netbird/README.md

227 lines
10 KiB
Markdown
Raw Normal View History

<div align="center">
<p align="center">
<img width="250" src="docs/media/logo-full.png"/>
</p>
<p>
<img src="https://img.shields.io/badge/license-BSD--3-blue" />
<img src="https://img.shields.io/docker/pulls/wiretrustee/management" />
<img src="https://badgen.net/badge/Open%20Source%3F/Yes%21/blue?icon=github" />
</p>
</div>
<p align="center">
<strong>
Start using Wiretrustee at <a href="https://app.wiretrustee.com/">app.wiretrustee.com</a>
<br/>
2021-11-22 23:11:26 +01:00
See <a href="https://docs.wiretrustee.com">Documentation</a>
<br/>
Join our <a href="https://join.slack.com/t/wiretrustee/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A">Slack channel</a>
<br/>
</strong>
</p>
2021-05-06 13:53:58 +02:00
<br>
**Wiretrustee is an open-source VPN platform built on top of WireGuard® making it easy to create secure private networks for your organization or home.**
2021-12-06 13:54:46 +01:00
It requires zero configuration effort leaving behind the hassle of opening ports, complex firewall rules, VPN gateways, and so forth.
2021-10-27 13:56:55 +02:00
**Wiretrustee automates Wireguard-based networks, offering a management layer with:**
2021-11-20 14:53:57 +01:00
* Centralized Peer IP management with a UI dashboard.
2022-02-10 19:18:25 +01:00
* Encrypted peer-to-peer connections without a centralized VPN gateway.
2021-10-27 13:56:55 +02:00
* Automatic Peer discovery and configuration.
* UDP hole punching to establish peer-to-peer connections behind NAT, firewall, and without a public static IP.
* Connection relay fallback in case a peer-to-peer connection is not possible.
* Multitenancy (coming soon).
* Client application SSO with MFA (coming soon).
* Access Controls (coming soon).
* Activity Monitoring (coming soon).
2022-01-17 20:21:52 +01:00
* Private DNS (coming soon)
2021-10-27 13:56:55 +02:00
### Secure peer-to-peer VPN in minutes
<p float="left" align="middle">
2021-10-16 16:54:37 +02:00
<img src="docs/media/peerA.gif" width="400"/>
<img src="docs/media/peerB.gif" width="400"/>
</p>
2021-05-06 13:53:58 +02:00
2021-08-20 13:24:54 +02:00
**Note**: The `main` branch may be in an *unstable or even broken state* during development. For stable versions, see [releases](https://github.com/wiretrustee/wiretrustee/releases).
2021-08-20 13:23:57 +02:00
Hosted version:
[https://app.wiretrustee.com/](https://app.wiretrustee.com/peers).
2021-09-12 20:38:26 +02:00
2021-09-03 15:33:49 +02:00
[UI Dashboard Repo](https://github.com/wiretrustee/wiretrustee-dashboard)
2021-09-27 09:23:19 +02:00
2021-05-06 13:57:21 +02:00
### A bit on Wiretrustee internals
2021-12-06 13:54:46 +01:00
* Wiretrustee features a Management Service that offers peer IP management and network updates distribution (e.g. when a new peer joins the network).
2021-05-06 14:40:51 +02:00
* Wiretrustee uses WebRTC ICE implemented in [pion/ice library](https://github.com/pion/ice) to discover connection candidates when establishing a peer-to-peer connection between devices.
* Peers negotiate connection through [Signal Service](signal/).
* Signal Service uses public Wireguard keys to route messages between peers.
Contents of the messages sent between peers through the signaling server are encrypted with Wireguard keys, making it impossible to inspect them.
2021-12-06 13:54:46 +01:00
* Occasionally, the NAT traversal is unsuccessful due to strict NATs (e.g. mobile carrier-grade NAT). When this occurs the system falls back to the relay server (TURN), and a secure Wireguard tunnel is established via the TURN server. [Coturn](https://github.com/coturn/coturn) is the one that has been successfully used for STUN and TURN in Wiretrustee setups.
