settings.
    cors:
      ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
      endpoints:
         - 'authorization'
         - 'pushed-authorization-request'
         - 'token'
         - 'revocation'
         - 'introspection'
         - 'userinfo'

      ## List of allowed origins.
      ## Any origin with https is permitted unless this option is configured or the
      ## allowed_origins_from_client_redirect_uris option is enabled.
      allowed_origins:
        - 'https://photos.example.com'
        - 'https://netbird.example.com'

      ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
      ## provided they have the scheme http or https and do not have the hostname of localhost.
      allowed_origins_from_client_redirect_uris: true

    ## Clients is a list of known clients and their configuration.
    clients:
        ## The Client ID is the OAuth 2.0 and OpenID Connect 1.0 Client ID which is used to link an application to a
        ## configuration.
      ## Immich Client
      - client_id: 'redacted'

        ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
        client_name: 'immich'

        ## The client secret is a shared secret between Authelia and the consumer of this client.
        # yamllint disable-line rule:line-length
        client_secret: 'redacted'  # The digest of 'insecure_secret'.

        ## Sector Identifiers are occasionally used to generate pairwise subject identifiers. In most cases this is not
        ## necessary. It is critical to read the documentation for more information.
        # sector_identifier_uri: 'https://example.com/sector.json'

        ## Sets the client to public. This should typically not be set, please see the documentation for usage.
        public: false

        ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
        redirect_uris:
          - 'https://photos.example.com/auth/login'
          - 'https://photos.example.com/user-settings'
          - 'app.immich:/'

        ## Request URI's specifies a list of valid case-sensitive TLS-secured URIs for this client for use as
        ## URIs to fetch Request Objects.
        # request_uris:
          # - 'https://oidc.example.com:8080/oidc/request-object.jwk'

        ## Audience this client is allowed to request.
        # audience: []

        ## Scopes this client is allowed to request.
        scopes:
          - 'openid'
          # - 'groups'
          - 'email'
          - 'profile'
          - 'offline_access'

        ## Grant Types configures which grants this client can obtain.
        ## It's not recommended to define this unless you know what you're doing.
        grant_types:
          - 'refresh_token'
          - 'authorization_code'

        ## Response Types configures which responses this client can be sent.
        ## It's not recommended to define this unless you know what you're doing.
        response_types:
          - 'code'

        ## Response Modes configures which response modes this client supports.
        response_modes:
          - 'form_post'
          - 'query'
          - 'fragment'

        ## The policy to require for this client; one_factor or two_factor. Can also be the key names for the
        ## authorization policies section.
        authorization_policy: 'two_factor'

        ## The custom lifespan name to use for this client. This must be configured independent of the client before
        ## utilization. Custom lifespans are reusable similar to authorization policies.
        # lifespan: ''

        ## The consent mode controls how consent is obtained.
        # consent_mode: 'auto'

        ## This value controls the duration a consent on this client remains remembered when the consent mode is
        ## configured as 'auto' or 'pre-configured' in the duration common syntax.
        # pre_configured_consent_duration: '1 week'

        ## Requires the use of Pushed Authorization Requests for this client when set to true.
        require_pushed_authorization_requests: false

        ## Enforces the use of PKCE for this client when set to true.
        # require_pkce: false

        ## Enforces the use of PKCE for this client when configured, and enforces the specified challenge method.
        ## Options are 'plain' and 'S256'.
        # pkce_challenge_method: 'S256'

        ## The permitted client authentication method for the Token Endpoint for this client.
        ## For confidential client types this value defaults to 'client_secret_basic' and for the public client types it
        ## defaults to 'none' per the specifications.
        # token_endpoint_auth_method: 'client_secret_basic'

        ## The permitted client authentication signing algorithm for the Token Endpoint for this client when using
        ## the 'client_secret_jwt' or 'private_key_jwt' token_endpoint_auth_method.
        # token_endpoint_auth_signing_alg: 'RS256'

        ## The signing algorithm which must be used for request objects. A client JWK with a matching algorithm must be
        ## available if configured.
        # request_object_signing_alg: 'RS256'

        ## The signing algorithm used for signing the authorization response. An issuer JWK with a matching algorithm
        ## must be available when configured. Configuring this value enables the  JWT Secured Authorization Response
        ## Mode (JARM) for this client. JARM is not understood by a majority of clients so you should only configure
        ## this when you know it's supported.
        ## Has no effect if authorization_signed_response_key_id is configured.
        # authorization_signed_response_alg: 'none'

        ## The signing key id used for signing the authorization response. An issuer JWK with a matching key id must be
        ## available when configured. Configuring this value enables the JWT Secured Authorization Response Mode (JARM)
        ## for this client. JARM is not understood by a majority of clients so you should only configure this when you
        ## know it's supported.
        # authorization_signed_response_key_id: ''

        ## The signing algorithm used for ID Tokens. An issuer JWK with a matching algorithm must be available when
        ## configured. Has no effect if id_token_signed_response_key_id is configured.
        # id_token_signed_response_alg: 'RS256'

