- Backend: add admin-only guard + role validation to PUT /users/{id}
- Backend: prevent admins from changing their own role
- Frontend: role toggle button (person-check / person-dash) per user row
- Frontend: admin badge green, viewer badge secondary, ldap badge blue
- i18n: add makeAdmin / makeViewer translations (de + en)
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Mount ./data/uploads into /app/static/uploads so uploaded logos
survive image rebuilds during the update process.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Uses Bootstrap 5.3 native data-bs-theme with localStorage persistence.
Inline script in <head> prevents flash on page load.
Moon/sun icon in top-right navbar switches between light and dark.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
In stop_customer, start_customer and restart_customer the local variable
'customer' was referenced on the instance_dir line before it was assigned
(it was only queried after the docker compose call). This caused an
UnboundLocalError (HTTP 500) on every stop/start/restart action.
Fix: move the customer query to the top of each function alongside the
deployment and config queries.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- Register SOURCE_DIR as git safe.directory before pulling so the
process (root inside container) can access repos owned by a host user
- Run 'git fetch --tags' after pull so git describe always finds the
latest tag for version.json — git pull does not reliably fetch all tags
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
The project name was hardcoded as 'netbirdmsp-appliance' but Docker Compose
derives the project name from the install directory name ('netbird-msp').
This caused Phase A to build an image under the wrong project name and
Phase B to start the replacement container under a mismatched project,
leaving the old container running indefinitely.
Fix: read the 'com.docker.compose.project' label from the running container
at update time. Both Phase A (build) and Phase B (docker compose up) now
use the detected project name. Falls back to SOURCE_DIR basename if the
inspect fails.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Add /relay* location block to Caddyfile template so that NetBird relay
WebSocket connections (rels://) are correctly forwarded to the relay
container instead of falling through to the dashboard handler.
Without this fix, all relay WebSocket connections silently hit the
dashboard container, causing STUN/relay connectivity failures for all
deployed NetBird instances.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