<p float="left" align="middle">
<img src="https://docs.wiretrustee.com/img/architecture/high-level-dia.png" width="700"/>
</p>
2021-05-06 13:57:21 +02:00
2021-06-02 21:30:19 +02:00
### Product Roadmap
2021-06-02 21:31:37 +02:00
- [Public Roadmap](https://github.com/wiretrustee/wiretrustee/projects/2)
2021-06-02 21:30:19 +02:00
- [Public Roadmap Progress Tracking](https://github.com/wiretrustee/wiretrustee/projects/1)
### Client Installation
#### Linux
2021-10-03 18:55:47 +02:00
**APT/Debian**
1. Add the repository:
```shell
sudo apt-get update
sudo apt-get install ca-certificates curl gnupg -y
curl -L https://pkgs.wiretrustee.com/debian/public.key | sudo apt-key add -
echo 'deb https://pkgs.wiretrustee.com/debian stable main' | sudo tee /etc/apt/sources.list.d/wiretrustee.list
```
2. Install the package
```shell
sudo apt-get update
sudo apt-get install wiretrustee
```
**RPM/Red hat**
1. Add the repository:
```shell
cat <<EOF | sudo tee /etc/yum.repos.d/wiretrustee.repo
[Wiretrustee]
name=Wiretrustee
baseurl=https://pkgs.wiretrustee.com/yum/
enabled=1
gpgcheck=0
gpgkey=https://pkgs.wiretrustee.com/yum/repodata/repomd.xml.key
repo_gpgcheck=1
EOF
```
2. Install the package
```shell
sudo yum install wiretrustee
```
#### MACOS
**Brew install**
1. Download and install Brew at https://brew.sh/
2. Install the client
2021-10-03 18:55:47 +02:00
```shell
brew install wiretrustee/client/wiretrustee
```
2021-09-06 16:12:57 +02:00
**Installation from binary**
1. Checkout Wiretrustee [releases](https://github.com/wiretrustee/wiretrustee/releases/latest)
2021-05-30 12:35:18 +02:00
2. Download the latest release (**Switch VERSION to the latest**):
2021-10-03 18:55:47 +02:00
```shell
curl -o ./wiretrustee_<VERSION>_darwin_amd64.tar.gz https://github.com/wiretrustee/wiretrustee/releases/download/v<VERSION>/wiretrustee_<VERSION>_darwin_amd64.tar.gz
```
3. Decompress
2021-10-03 18:55:47 +02:00
```shell
tar xcf ./wiretrustee_<VERSION>_darwin_amd64.tar.gz
sudo mv wiretrusee /usr/local/bin/wiretrustee
chmod +x /usr/local/bin/wiretrustee
```
After that you may need to add /usr/local/bin in your MAC's PATH environment variable:
2021-10-03 18:55:47 +02:00
````shell
export PATH=$PATH:/usr/local/bin
````
2021-06-23 01:38:44 +02:00
#### Windows
1. Checkout Wiretrustee [releases](https://github.com/wiretrustee/wiretrustee/releases/latest)
2. Download the latest Windows release installer ```wiretrustee_installer_<VERSION>_windows_amd64.exe``` (**Switch VERSION to the latest**):
3. Proceed with installation steps
4. This will install the client in the C:\\Program Files\\Wiretrustee and add the client service
2021-10-03 18:55:47 +02:00
5. After installing, you can follow the [Client Configuration](#Client-Configuration) steps.
> To uninstall the client and service, you can use Add/Remove programs
2021-06-23 01:38:44 +02:00
### Client Configuration
1. Login to the Management Service. You need to have a `setup key` in hand (see ).
2021-06-23 01:38:44 +02:00
For **Unix** systems:
2021-10-03 18:55:47 +02:00
```shell
sudo wiretrustee up --setup-key <SETUP KEY>
2021-10-03 18:55:47 +02:00
```
For **Windows** systems, start powershell as administrator and:
2021-10-03 18:55:47 +02:00
```shell
wiretrustee up --setup-key <SETUP KEY>
2021-10-03 18:55:47 +02:00
```
For **Docker**, you can run with the following command:
```shell
docker run --network host --privileged --rm -d -e WT_SETUP_KEY=<SETUP KEY> -v wiretrustee-client:/etc/wiretrustee wiretrustee/wiretrustee:<TAG>
```
> TAG > 0.3.0 version
2021-05-06 13:53:58 +02:00
Alternatively, if you are hosting your own Management Service provide `--management-url` property pointing to your Management Service:
2021-10-03 18:55:47 +02:00
```shell
sudo wiretrustee up --setup-key <SETUP KEY> --management-url https://localhost:33073
2021-10-03 18:55:47 +02:00
```
2022-02-10 19:18:25 +01:00
> You could also omit the `--setup-key` property. In this case, the tool will prompt for the key.
