From ff76a7bbc8a1b3d2c8ebd9073308eb2e64283306 Mon Sep 17 00:00:00 2001 From: qz <4quetz@gmail.com> Date: Tue, 8 Sep 2026 14:51:01 +0300 Subject: [PATCH] [doc] Document Relay loopback metrics and healthcheck binding --- src/pages/selfhosted/observability/relay.mdx | 21 ++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/pages/selfhosted/observability/relay.mdx b/src/pages/selfhosted/observability/relay.mdx index 10a634ccd..f659c703d 100644 --- a/src/pages/selfhosted/observability/relay.mdx +++ b/src/pages/selfhosted/observability/relay.mdx @@ -17,6 +17,27 @@ The Relay service forwards encrypted WireGuard traffic between peers that cannot netbird-relay --metrics-port 9090 ``` +For the standalone Relay service, `--metrics-port` accepts either a port or a +`host:port` address. A bare port such as `9090`, or `:9090`, listens on all +interfaces. To bind both metrics and healthcheck to IPv4 loopback, add these +flags to your Relay command: + +```bash +--metrics-port 127.0.0.1:9090 --health-listen-address 127.0.0.1:9000 +``` + +The equivalent environment variables are: + +```bash +NB_METRICS_PORT=127.0.0.1:9090 +NB_HEALTH_LISTEN_ADDRESS=127.0.0.1:9000 +``` + +Use `[::1]:9090` and `[::1]:9000` for IPv6 loopback. Metrics remain at +`/metrics` and healthcheck at `/health`. Existing numeric metrics settings and +the defaults (`:9090` and `:9000`) are unchanged. Port `0` selects a random +port; it does not disable the listener. + In the combined container, the metrics port is set with `server.metricsPort` in `config.yaml` and is shared with Management and Signal. See [Combined](/selfhosted/observability/combined).