DNS Nameserver Group limited to 3 resolvers — blocks dual-stack IPv4+IPv6 redundancy

[renne]

Describe the problem

The "Add Nameserver" button in the DNS Nameserver Group modal becomes disabled after 3 entries (nameservers.length >= 3, NameserverModal.tsx:329). This makes it impossible to configure a properly redundant dual-stack DNS setup.

Resilient DNS for a dual-stack network requires at minimum 4 resolvers: 2 × IPv4 and 2 × IPv6. With only 3 slots you must choose between full redundancy for one address family or partial coverage for both — neither is acceptable for production. Should one address family become unreachable, resolution silently degrades.

The limit of 3 is hardcoded in three places across two repositories:

1. Backend validation — management/server/nameserver.go, line 265 (netbirdio/netbird):
go
if nsListLength == 0 || nsListLength > 3 {
    return status.Errorf(status.InvalidArgument,
        "the list of nameservers should be 1 or 3, got %d", len(list))
}


2. OpenAPI spec — shared/management/http/api/openapi.yml, line 2138 (netbirdio/netbird):
yaml
nameservers:
  description: Nameserver list
  minLength: 1    # note: wrong keyword for arrays — should be minItems/maxItems
  maxLength: 3
  type: array

(Also a secondary bug: minLength/maxLength are string keywords in OpenAPI 3.1; the correct array keywords are minItems/maxItems. This constraint is malformed and would not be enforced by spec-validating middleware.)

3. Dashboard UI — src/modules/dns/nameservers/NameserverModal.tsx, line 329 (this repo):
tsx
disabled={nameservers.length >= 3 || !canAction}


Because the backend enforces its own hard limit, the API also rejects groups with more than 3 nameservers. This is a cross-repository issue requiring coordinated changes in both netbirdio/netbird and netbirdio/dashboard.

To Reproduce

Steps to reproduce the behavior:

1. Go to DNS → Nameservers → Create Nameserver Group
2. Add 3 nameserver entries
3. The "Add Nameserver" button becomes disabled — no 4th entry can be added
4. Alternatively: call POST /api/dns/nameservers with 4 nameserver objects — the backend returns InvalidArgument

Expected behavior

The UI and backend allow adding up to a reasonable maximum of nameservers per group (e.g. 8). The button should not be disabled before that maximum.

Proposed fix

The limit is currently duplicated independently across the OpenAPI spec, the Go validation, and the React component. The optimal solution is to define it once and propagate:

- Extract a named constant in netbirdio/netbird (e.g. MaxNameserversPerGroup = 8 in dns/nameserver.go)
- Use it in validateNSList() and fix the OpenAPI spec (maxItems: 8, correcting the keyword too)
- Have the Management API expose the spec at a stable endpoint (e.g. GET /api/openapi.yaml)
- The Dashboard reads maxItems from the spec at initialisation so the UI always reflects the server's actual limit — self-hosted operators who change the constant get correct UI behaviour automatically, with no separate frontend release required

Short-term: raise the constant to 8 in all three files. The UI fix in this repo is a one-line change.

Are you using NetBird Cloud?
Self-hosted

NetBird version
Management v0.73.2 (released 2026-06-22), Dashboard v2.80.0 (released 2026-06-23).

NetBird status -d output:
Not applicable (configuration/validation issue, not a connectivity issue).

Screenshots