使用 Netbird 轻松组建内网

- 自建：Zitadel / Keycloak / Authentik
- 托管：Azure AD（Entra ID）/ Okta / Google Workspace / Auth0 / JumpCloud安装 1Panel 或 Docker（本文用 1Panel 管理 Docker）。放行端口：TCP 33073、10000、33080；UDP 3478、49152–65535。安装 jq apt install jq / yum install jq

#!/bin/bash
REPO="https://hub.mwm.moe/https://github.com/netbirdio/netbird/"
# 获取最新 tag，例如 v0.8.x
LATEST_TAG=$(basename $(curl -fs -o/dev/null -w %{redirect_url} ${REPO}releases/latest))
echo $LATEST_TAG
# 克隆对应版本
git clone --depth 1 --branch $LATEST_TAG $REPO

cd netbird/infrastructure_files/

# 访问域名
NETBIRD_DOMAIN="vpn.example.com"
# 关闭内置证书签发（改用 Nginx 反代）
NETBIRD_DISABLE_LETSENCRYPT=true
# 指定端口
NETBIRD_MGMT_API_PORT=443
NETBIRD_SIGNAL_PORT=443

- 进入 **Projects → Create New Project**：名称 `NETBIRD` 
- 在 **APPLICATIONS → New**：  名称 `netbird`、应用类型 `User Agent`、认证方式 `PKCE` 
- **Redirect URIs**：  `https://<domain>/auth`、`https://<domain>/silent-auth`、`http://localhost:53000`（本地调试）  **Post Logout URIs**：`https://<domain>/` 
- **授权模式**：`Authorization Code`、`Device Code`、`Refresh Token` 
- 复制 **Client ID** 备用  
- 参考截图：  

- Token 类型 `JWT` 
- 勾选 **Add user roles to the access token**  

# OIDC 配置端点
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://<你的域名>/.well-known/openid-configuration"
NETBIRD_USE_AUTH0=false

# 应用 Client ID
NETBIRD_AUTH_CLIENT_ID="<ZITADEL_CLIENT_ID>"
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
NETBIRD_AUTH_AUDIENCE=$NETBIRD_AUTH_CLIENT_ID

# 授权回调
NETBIRD_AUTH_REDIRECT_URI="/auth"
NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"

# 设备授权
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="hosted"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=$NETBIRD_AUTH_CLIENT_ID
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_CLIENT_ID

# 管理端对接 Zitadel
NETBIRD_MGMT_IDP="zitadel"
NETBIRD_IDP_MGMT_CLIENT_ID="<SERVICE_USER_CLIENT_ID>"
NETBIRD_IDP_MGMT_CLIENT_SECRET="<SERVICE_USER_CLIENT_SECRET>"
NETBIRD_IDP_MGMT_EXTRA_MANAGEMENT_ENDPOINT="https://<你的域名>/management/v1"
NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true

- 类型：`OAuth2/OpenID Provider` 
- 名称：`Netbird` 
- Authentication Flow：`default-authentication-flow` 
- Authorization Flow：`default-provider-authorization-explicit-consent` 
- 协议：Client type `Public`；Redirect（RegEx）：`https://<domain>/.*`、`http://localhost:53000` 
- Signing Key：选择证书（如 `authentik Self-signed Certificate`）  
- 高级：Access code validity `10 分钟`；Subject mode `Based on the User's ID`  记录 **Client ID**。  

# OIDC 配置端点
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://<YOUR_AUTHENTIK_HOST_AND_PORT>/application/o/netbird/.well-known/openid-configuration"
NETBIRD_USE_AUTH0=false

# Client / Audience
NETBIRD_AUTH_CLIENT_ID="<PROVIDER_CLIENT_ID>"
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
NETBIRD_AUTH_AUDIENCE="<PROVIDER_CLIENT_ID>"

# 设备授权
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="<PROVIDER_CLIENT_ID>"
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE="<PROVIDER_CLIENT_ID>"

# 回调
NETBIRD_AUTH_REDIRECT_URI="/auth"
NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"

# 管理端对接 Authentik
NETBIRD_MGMT_IDP="authentik"
NETBIRD_IDP_MGMT_CLIENT_ID="<PROVIDER_CLIENT_ID>"
NETBIRD_IDP_MGMT_EXTRA_USERNAME="Netbird"
NETBIRD_IDP_MGMT_EXTRA_PASSWORD="<SERVICE_ACCOUNT_PASSWORD>"

# 已知问题：禁用 PKCE 的 login 提示（参考 issue #3654）
NETBIRD_AUTH_PKCE_DISABLE_PROMPT_LOGIN=true

./configure.sh

cd artifacts

services:
  dashboard:
    image: netbirdio/dashboard:latest
    ports:
      - 10080:80
    environment:
      - NETBIRD_MGMT_API_ENDPOINT=https://vpn.example.com:443
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://vpn.example.com:443
      - AUTH_AUDIENCE=338490954304520197
      - AUTH_CLIENT_ID=338490954304520197
      - AUTH_AUTHORITY=https://sso.example.com
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=/auth
      - AUTH_SILENT_REDIRECT_URI=/silent-auth
      - NETBIRD_TOKEN_SOURCE=accessToken
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/

  signal:
    image: netbirdio/signal:latest
    volumes:
      - netbird-signal:/var/lib/netbird
    ports:
      - 10081:80

  relay:
    image: netbirdio/relay:latest
    environment:
      - NB_LOG_LEVEL=info
      - NB_LISTEN_ADDRESS=:33080
      - NB_EXPOSED_ADDRESS=rels://vpn.example.com:33080/relay
      - NB_AUTH_SECRET=gJ5WI25foN/yherA6dio5i1a3zNYLelwESDA663IYZE
    ports:
      - 10084:33080

  management:
    image: netbirdio/management:latest
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    ports:
      - 10083:443
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=vpn.example.com",
      "--dns-domain=netbird.selfhosted"
    ]
    environment:
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      - NETBIRD_STORE_ENGINE_MYSQL_DSN=

  coturn:
    image: coturn/coturn:latest
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

location ^~ /management.ManagementService/ {
    grpc_read_timeout 300s;
    grpc_send_timeout 300s;
    grpc_socket_keepalive on;
    grpc_pass grpc://127.0.0.1:10083;
    access_log off;
}

location ^~ /signalexchange.SignalExchange/ {
    grpc_read_timeout 300s;
    grpc_send_timeout 300s;
    grpc_socket_keepalive on;
    grpc_pass grpc://127.0.0.1:10081;
    access_log off;
}