dashboard
dashboard copied to clipboard
Allow `/install` to be configurable on self hosted setup
Is your feature request related to a problem? Please describe.
Currently, /install
on the dashboard is publicly accessible. This endpoint hosts instructions to set up Netbird for the particular domain. It also serves as a notion that the entity is currently running Netbird, something that might be problematic for a few environments. As an example, it's generally thought of as a good practice to disable nginx from exposing the current running version, to prevent attackers from attempting to exploit any vulnerabilities in the said version. As for Netbird, this might end up being an attack vector in the future, where attackers can know what VPN is being used and exploit it.
From my knowledge, and discussion with the Netbird team, this page only serves as a guide to install and configure Netbird, something that can also be done through the dashboard access, or teams in environment that setup and configure the VPN for the user. So I believe it makes sense to allow users to disable the endpoint completely.
Describe the solution you'd like
Allow a flag to disable the /install
endpoint
Describe alternatives you've considered
Right now, users can add a block in the reverse proxy to disable access to /install
, but it also might break the dashboard modal for installation instructions (untested).
Additional context N/A