Migrating to v0.72 - Private Services and Proxy Clusters

Tips and Guides
1

If you’re self-hosting with the built-in Traefik setup from the quick start script, there’s one required change before you upgrade: the gRPC router needs to route the proxy’s new gRPC service through the h2c backend. Without it, proxy registration falls through to the HTTP/1 backend router and breaks.

In your docker-compose.yml, find the netbird-grpc.rule label on the netbird-server service and add the third PathPrefix:

- - traefik.http.routers.netbird-grpc.rule=Host(`netbird.example.com`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`))
+ - traefik.http.routers.netbird-grpc.rule=Host(`netbird.example.com`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))

Replace netbird.example.com with your domain.

Then, if you want your proxy to support private services, drop the private flag into your proxy.env:

NB_PROXY_PRIVATE=true

This is what gives the cluster its Private capability and unlocks NetBird-Only access in the dashboard. It’s not generated by the quick start script, so you need to add it yourself. Skip it if you don’t need private services.

From there it’s the usual:

docker compose pull
docker compose up -d

Only netbird-server and the proxy get recreated, the rest keeps running. To verify the proxy registers over the new gRPC route, check the logs:

docker compose logs --tail=30 proxy netbird-server

You’re looking for notified management about tunnel connection on the proxy and Service status updated ... status: active on the server. If you see those, you’re good to go.

2 Likes
Private Service functionality
2

This is working great on Windows and Linux devices, but Android clients can’t access private services.

I’m still testing and trying to narrow it down, but it seems that android clients are trying to access private services from outside! Which is why they get “Forbidden”.

I assume this means the Android client needs updating for this feature?

3

Update to this: android clients aren’t trying to route from outside, they do get through but very slowly. Very slow to make the initial connection.

Does the connection have to go through the proxy instead of direct?