mirror of https://github.com/gravitl/netmaker.git synced 2026-10-12 02:15:06 +00:00

T

Vishal Dalwadi f81fe29d4d NM-341-v6 (#4107 )

* wip(go): wire ctx in extclient apis;

* wip(go): wire ctx in extclient apis;

* wip(go): remove org id check from global scoped get tenant api;

* wip(go): add scope slug to discover response;

* wip(go): wire ctx in get users;

* wip(go): set tenant id in posture check violations;

* wip(go): upsert membership instead of user;

* wip(go): pass correct len;

* wip(go): optimize (single loop);

* wip(go): unify todos;

* wip(go): add todo;

* wip(go): wire context for network get;

* wip(go): wire context;

* wip(go): wire context;

* wip(go): wire ctx when getting tenant superadmin;

* wip(go): add network creator to network admin group;

* wip(go): check for user membership on sync;

* wip(go): add methods with strict membership check;

* wip(go): remove unwanted feature flags;

* wip(go): report per-tenant usage during license validation;

* wip(go): move email setting from tenant to org;

* wip(go): pass org scope to email init;

* wip(go): remove old tenant email settings usages; use org settings to get email settings

* wip(go): use get email settings from org settings;

* wip(go): remove email settings migration;

* wip(go): migrate email settings from server to org settings;

* wip(go): assign global network admin group membership only for super-admin and admins;

* wip(go): assign global network admin group membership only for super-admin and admins;

* wip(go): add membership alias to filter;

* wip(go): skip clearing local license validation response cache;

* wip(go): extend license validation response for multi-tenancy;

* wip(go): add functions to get sole tenant and org;

* wip(go): use tenant-specific feature flags;

* wip(go): add tenant status type;

* wip(go): remove old hook comment;

* wip(go): expect ctx during license validation;

* wip(go): always create default org and tenant for ce;

* wip(go): add tenant-specific check for license validation error;

* wip(go): cache license validation response in memory;

* wip(go): add todo to handle multiple-tenant for integration pull;

* wip(go): pass ctx during license validation;

* wip(go): add todo for making changes later; run hook separately for each tenant;

* wip(go): return specific errors when license validation response not in cache;

* wip(go): use retryable.httpclient for calling license validation api;

* wip(go): process license validation;

* wip(go): license validation function;

* wip(go): migration on license validation;

* wip(go): org settings not expected;

* wip(go): remove expiry from license validation response;

* wip(go): add limits and limits enforcement to license validation response;

* wip(go): remove expiry usages;

* wip(go): add arg to clear cache;

* wip(go): add arg to clear cache;

* wip(go): skip license validation if cached resp;

* wip(go): allow org_id and tenant_id query params;

* wip(go): upsert tenant membership on sync;

* wip(go): pass ctx to delete network roles;

* wip(go): create tenant membership on org owner creation on ce;

* wip(go): add tenant orchestrator;

* wip(go): use tenant orchestrator;

* wip(go): add default settings for tenant;

* wip(go): make org owner superadmin on all tenants;

* wip(go): simplify SyncOrgAndTenants;

* wip(go): retry license validation only 3 times

* wip(go): store invalid err;

* wip(go): add function to check if limits are to be enforced on a tenant;

* wip(go): pass tenant scope if possible when checking for license validation error;

* wip(go): remove merge errors;

* wip(go): add functions for limit checks;

* wip(go): wire host limit check;

* wip(go): wire ingress limit check;

* wip(go): wire egress limit check;

* wip(go): wire client limit check;

* wip(go): wire network limit check;

* wip(go): wire user limit check;

* wip(go): use correct errors;

* wip(go): skip telemetry for msps;

* wip(go): disable telemetry on msp tenants;

* wip(go): err check;

* wip(go): uncomment log event;

* wip(go): get sso state to get scope for non-headless oauth login;

* wip(go): inline delete pending user;

* wip(go): allow both org and tenant scope for pending users table;

* wip(go): add migration for pending user table during set tenant id and rekey org/tenant id;

* wip(go): update queries to use new scope fields in pending users table;

* wip(go): allow both org and tenant scope for user invites table;

* wip(go): update queries to use new scope fields;

* wip(go): add migration for rekey-ing org/tenant id and setting tenant id;

* wip(go): inline delete user invite;

* wip(go): set scope when creating invite;

* wip(go): get user count with membership is ctx is tenant scoped;

* wip(go): add methods to upsert and delete org memberships;

* wip(go): add global valid tenant and org roles map;

* wip(go): add scope query in user invite get by email;

* wip(go): add support for upsert and delete of org and tenant membership both;

* wip(go): infer scope for user invite apis;

