NetBird - FOSS noconf Mesh VPN using Wireguard, alternative to ZeroTier, Tailscale, OmniEdge, Netmaker etc

[marcusquinn]

1st draft packaging this, if anyone that know's more wants to test:

• https://github.com/marcusquinn/cloudron-netbird-app

[marcusquinn]

Update on the Cloudron NetBird package
The packaging scaffold at https://github.com/marcusquinn/cloudron-netbird-app is fairly complete -- it uses the combined netbird-server binary behind an internal nginx that consolidates all the path-based routing (gRPC, WebSocket, REST API, dashboard) onto a single HTTP port for Cloudron's reverse proxy.
What works (in theory -- needs real-world testing):

• Management API, Signal, Relay, STUN, and Dashboard all in one container
• Cloudron SSO via the OIDC addon
• Cloudron's built-in TURN server for NAT traversal relay
• PostgreSQL via Cloudron addon
• Backup/restore of all persistent state
  The one feature that can't work on Cloudron: NetBird's Reverse Proxy (v0.65+)
  This is NetBird's newer feature that exposes internal services on mesh peers to the public internet with automatic TLS. It requires Traefik with TLS passthrough -- the NetBird proxy container needs to terminate TLS itself. Cloudron's nginx terminates TLS before traffic reaches the app, so there's no way to pass through the raw TLS connection that NetBird's proxy needs.
  I looked at whether alpine/socat (TCP socket forwarder) could bridge this gap, but it can't -- the problem is Layer 7 (HTTP path routing, gRPC protocol handling, TLS termination order), not Layer 4 (TCP forwarding). socat only does port-to-port TCP forwarding and has no understanding of HTTP paths, gRPC, or WebSocket upgrade headers.
  This doesn't affect the core VPN functionality at all -- peer-to-peer WireGuard tunnels, NAT traversal, access control, DNS, network routes, and the management dashboard all work fine without it. The reverse proxy is an optional add-on for publicly exposing internal services.

What's needed next:

1. Testing on a real Cloudron instance (I haven't done this yet -- the packaging is based on docs and the combined container architecture)
2. Verifying the internal nginx correctly handles the gRPC h2c proxying that Signal and Management need
3. End-to-end OIDC flow testing with Cloudron SSO
4. TURN relay testing for peers behind strict NAT
   If anyone wants to help test, the repo has a full testing checklist in the README. Would be great to get this into the Cloudron App Store.

feedback welcome!

[timconsidine]

Great work @marcusquinn

Will try to test it out, been wanting NetBird, currently running it on a separate VPS

I ran into similar issues about routing of traffic when I was packaging Agate+. But I don’t recall the solution (and may not be a solution) - will try to check it out.

[marcusquinn]

Related: https://forum.cloudron.io/topic/15109/tls-passthrough-option-for-apps-requiring-end-to-end-tls

[timconsidine]

Testing on a real Cloudron instance (I haven't done this yet -- the packaging is based on docs and the combined container architecture)

I don't know how this is possible - I always need to do multiple builds to get a working package.

I started building from @marcusquinn repo.
I needed to make some changes. Currently app builds and installs but have hit a circular dependency ("Catch-22") regarding authentication.

The Goal: Configure NetBird to use Cloudron's OIDC service as its Identity Provider.

The Problem:

1. Configuration requires Login: To add Cloudron OIDC as an IdP, I need to log in to the NetBird dashboard (or use the API, which requires a token).
2. Initial Login requires Embedded Dex: Since Cloudron OIDC isn't configured yet, I must use the embedded Dex IdP for the first login.
3. Embedded Dex Fails: The embedded IdP is configured strictly according to the "combined server" docs (v0.36+). The dashboard loads, redirects to the embedded auth flow, but fails at the final step:
   • POST /oauth2/token returns 401 Unauthorized .
   • Browser console shows: storage[oidc.login.default] is empty and Token request failed .
   • Logs show no specific server-side error, just the 401.

The Catch-22: I cannot log in (via embedded Dex) to configure the external IdP (Cloudron OIDC). I cannot configure the external IdP via files/env vars to bypass the broken embedded login.

I will try a hack to get past this.

[timconsidine]

Starting again, fresh start.
Will update.

[timconsidine]

Parking this for now - can't get past auth errors, even stripping out any OIDC and just using the embedded Dex user management.
Will resume at some point because Netbird is very cool, works well for me via separately-hosted docker compose, and would be good to have on Cloudron.
But other priorities push Netbird down the list.

[marcusquinn]

@timconsidine thanks for testing. Refactored so OICD is an optional extra, plus other changes to the whole approach. README should explain.

[timconsidine]

@marcusquinn I tried similar approach - simplify to just Netbird and embedded Dex. But that wasn't enough.
Will try again shortly with fresh brain.

[marcusquinn]

Added as a community app here:

• https://ca.cloudron.io/app/netbird

[sponch]

very cool. Just installed but do not get to the initial admin dashboard to make the admin account (neither with the installed URL Netbird.xyz.com nor with Netbird.xyz.coom/peers.
instead I get an error (There was an error logging you in.
Error: Unauthenticated).

[sponch]

@marcusquinn just saw that the stun port is already reserved an so not being used by netbird. Changing the port number doesn't help as the app doesn't keep it and deactivates it again after restarting the container.

(is there a way to find out which app uses that port in Cloudron? couldn't find it)

[marcusquinn]

@sponch Can you post issues to the github repo and any relevant info, please? My systems will pick them up, review, and patch. Sorry, I can maintain it, but rely on other user feedback in case there's things my setup solved but don't work yet for others.

If I can recommend a look, too, at my main ai harness invention: https://aidevops.sh, because it's really good at diagnosing issues and logging them to the git repo for then solving.

[timconsidine]

@marcusquinn I logged an issue - can't get it installed - might be a simple fix (detailed in issue).

[marcusquinn]

@timconsidine sorry, forgot to star my own repo to get notifications — looking now — should be a quick fix & release with you soon...

[marcusquinn]

@timconsidine latest release should work. Let me know if now. I'll get notifications for any new issues now.

[timconsidine]

@marcusquinn thank you for checking and resolving

[sponch]

@marcusquinn still not working here.
No possibility to create an account via Dashboard on initial start. Also had to change stun port because default is already in use here.

[marcusquinn]

@sponch Can you try again from the latest release, please?

[timconsidine]

I got the same as @sponch did earlier.
Getting the same after the latest version.

Also FYI UDP port 3478 cannot be used (reserved).
Ticking the STUN NAT Traversal box and setting and saving 3479 superficially works, but on going back to 'Location' in app portal, 3479 has not been saved, it's reverted to 3478 and the tick box to enable custom port has been unticked.

I don't think the app CloudronManifest.json is using the cloudron turn addon, which might (not sure) allow port 3478 to be used.