The tokens captured for central update control expire (NetBird enforces a
365-day max on Personal Access Tokens), and nothing was renewing them —
discovered that the 47 tokens created via the browser-automation bulk
onboarding were actually only 30-day tokens (left the UI's default
expiration field untouched instead of setting 365), so they would have
silently broken automatic-update control next month with no warning.
- Bumped all existing tokens to fresh 365-day ones via the API (using the
still-valid old token as bearer — no re-login needed)
- Added netbird_api_token_renewed_at per deployment
- Scheduler now checks daily and renews any token older than 300 days
automatically, so this never needs to be done by hand again
Lets the MSP admin control NetBird's own "Settings > Clients > Automatic
Updates" feature (client/peer auto-update, v0.61.0+) for every customer from
one place, instead of logging into each customer's dashboard individually.
- New deployments automatically capture a Personal Access Token during the
existing /api/setup bootstrap call (create_pat=true), requiring
NB_SETUP_PAT_ENABLED=true on the management container (now set by default
in the compose template). Token is encrypted at rest per customer.
- Existing customers (deployed before this existed) can have a token pasted
in manually from their own dashboard — verified before being stored.
- Settings > Docker Images: master default (version + force-update toggle)
plus "Apply to All Customers" which pushes it to everyone with a token.
- Customer detail page: shows the customer's live current setting (read
from their NetBird API, not cached) with per-customer override or
"sync from default".
- New app/services/netbird_client_update_service.py wraps the customer's
NetBird Management API (GET/PUT /api/accounts) for this.
twothatIT