* wip(go): wire ctx in get user invite by email;

* wip(go): allow no scope headers to be passed in infer scope apis;

* wip(go): add validation and checks for org-scoped invite api handlers;

* wip(go): wire ctx to is pending user check;

* wip(go): infer scope for pending user apis;

* wip(go): set default role based on ctx scope;

* wip(go): move mfa to tenant membership table; move account status to membership tables;

* wip(go): migrate account status and mfa settings;

* wip(go): update account status on sync;

* wip(go): use update mfa to update mfa setting;

* wip(go): set new membership settings on user creation;

* wip(go): use membership where required;

* wip(go): wire ctx on key unlink refs;

* wip(go): use r.Context directly without reinitializing db;

* wip(go): wire ctx in acls;

* wip(go): add tenant scoped primary key constructor;

* wip(go): use tenant scoped primary key for acls, dns, extclients and tags;

* wip(go): wire ctx for get groups in network;

* wip(go): wire ctx for get groups;

* wip(go): scope non-uuid group ids by tenant id;

* wip(go): migrate non-uuid group ids to scoped ids;

* wip(go): don't expect scope id in invite validation and signup apis;

* wip(go): wire ctx for get matching user; allow org scope when querying by external idp id;

* wip(go): add mfa to org;

* wip(go): scope preauth token;

* wip(go): add fallback for older auth tokens;

* wip(go): wire ctx for preauth token creation;

* wip(go): migrate mfa settings;

* wip(go): resolve mfa settings for inherited auth;

* wip(go): update mfa for org;

* wip(go): infer scope for totp apis;

* wip(go): use ctx when passed;

* wip(go): infer scope for list user apis;

* wip(go): ensure set primary keys don't cause errors during fetch;

* wip(go): make primary key for integrations uuid and store provider in separate key;

* wip(go): migrate integration ids;

* wip(go): use provider instead of id everywhere;

* wip(go): remove gorm column;

* wip(go): wire ctx for igw egress creation;

* wip(go): wire ctx for igw egress update;

* wip(go): wire ctx for host registration;

* wip(go): wire ctx for host registration;

* wip(go): merge errors;

* wip(go): merge errors;

* wip(go): wire ctx; remove default scope usages;

* wip(go): use get with membership;

* wip(go): org scope license validation;

* wip(go): remove debug log;

* wip(go): remove scoping on list roles;

* wip(go): ignore invite creation if already exists;

* wip(go): add is msp func to check if deployment is msp deployment;

* wip(go): ensure username is email for msp users;

* wip(go): add email validated check on user table;

* wip(go): mark email validated when oauth user;

* wip(go): handle gorm error;

* wip(go): add tenant id to siem grpc schema;

* wip(go): read tenant from scoped ctx;

* wip(go): pass scoped ctx to siem grpc client;

* wip(go): remove unused publisher;

* wip(go): publish all tenant exporter updates on pull;

* wip(go): fix wg usage;

* wip(go): tenant scope the ctx when getting server info;

* wip(go): add tenant id to enrollment key token;

* wip(go): make host register tenant scope;

* wip(go): add default settings;

* wip(go): use correct checks for is msp tenant;

* wip(go): add email validation extension;

* wip(go): add pages for validation check;

* wip(go): use extension for validating user;

* wip(go): add invite type;

* wip(go): create only one validation invite per user email;

* wip(go): add validate email handler;

* wip(go): add email builder;

* wip(go): add user invite type migration logic;

* wip(go): only log email send failures;

* wip(go): add tenant id to flows table;

* wip(go): add func to check if connected to clickhouse;

* wip(go): migrate clickhouse;

* wip(go): add tenant id to mdm and edr state;

* wip(go): add delete methods for tables;

* wip(go): add tenant teardown method;

* wip(go): handle tenant deletion;

* wip(go): clean up flow logs on tenant deletion;

* wip(go): add update org membership role id method;

* wip(go): add transfer org ownership api;

* wip(go): move audit logs retention period to org settings;

* wip(go):get retention period from org settings;

* wip(go): remove old audit logs usage;

* wip(go): migrate audit logs retention period;

* wip(go): unmarshal decodes nums as float64;

* wip(go): run flow logs cleanup for all tenants in one go;

* wip(go): add audit logs retention period and smtp settings to tenant settings table for non-msp tenants;

* wip(go): resolve retention period and smtp settings correctly;

* wip(go): handle retention period and smtp settings updates and fetches correctly;

* wip(go): overlay retention period and smtp settings on server settings;;

* wip(go): upsert overlayed settings;

* wip(go): add azure tenant id to org settings;

