reverse proxy without a cluster

[redzovic]

Before posting

• I searched existing discussions and issues for similar questions.
• I reviewed the relevant NetBird documentation or troubleshooting guide.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Topic

Self-hosting

Deployment type

Self-hosted - advanced/custom deployment

Operating system or environment

Linux

NetBird version

No response

Question

as far as i understood it is mandatory to add a cluster to the reverse proxy section to be able to add a custom domain which can be used to reverse proxy stuff from the home lab.

i guess the cluster could also be hosted on the same machine as the netbird server itself but there are port clashes (80, 443). it feels like this isn't really necessary for a simple reverse tunneling setup.

Desired outcome

reverse tunnel without a cluster

What have you tried?

No response

Relevant environment details

No response

Logs or output

No response

Additional context

No response

[NeoPxl]

It's possible, i use it that way:

use the migration guide, see step 3 -> https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy

or add this to your docker-compose.yml (i like it all in one file with no volumes) and generate a token described in the guide

docker exec -it netbird-server /go/bin/netbird-server token create --name "proxy" --config /etc/netbird/config.yaml

services:
  proxy:
    image: netbirdio/reverse-proxy:latest
    container_name: netbird-proxy
    restart: unless-stopped
    networks: [netbird]
    depends_on:
      netbird-server:
        condition: service_started
    environment:
      NB_PROXY_DOMAIN: "proxy.example.com"
      NB_PROXY_TOKEN: "generate_token_like_in_docs_mentioned"
      NB_PROXY_MANAGEMENT_ADDRESS: "http://netbird-server:80"
      NB_PROXY_ALLOW_INSECURE: "true"
      NB_PROXY_ADDRESS: ":8443"
      NB_PROXY_ACME_CERTIFICATES: "true"
      NB_PROXY_ACME_CHALLENGE_TYPE: "tls-alpn-01"
      NB_PROXY_CERTIFICATE_DIRECTORY: "/certs"
      NB_PROXY_PRIVATE: "true"
    volumes:
      - ./data/netbird_proxy_certs:/certs
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.proxy-passthrough.entrypoints=websecure
      - traefik.tcp.routers.proxy-passthrough.rule=HostSNI(`*`)
      - traefik.tcp.routers.proxy-passthrough.tls.passthrough=true
      - traefik.tcp.routers.proxy-passthrough.service=proxy-tls
      - traefik.tcp.routers.proxy-passthrough.priority=1
      - traefik.tcp.services.proxy-tls.loadbalancer.server.port=8443
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

[sorenisanerd]

It's confusing why NB_PROXY_PRIVATE isn't true by default. The page you reference is the only place I can find that says anything about that env var. It says:

Serve private services with NetBird-Only authentication,
reachable exclusively over the WireGuard tunnel (also enables
per-account inbound listeners). Advanced; intended for proxies
embedded in a NetBird client rather than standalone deployments.

I don't know what this embedded client business is. A few other places in the docs mention netbird proxy as though that's a command you could run, but it's not.

Either way, it sort of hints that you shouldn't enable it, but I have yet to find any downside to doing so.