homelab/netbird/compose.yaml

name: netbird

services:
  netbird-server:
    image: netbirdio/netbird-server:0.80.0
    container_name: netbird-server
    restart: unless-stopped
    environment:
      NETBIRD_DOMAIN: "${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
      NETBIRD_PROXY_SUBNET: "${NETBIRD_PROXY_SUBNET:?Set NETBIRD_PROXY_SUBNET in netbird/.env (run setup.sh)}"
    entrypoint:
      - /bin/sh
      - /opt/netbird/entrypoint.sh
    command:
      - --config
      - /run/netbird/config.yaml
    ports:
      - "3478:3478/udp"
    volumes:
      - netbird_data:/var/lib/netbird
      - ./config.template.yaml:/opt/netbird/config.template.yaml:ro
      - ./entrypoint.sh:/opt/netbird/entrypoint.sh:ro
    secrets:
      - relay_auth_secret
      - datastore_encryption_key
    tmpfs:
      - /run/netbird:mode=0700
    healthcheck:
      test:
        - CMD
        - bash
        - -ec
        - exec 3<>/dev/tcp/127.0.0.1/80
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s
    stop_grace_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.netbird-server.loadbalancer.server.port=80"
      - "traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80"
      - "traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c"

      # gRPC routers
      # Prod Router
      - "traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
      - "traefik.http.routers.netbird-grpc.entrypoints=websecure"
      - "traefik.http.routers.netbird-grpc.service=netbird-server-h2c"
      - "traefik.http.routers.netbird-grpc.priority=100"
      - "traefik.http.routers.netbird-grpc.tls=true"
      - "traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.netbird-grpc-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
      - "traefik.http.routers.netbird-grpc-local.entrypoints=websecure"
      - "traefik.http.routers.netbird-grpc-local.service=netbird-server-h2c"
      - "traefik.http.routers.netbird-grpc-local.priority=100"
      - "traefik.http.routers.netbird-grpc-local.tls=true"
      # Dev Router
      - "traefik.http.routers.netbird-grpc-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
      - "traefik.http.routers.netbird-grpc-dev.entrypoints=websecure"
      - "traefik.http.routers.netbird-grpc-dev.service=netbird-server-h2c"
      - "traefik.http.routers.netbird-grpc-dev.priority=100"
      - "traefik.http.routers.netbird-grpc-dev.tls=true"

      # Backend routers
      # Prod Router
      - "traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
      - "traefik.http.routers.netbird-backend.entrypoints=websecure"
      - "traefik.http.routers.netbird-backend.service=netbird-server"
      - "traefik.http.routers.netbird-backend.priority=100"
      - "traefik.http.routers.netbird-backend.tls=true"
      - "traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.netbird-backend-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
      - "traefik.http.routers.netbird-backend-local.entrypoints=websecure"
      - "traefik.http.routers.netbird-backend-local.service=netbird-server"
      - "traefik.http.routers.netbird-backend-local.priority=100"
      - "traefik.http.routers.netbird-backend-local.tls=true"
      # Dev Router
      - "traefik.http.routers.netbird-backend-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
      - "traefik.http.routers.netbird-backend-dev.entrypoints=websecure"
      - "traefik.http.routers.netbird-backend-dev.service=netbird-server"
      - "traefik.http.routers.netbird-backend-dev.priority=100"
      - "traefik.http.routers.netbird-backend-dev.tls=true"
    networks:
      - proxy

  dashboard:
    image: netbirdio/dashboard:v2.94.0
    container_name: netbird-dashboard
    restart: unless-stopped
    environment:
      NETBIRD_MGMT_API_ENDPOINT: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
      NETBIRD_MGMT_GRPC_API_ENDPOINT: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
      AUTH_AUDIENCE: netbird-dashboard
      AUTH_CLIENT_ID: netbird-dashboard
      AUTH_CLIENT_SECRET: ""
      AUTH_AUTHORITY: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}/oauth2"
      AUTH_SUPPORTED_SCOPES: openid profile email groups
      AUTH_REDIRECT_URI: /nb-auth
      AUTH_SILENT_REDIRECT_URI: /nb-silent-auth
      USE_AUTH0: "false"
      LETSENCRYPT_DOMAIN: none
    depends_on:
      netbird-server:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1/"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 15s
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.netbird-dashboard.loadbalancer.server.port=80"
      # Dashboard catch-all routers
      # Prod Router
      - "traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`)"
      - "traefik.http.routers.netbird-dashboard.entrypoints=websecure"
      - "traefik.http.routers.netbird-dashboard.service=netbird-dashboard"
      - "traefik.http.routers.netbird-dashboard.priority=1"
      - "traefik.http.routers.netbird-dashboard.tls=true"
      - "traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.netbird-dashboard-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`)"
      - "traefik.http.routers.netbird-dashboard-local.entrypoints=websecure"
      - "traefik.http.routers.netbird-dashboard-local.service=netbird-dashboard"
      - "traefik.http.routers.netbird-dashboard-local.priority=1"
      - "traefik.http.routers.netbird-dashboard-local.tls=true"
      # Dev Router
      - "traefik.http.routers.netbird-dashboard-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`)"
      - "traefik.http.routers.netbird-dashboard-dev.entrypoints=websecure"
      - "traefik.http.routers.netbird-dashboard-dev.service=netbird-dashboard"
      - "traefik.http.routers.netbird-dashboard-dev.priority=1"
      - "traefik.http.routers.netbird-dashboard-dev.tls=true"
    networks:
      - proxy

networks:
  proxy:
    external: true

volumes:
  netbird_data:
    name: netbird_data

secrets:
  relay_auth_secret:
    file: ./secrets/relay-auth-secret
  datastore_encryption_key:
    file: ./secrets/datastore-encryption-key