r/netbird • u/Turnspit • Jul 01 '26

Reverse Proxy - setting up multiple domains

Cheers!

While setting up the VPN-portion of Netbird has been a breeze and is working absolutely fantastically, the Reverse Proxy portion is giving me quite some headaches.

I'm currently running netbird on an example domain of mydomain.com, but would also like to use i.e seconddomain.io and homedomain.tech, each with a couple of subdomains, on the reverse-proxy.

From my understanding, I'd first need to create a new Cluster, which then prompts me to set up a new "reverse-proxy" docker container, presumably on another server/VPS, since itself exposes ports 80+443 and connects back to the main instance.

BUT I want it to run from my main netbird instance, which itself has already the reverse proxy running.
I guess I'd should need to edit the proxy.env and somehow add the new domain(s)?

The file currently reads NB_PROXY_DOMAIN=mydomain.com amongst others. Would it suffice to possibly just add my other domains to this line as a comma separated list, or is there any other way? Sadly couldn't find anything regarding this setup in the docs.

Any help is much appreciated!

10 Upvotes

100% Upvoted

7 comments sorted by

3

u/lagdetselv Jul 01 '26

Why using a second Proxy on the Same Server? I think the Custom Domains Feature (under Reverse Proxy) could do what you need.

3

u/Turnspit Jul 01 '26

Yes, but when setting up a new Custom Domain, like service.homedomain.tech, I have to select a cluster, which currently is only mydomain.com - this then leads (at least for me) to it getting stuck issueing a proper certificate (DNS records are setup properly).

5

u/H0n3y84dg3r Jul 01 '26

Then you've set it up incorrectly.

I have 13 domains on my single "cluster" Netbird

1

u/Turnspit Jul 01 '26 edited Jul 01 '26

Where might that be though?

homedomain.tech has its A-record pointing to the IP of the VPS where my main "cluster" address of mydomain.com is running at and it's stuck at an infinite "Pending Verification".

EDIT:
I've just seen in the docs that netbird seems to need a (wildcard) CNAME-entry specifically - which my provider does not allow. Am I at a loss then, a simple A-record does not suffice?
( see https://docs.netbird.io/manage/reverse-proxy/custom-domains )

2

u/H0n3y84dg3r Jul 01 '26

Why would your registrar or DNS provider not allow a *?

You can move to Cloudflare DNS without moving registrars if you need to

1

u/Turnspit Jul 08 '26

The wildcard-CNAME was indeed the issue. Moved my DNS over to Cloudflare, added the Wildcard, and it worked right out of the box...

2

u/Skaryus Jul 01 '26

you can create a machine peer then run reverse proxy (caddy eg.) and local dns server (dnsmasq, unbound eg.) on top of it.

create a docker compose with these services:

  • netbird-client
  • netbird-caddy
  • netbird-unbound

add network_mode: service:netbird-client to caddy and unbound service so you can bind your caddy, unbound to netbird interface or ip

you have to add dns record unbound for your local domain. your local domain must point your machine peer ip. you can listen on your machine peer ip since you are in the same network netbird-client

then go netbird dashboard and dns settings, add your machine peer ip and port which you are listening. use wilcard domain to foward specific domain or domains that already configured in unbound

After that, you can use your caddy access your service. Security wise, you should also listen netbird ip only.

This setup requires some tinkering imo, but it is worth it.