* wip(go): tenant scope list roles;

* wip(go): add noop creds;

* wip(go): use first instead of find;

* wip(go): use correct roles when transfering ownership;

* wip(go): delete access tokens only if tenant scoped;

* wip(go): make delete user work for both org and tenant scope;

* wip(go): delete extclients only if tenant scoped;

* wip(go): check if caller is allowed to delete user;

* wip(go): infer scope for update user;

* wip(go): prevent org-owner elevation;

* wip(go): permissions check for update;

* wip(go): delete user access tokens only if tenant scope;

* wip(go): delete extclients only if tenant scope;

* wip(go): move upsert membership in upsert user;

* wip(go): set api host when constructing server config;

* wip(go): fix static errors;

* wip(go): fix test cases;

* wip(go): use correct get ns order;

* wip(go): use correct get pending host order;

* wip(go): use correct get access token order;

* wip(go): use correct get event order;

* wip(go): return error response on emqx user creation error;

* wip(go): store correct value in cache;

* wip(go): return better error response;

* wip(go): return better error response;

* wip(go): use cache when listing egress acls;

* wip(go): wire ctx in UserHasNetworkGroupAccess;

* wip(go): remove double scope wrapping;

* wip(go): add security check for list and get org;

* wip(go): ratelimit discover api;

* wip(go): expect sole org id in get and create org owner;

* wip(go): wrap create org owner in tx;

* wip(go): wire ctx correctly;

* wip(go): wire ctx for posture check functions;

* wip(go): remove resolved todo;

* wip(go): wire ctx for posture check function;

* wip(go): remove scope from netdesk login api;

* wip(go): use orgid correctly;

* wip(go): scope user update checks correctly;

* wip(go): wire ctx for fetch oauth secret;

* wip(go): add tenant_id and org_id query string param to user invite url;

* wip(go): get sole org;

* wip(go): set query string correctly;

* wip(go): wire ctx in update user groups;

* wip(go): allow delete oauth non-idp users;

* wip(go): delete access tokens post update but check before update;

2026-08-10 18:59:40 +05:30

.github

v1.6.0: release notes (#4057 )

2026-06-12 12:40:40 +05:30

auth

NM-341-v6 (#4107 )

2026-08-10 18:59:40 +05:30

cli

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

clickhouse

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

compose

v1.6.0: release notes (#4057 )

2026-06-12 12:40:40 +05:30

config

NM-271: Scalability Improvements (#3921 )

2026-03-18 00:24:54 +05:30

controllers

NM-341-v6 (#4107 )

2026-08-10 18:59:40 +05:30

NM-341: Schema Migration for Serverconf, Generated and Enrollment Keys Table (#4065 )

2026-07-06 23:00:21 +05:30

docker

NM-324: PenTest Fixes (#3996 )

2026-05-07 17:38:52 +05:30

docs

fix: update documentation links to new docs (#3156 )

2024-10-17 14:35:36 +04:00

grpc

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

k8s

v1.6.0: release notes (#4057 )

2026-06-12 12:40:40 +05:30

logger

ee license check

2023-04-12 10:45:06 -04:00

logic

NM-341-v6 (#4107 )

2026-08-10 18:59:40 +05:30

middleware

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

migrate

NM-341-v6 (#4107 )

2026-08-10 18:59:40 +05:30

models

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

netclient/ncutils

load all nodes into cache

2024-11-27 14:56:24 +04:00

nginx

remove references to grpc/comms net

2022-04-21 15:53:44 -04:00

orchestrator

NM-341-v6 (#4107 )

2026-08-10 18:59:40 +05:30

pro

NM-341-v6 (#4107 )

2026-08-10 18:59:40 +05:30

schema

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

scope

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

scripts

v1.6.0: release notes (#4057 )

2026-06-12 12:40:40 +05:30

servercfg

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

test

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

tls

initial changes to make cert <-> broker comms work

2022-07-05 15:04:45 -04:00

utils

NM-356: handle device approval workflow for desktop app

2026-07-02 18:33:00 +05:30

validation

merge conflicts resolved

2022-09-26 17:47:20 +05:30

.dockerignore

NET-163: Return 403 instead of 401 (#2326 )

2023-05-25 09:40:39 -04:00

.fpm

add rpms

2022-03-09 15:28:39 -05:00

.gitignore

NET-1996: Add Support for TOTP Authentication. (#3517 )

2025-06-26 08:29:13 +05:30

.goreleaser.prerelease.yaml

Net 792 remove freebsd (#2735 )

2024-01-16 20:19:08 +05:30

.goreleaser.update.yaml

cleanup

2023-02-25 08:03:16 -05:00

.goreleaser.yaml

Net 792 remove freebsd (#2735 )