        ## The signing key id used for ID Tokens. An issuer JWK with a matching key id must be available when
        ## configured.
        # id_token_signed_response_key_id: ''

        ## The signing algorithm used for Access Tokens. An issuer JWK with a matching algorithm must be available.
        ## Has no effect if access_token_signed_response_key_id is configured. Values other than 'none' enable RFC9068
        ## for this client.
        # access_token_signed_response_alg: 'none'

        ## The signing key id used for Access Tokens. An issuer JWK with a matching key id must be available when
        ## configured. Values other than a blank value enable RFC9068 for this client.
        # access_token_signed_response_key_id: ''

        ## The signing algorithm used for User Info responses. An issuer JWK with a matching algorithm must be
        ## available. Has no effect if userinfo_signing_key_id is configured.
        userinfo_signed_response_alg: 'none'

        ## The signing key id used for User Info responses. An issuer JWK with a matching key id must be available when
        ## configured.
        # userinfo_signed_response_key_id: ''

        ## The signing algorithm used for Introspection responses. An issuer JWK with a matching algorithm must be
        ## available when configured. Has no effect if introspection_signed_response_key_id is configured.
        # introspection_signed_response_alg: 'none'

        ## The signing key id used for Introspection responses. An issuer JWK with a matching key id must be available
        ## when configured.
        # introspection_signed_response_key_id: ''

        ## Trusted public keys configuration for request object signing for things such as 'private_key_jwt'.
        ## URL of the HTTPS endpoint which serves the keys. Please note the 'jwks_uri' and the 'jwks' option below
        ## are mutually exclusive.
        # jwks_uri: 'https://app.example.com/jwks.json'

        ## Trusted public keys configuration for request object signing for things such as 'private_key_jwt'.
        ## List of JWKs known and registered with this client. It's recommended to use the 'jwks_uri' option if
        ## available due to key rotation. Please note the 'jwks' and the 'jwks_uri' option above are mutually exclusive.
        # jwks:
          # -
            ## Key ID used to match the JWT's to an individual identifier. This option is required if configured.
            # key_id: 'example'

            ## The key algorithm expected with this key.
            # algorithm: 'RS256'

            ## The key use expected with this key. Currently only 'sig' is supported.
            # use: 'sig'

            ## Required Public Key in PEM DER form.
            # key: |
              # -----BEGIN RSA PUBLIC KEY-----
              # ...
              # -----END RSA PUBLIC KEY-----

            ## The matching certificate chain in PEM DER form that matches the key if available.
            # certificate_chain: |
              # -----BEGIN CERTIFICATE-----
              # ...
              # -----END CERTIFICATE-----
              # -----BEGIN CERTIFICATE-----
              # ...
              # -----END CERTIFICATE-----

      ## Netbird Client
      - client_id: 'redacted'
        client_name: 'Netbird'
        client_secret:
        public: true
        redirect_uris:
          - 'https://netbird.example.com'
          - 'https://netbird.example.com/auth/callback'
          - 'https://netbird.example.com/a/oauth_response'
          - 'http://localhost:53000/auth/callback'
          - 'https://netbird.example.com/callback'
          - 'https://authelia.example.com/*'
          - 'https://authelia.example.com/oauth2/callback'
          - 'https://netbird.example.com/oauth2/callback'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
          - 'offline_access'
          - 'api'

        ## Grant Types configures which grants this client can obtain.
        ## It's not recommended to define this unless you know what you're doing.
        grant_types:
          - 'authorization_code'
          - 'refresh_token'

        ## Response Types configures which responses this client can be sent.
        ## It's not recommended to define this unless you know what you're doing.
        response_types:
          - 'code'

        ## Response Modes configures which response modes this client supports.
        response_modes:
          - 'form_post'
          - 'query'
          - 'fragment'

        ## The policy to require for this client; one_factor or two_factor. Can also be the key names for the
        ## authorization policies section.
        authorization_policy: 'two_factor'  # Adjust based on your security requirements


...


netbird.subdomain.conf (SWAG)

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name netbird.example.com;

    include /config/nginx/ssl.conf;

    client_max_body_size 128M;
    client_header_timeout 1d;
    client_body_timeout 1d;

    location / {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app NetBird-Dashboard;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }

    location /api {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app NetBird-Management;
        set $upstream_port 443;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;
    }

    location /signalexchange.SignalExchange/ {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        grpc_read_timeout 1d;
        grpc_send_timeout 1d;
        grpc_socket_keepalive on;

        set $upstream_app NetBird-Signal;
        set $upstream_port 80;
        set $upstream_proto grpc;
        grpc_pass $upstream_proto://$upstream_app:$upstream_port;
    }

    location /management.ManagementService/ {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;

        grpc_read_timeout 1d;
        grpc_send_timeout 1d;
        grpc_socket_keepalive on;

        set $upstream_app NetBird-Management;
        set $upstream_port 443;
        set $upstream_proto grpc;
        grpc_pass $upstream_proto://$upstream_app:$upstream_port;
    }
}