NetBird - FOSS noconf Mesh VPN using Wireguard, alternative to ZeroTier, Tailscale, OmniEdge, Netmaker etc

[marcusquinn]

@timconsidine thanks for testing. Refactored so OICD is an optional extra, plus other changes to the whole approach. README should explain.

[timconsidine]

@marcusquinn I tried similar approach - simplify to just Netbird and embedded Dex. But that wasn't enough.
Will try again shortly with fresh brain.

[marcusquinn]

Added as a community app here:

• https://ca.cloudron.io/app/netbird

[sponch]

very cool. Just installed but do not get to the initial admin dashboard to make the admin account (neither with the installed URL Netbird.xyz.com nor with Netbird.xyz.coom/peers.
instead I get an error (There was an error logging you in.
Error: Unauthenticated).

[sponch]

@marcusquinn just saw that the stun port is already reserved an so not being used by netbird. Changing the port number doesn't help as the app doesn't keep it and deactivates it again after restarting the container.

(is there a way to find out which app uses that port in Cloudron? couldn't find it)

[marcusquinn]

@sponch Can you post issues to the github repo and any relevant info, please? My systems will pick them up, review, and patch. Sorry, I can maintain it, but rely on other user feedback in case there's things my setup solved but don't work yet for others.

If I can recommend a look, too, at my main ai harness invention: https://aidevops.sh, because it's really good at diagnosing issues and logging them to the git repo for then solving.

[timconsidine]

@marcusquinn I logged an issue - can't get it installed - might be a simple fix (detailed in issue).

[marcusquinn]

@timconsidine sorry, forgot to star my own repo to get notifications — looking now — should be a quick fix & release with you soon...

[marcusquinn]

@timconsidine latest release should work. Let me know if now. I'll get notifications for any new issues now.

[timconsidine]

@marcusquinn thank you for checking and resolving

[sponch]

@marcusquinn still not working here.
No possibility to create an account via Dashboard on initial start. Also had to change stun port because default is already in use here.

[marcusquinn]

@sponch Can you try again from the latest release, please?

[timconsidine]

I got the same as @sponch did earlier.
Getting the same after the latest version.

Also FYI UDP port 3478 cannot be used (reserved).
Ticking the STUN NAT Traversal box and setting and saving 3479 superficially works, but on going back to 'Location' in app portal, 3479 has not been saved, it's reverted to 3478 and the tick box to enable custom port has been unticked.

I don't think the app CloudronManifest.json is using the cloudron turn addon, which might (not sure) allow port 3478 to be used.

[sponch]

@marcusquinn hey, its working now thanks! Do you think it's possible to include the proxy cluster in the installation? it's quite a pain to install that afterwards

[timconsidine]

@sponch said it worked so I went back, dug deeper, my browser cache was the culprit
So yes, management app incl login working.
Thank you @marcusquinn

I can't get a peer connected using netbird up -m https://netbird.domain.tld:443 -k <app_generated_secret_key>

[sponch]

@timconsidine should it not be
netbird up --management-url https://netbird.xxx.tld --setup-key xxx

[timconsidine]

@sponch yes,, I am just using the short forms -m and -k

 -m, --management-url string    Management Service URL [http|https]://[host]:[port] (default "https://api.netbird.io:443")
 -k, --setup-key string         Setup key obtained from the Management Service Dashboard (used to register peer)

I don't get a client connecting to the management app with long or short forms. Did you ?

[timconsidine]

Netbird is not an easy app to package - so big kudos to @marcusquinn for doing it.

I continued to struggle with getting a client device to connect to the published Community App package.
So I built my own package and (eventually after many attempts!) got the app UI and client connections working.

The key difference is the client transport model:

• @marcusquinn package sends native NetBird management/signal traffic over the normal Cloudron app URL on standard 443
• it does not expose a dedicated native TCP port
• it also does not use the Cloudron tls addon for a separate native listener
• native gRPC is proxied through nginx behind Cloudron’s standard HTTPS path
• does not use Cloudron’s turn addon STUN/TURN service; it uses NetBird’s own exposed STUN UDP port instead.

My package now takes a different approach :

• web UI/API/OIDC stay on the normal app URL
• native NetBird clients use a dedicated port: https://<domain>:33073
• Cloudron tls is used for that native port
• nginx terminates TLS/HTTP2 on the native port and forwards gRPC internally
• standard 443 is treated as web-only, not as the native client path
• STUN comes from Cloudron’s turn addon rather than NetBird’s own exposed UDP listener

So the packaging difference is basically:
“everything over Cloudron 443 (marcus)” vs “web on 443, native clients on dedicated 33073 (mine)”

My code is at : https://forgejo.tcjc.uk/cca/cloudron-netbird
My CloudronVersions.json for installation is at : https://communityapps.appx.uk/cloudron-netbird/CloudronVersions.json

I am not listing my package on ca.cloudron.io because that right goes to @marcusquinn (and 2 listed packages is just confusing to others).
But it is available at the CloudronVersions link above.

[sponch]

Sounds great. Is the Reverse Proxy working „out of the box“ this way? (By adding custom Domains)

[timconsidine]

@sponch if I understand question, yes, just install as e.g. netbird.domain.tld and client connects as ‘netbird up -m https://netbird.domain.tld:33073 -k <setup key from app ui>