2. Check your IP:
2021-10-03 18:55:47 +02:00
For **MACOS** you will just start the service:
````shell
sudo ipconfig getifaddr utun100
````
For **Linux** systems:
2021-10-03 18:55:47 +02:00
```shell
ip addr show wt0
```
For **Windows** systems:
2021-10-03 18:55:47 +02:00
```shell
netsh interface ip show config name="wt0"
```
3. Repeat on other machines.
2021-09-13 07:58:52 +02:00
### Running Dashboard, Management, Signal and Coturn
2021-09-07 10:38:07 +02:00
Wiretrustee uses [Auth0](https://auth0.com) for user authentication and authorization, therefore you will need to create a free account
2021-09-13 07:58:52 +02:00
and configure Auth0 variables in the compose file (dashboard) and in the management config file.
2022-02-10 19:18:25 +01:00
We chose Auth0 to "outsource" the user management part of our platform because we believe that implementing a proper user auth is not a trivial task and requires a significant amount of time to make it right. We focused on connectivity instead.
It is worth mentioning that the dependency on Auth0 is the only one that cannot be self-hosted.
2021-09-13 08:06:28 +02:00
Configuring Wiretrustee Auth0 integration:
- check [How to run](https://github.com/wiretrustee/wiretrustee-dashboard#how-to-run) to obtain Auth0 environment variables for UI Dashboard
2021-09-13 07:58:52 +02:00
- set these variables in the [environment section of the docker-compose file](https://github.com/wiretrustee/wiretrustee/blob/main/infrastructure_files/docker-compose.yml)
- check [Auth0 Golang API Guide](https://auth0.com/docs/quickstart/backend/golang) to obtain ```AuthIssuer```, ```AuthAudience```, and ```AuthKeysLocation```
- set these properties in the [management config files](https://github.com/wiretrustee/wiretrustee/blob/main/infrastructure_files/management.json#L33)
2021-09-07 10:38:07 +02:00
2021-09-13 07:58:52 +02:00
Under infrastructure_files we have a docker-compose example to run Dashboard, Wiretrustee Management and Signal services, plus an instance of [Coturn](https://github.com/coturn/coturn), it also provides a turnserver.conf file as a simple example of Coturn configuration.
2021-05-30 12:35:18 +02:00
You can edit the turnserver.conf file and change its Realm setting (defaults to wiretrustee.com) to your own domain and user setting (defaults to username1:password1) to **proper credentials**.
2022-02-10 19:18:25 +01:00
The example is set to use the official images from Wiretrustee and Coturn; you can find our documentation to run the signal server in docker in [Running the Signal service](#running-the-signal-service), the management in [Management](./management/README.md), and the Coturn official documentation [here](https://hub.docker.com/r/coturn/coturn).
2021-05-30 09:29:30 +02:00
> Run Coturn at your own risk, we are just providing an example, be sure to follow security best practices and to configure proper credentials as this service can be exploited and you may face large data transfer charges.
2022-02-10 19:18:25 +01:00
Also, if you have an SSL certificate for Coturn, you can modify the docker-compose.yml file to point to its files in your host machine and then switch the domain name to your own SSL domain. If you don't already have an SSL certificate, you can follow [Certbot's](https://certbot.eff.org/docs/intro.html) official documentation
to generate one from [Lets Encrypt](https://letsencrypt.org/), or, we found that the example provided by [BigBlueButton](https://docs.bigbluebutton.org/2.2/setup-turn-server.html#generating-tls-certificates) covers the basics to configure Coturn with Let's Encrypt certs.
2022-02-10 19:18:25 +01:00
> The Wiretrustee Management service can generate and maintain the certificates automatically, all you need to do is run the service in a host with a public IP, configure a valid DNS record pointing to that IP and uncomment the 443 ports and command lines in the docker-compose.yml file.
Simple docker-composer execution:
````shell
cd infrastructure_files
docker-compose up -d
````
You can check logs by running:
````shell
cd infrastructure_files
docker-compose logs signal
docker-compose logs management
docker-compose logs coturn
````
If you need to stop the services, run the following:
````shell
cd infrastructure_files
docker-compose down
````
2021-06-02 21:30:19 +02:00
### Legal
[WireGuard](https://wireguard.com/) is a registered trademark of Jason A. Donenfeld.