2024-01-16 20:19:08 +05:30

.swaggo

add format int64 for swagger doc (#3247 )

2024-12-12 09:52:52 +04:00

CONTRIBUTING.md

Create CONTRIBUTING.md

2022-01-20 08:19:23 -05:00

dev.yaml

remove grpc parameters

2023-02-20 09:09:26 -07:00

Dockerfile

build(deps): bump alpine from 3.23.3 to 3.23.4 (#3980 )

2026-05-15 22:10:01 +05:30

Dockerfile-quick

build(deps): bump alpine from 3.23.3 to 3.23.4 (#3980 )

2026-05-15 22:10:01 +05:30

go.mod

build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 (#4085 )

2026-07-13 15:18:20 +08:00

go.sum

build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 (#4085 )

2026-07-13 15:18:20 +08:00

LICENSE.md

feat(go): rename pro license file;

2026-04-27 18:25:08 +05:30

main_ee.go

NET-1778: scale test code changes (#3203 )

2024-12-10 10:15:31 +04:00

main.go

NM-341-v6: AMB Multi-tenancy Management (#4101 )

2026-08-05 21:25:02 +08:00

Makefile

NM-366: handle exit node functionality via new node apis. fix jit affected user config deletion

2026-07-09 13:33:13 +05:30

README.md

v1.6.0: release notes (#4057 )

2026-06-12 12:40:40 +05:30

release.md

v1.6.0: release notes (#4057 )

2026-06-12 12:40:40 +05:30

remote-build.sh

NM-366: handle exit node functionality via new node apis. fix jit affected user config deletion

2026-07-09 13:33:13 +05:30

SECURITY.md

update security policy

2026-06-15 23:37:42 +05:30

swagger.yaml

add host identifiers to api obj

2026-06-23 13:05:37 +05:30

README.md

WireGuard^® automation from homelab to enterprise

Create	Manage	Automate
✔️ WireGuard Networks	✔️ Admin UI	✔️ Linux
✔️ Remote Access Gateways	✔️ OAuth	✔️ Docker
✔️ Mesh VPNs	✔️ Private DNS	✔️ Mac
✔️ Site-to-Site	✔️ Access Control Lists	✔️ Windows

Try Netmaker SaaS

If you're looking for a managed service, you can get started with just a few clicks, visit netmaker.io to create your netmaker server.

Self-Hosted Open Source Quick Start

These are the instructions for deploying a Netmaker server on your cloud VM as quickly as possible. For more detailed instructions, visit the Install Docs.

Get a cloud VM with Ubuntu 24.04 and a static public IP.
Allow inbound traffic on port 443,51821 TCP and UDP to the VM firewall in cloud security settings, and for simplicity, allow outbound on All TCP and All UDP.
(recommended) Prepare DNS - Set a wildcard subdomain in your DNS settings for Netmaker, e.g. *.netmaker.example.com, which points to your VM's public IP.
Run the script to setup open source version of Netmaker:

sudo wget -qO /root/nm-quick.sh https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/nm-quick.sh && sudo chmod +x /root/nm-quick.sh && sudo /root/nm-quick.sh

To Install Self-Hosted PRO Version - https://docs.netmaker.io/docs/server-installation/netmaker-professional-setup

After installing Netmaker, check out the Walkthrough and Getting Started guides to learn more about configuring networks. Or, check out some of our other Tutorials for different use cases, including Kubernetes.

Get Support

Why Netmaker + WireGuard?

Netmaker automates virtual networks between data centres, clouds, and edge devices, so you don't have to.
Kernel WireGuard offers maximum speed, performance, and security.
Netmaker is built to scale from small businesses to enterprises.
Netmaker with WireGuard can be highly customized for peer-to-peer, site-to-site, Kubernetes, and more.

Community Projects

Disclaimer

WireGuard is a registered trademark of Jason A. Donenfeld.

License

Netmaker's source code and all artifacts in this repository are freely available. All content that resides under the "pro/" directory of this repository, if that directory exists, is licensed under the license defined in "pro/PRO_LICENSE". All third party components incorporated into the Netmaker Software are licensed under the original license provided by the owner of the applicable component. Content outside of the above mentioned directories or restrictions above is available under the "Apache Version 2.0" license as defined below. All details for the licenses used can be found here: LICENSE.md.

README.md

WireGuard® automation from homelab to enterprise

Try Netmaker SaaS

Self-Hosted Open Source Quick Start

Get Support

Why Netmaker + WireGuard?

Community Projects

Disclaimer

License

WireGuard^® automation from homelab to enterprise