Describe the problem
When deploying NetBird self-hosted via TrueNAS Chart (using an external Identity Provider and disabling the "Use Embedded Identity Provider" option), the NetBird Dashboard fails to load.
Looking at the browser's DevTools Network tab, the dashboard attempts to fetch instance metadata using a malformed literal string URL:
https://netbird.myserver.com:8080/$NETBIRD_MGMT_API_ENDPOINT/api/instance
It appears that when the embedded IdP is disabled, the container's entrypoint script fails to substitute the environment variable $NETBIRD_MGMT_API_ENDPOINT inside the static frontend JS production files. When the embedded IdP is active, the substitution works perfectly, and the URL correctly targets https://netbird.myserver.com:8080/api/instance.
To Reproduce
Steps to reproduce the behavior:
- Deploy NetBird Management and Dashboard self-hosted (e.g., via TrueNAS Scale catalog app).
- Configure an external OIDC provider (like Authentik) and disable/uncheck the "Use Embedded Identity Provider" flag.
- Attempt to access the NetBird Dashboard UI via browser.
- The dashboard stays blank or throws an authentication/loading error. Open DevTools ➔ Network tab to see the failed request containing the unreplaced
$NETBIRD_MGMT_API_ENDPOINT string template.
Expected behavior
The container initialization/entrypoint script should always parse and replace $NETBIRD_MGMT_API_ENDPOINT inside the frontend static files with the actual environment variable value, regardless of whether the embedded IDP feature flag is enabled or disabled.
Are you using NetBird Cloud?
Self-hosted control plane.
NetBird version
- Management: v0.74.7
- Dashboard: v2.90.4
- TrueNAS Chart/Container Version: 1.0.36
- TrueNAS Scale Host Version: 25.10.3
NetBird status -d output:
N/A (Dashboard UI / Container Initialization Bug)
Screenshots
Using the default behavior (with embedded IdP true):
With embedded false:
Additional context
Below are the differences in the container environment variables (env outputs) inside /usr/share/nginx/html.
With Embedded Identity Provider ON (Working Substitution):
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
HOSTNAME=a4ba226e848b
AUTH_AUTHORITY=https://netbird.myserver.com:8080/oauth2
AUTH_SUPPORTED_SCOPES=openid profile email groups
USE_AUTH0=false
AUTH_CLIENT_ID=netbird-dashboard
AUTH_AUDIENCE=netbird-dashboard
AUTH_REDIRECT_URI=/nb-auth
NETBIRD_MGMT_API_ENDPOINT=https://netbird.myserver.com:8080
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.myserver.com:8080
With Embedded Identity Provider OFF (Broken Substitution - Variables remain as literals):
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
HOSTNAME=e5413dbf113d
AUTH_AUTHORITY=https://netbird.myserver.com:8080/oauth2
NETBIRD_MGMT_API_ENDPOINT=https://netbird.myserver.com:8080
AUTH_REDIRECT_URI=/nb-auth
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.myserver.com:8080
Note that variables like AUTH_CLIENT_ID, AUTH_AUDIENCE, and USE_AUTH0 are stripped from the environment when the feature flag changes, which might be altering the logic path of the entrypoint shell script responsible for running sed or envsubst on the HTML/JS assets.
Describe the problem
When deploying NetBird self-hosted via TrueNAS Chart (using an external Identity Provider and disabling the "Use Embedded Identity Provider" option), the NetBird Dashboard fails to load.
Looking at the browser's DevTools Network tab, the dashboard attempts to fetch instance metadata using a malformed literal string URL:
https://netbird.myserver.com:8080/$NETBIRD_MGMT_API_ENDPOINT/api/instance
It appears that when the embedded IdP is disabled, the container's entrypoint script fails to substitute the environment variable
$NETBIRD_MGMT_API_ENDPOINTinside the static frontend JS production files. When the embedded IdP is active, the substitution works perfectly, and the URL correctly targets https://netbird.myserver.com:8080/api/instance.To Reproduce
Steps to reproduce the behavior:
$NETBIRD_MGMT_API_ENDPOINTstring template.Expected behavior
The container initialization/entrypoint script should always parse and replace
$NETBIRD_MGMT_API_ENDPOINTinside the frontend static files with the actual environment variable value, regardless of whether the embedded IDP feature flag is enabled or disabled.Are you using NetBird Cloud?
Self-hosted control plane.
NetBird version
NetBird status -d output:
N/A (Dashboard UI / Container Initialization Bug)
Screenshots
Using the default behavior (with embedded IdP true):
With embedded false:
Additional context
Below are the differences in the container environment variables (
envoutputs) inside/usr/share/nginx/html.With Embedded Identity Provider ON (Working Substitution):
With Embedded Identity Provider OFF (Broken Substitution - Variables remain as literals):
Note that variables like
AUTH_CLIENT_ID,AUTH_AUDIENCE, andUSE_AUTH0are stripped from the environment when the feature flag changes, which might be altering the logic path of the entrypoint shell script responsible for runningsedorenvsubston the HTML/JS assets.