NetBird adds identity and policy to a WireGuard overlay
NetBird connects enrolled machines through WireGuard and manages them centrally. Clients discover direct connection candidates with ICE and STUN, exchange connection information through a signal service, and use a relay when NAT traversal fails. A management service owns network state, peer addresses, and updates. This is more machinery than a hand-written WireGuard configuration, but it solves user enrollment, changing fleets, and access policy across many networks.
The README names more than 15 client targets across desktop systems, phones, routers, NAS products, hypervisors, containers, and serverless environments. Features include private-network routes, exit nodes, private DNS, browser SSH and RDP, reverse proxying, posture checks, periodic authentication, and activity records. Automation comes through an API, setup keys, Terraform, and Ansible. That breadth is useful and creates a large platform-specific test surface.
Self-hosting starts with 3 public ports and several services
The quick start expects a public domain pointing at a Linux VM with at least 1 CPU and 2 GB of memory. TCP ports 80 and 443 and UDP port 3478 must be reachable. Docker with the Compose v2 plugin runs a published installation script. Its five-minute estimate assumes DNS, firewall rules, a clean host, and supported container tooling are already available.
Production adds decisions about identity, setup-key lifetime, route approval, DNS, relay capacity, logs, backups, and upgrades. NetBird Cloud removes much of that server work but moves trust to the hosted service. Self-hosting retains control while making the operator responsible for management, signal, and relay availability. This belongs with the network or identity team, not as an application developer's unnoticed side service.
What happened when we ran it
Our sandbox installed 697 Go packages in 89 seconds and built commit 3f90181 in 8 seconds. The checkout held 2,638 files, about 541,850 source lines, and occupied 25.9 MB. The unprivileged Debian container had 3 CPUs and 8 GB of RAM. NetBird is a large Go network product that compiles quickly after its substantial dependency download.
The test command did not finish before our 900-second cap. Go had reported 104 package results passing and 11 failing out of 115. The final lines show several management reverse-proxy packages passing, including access logs, proxy tokens, and service code. They do not show which test was active when time expired or the assertions behind the 11 failures, so the lab evidence supports no narrower diagnosis.
The repository has 22 CI workflow files, no Dockerfile, and no top-level tests directory. Go tests usually sit beside source, which fits the 115 results observed. Published containers power the self-host quick start despite the lack of a root Dockerfile. The timeout means contributors should learn the project's targeted CI commands instead of expecting one broad local invocation to return quick feedback.
Stable v0.77.1 matters because main may break
The README says the main branch can be unstable or broken and directs production users to releases. Version 0.77.1 was published August 21, 2026, with fixes across Linux authentication, Windows routing and updates, Android network changes, setup-key validation, and installation automation. One network product must interact with several operating-system routing, DNS, credential, and lifecycle models, and those release notes show the ongoing cost.
GitHub recorded a last push on August 26, 2026, 28,668 stars, and 1,577 combined issues and pull requests. The open count is not 1,577 confirmed bugs. The same-day push and recent release show active maintenance, while the large queue is still worth searching before rollout. Match client versions to each operating system and inspect reports about sleep, DNS, routes, and upgrades that resemble your fleet.
macOS wake recovery has a 62-comment report
Issue 2454 was opened in August 2024 and had 62 comments when checked. The reporter says a self-hosted macOS client may show a connected state after sleep while peer traffic fails, with a down-and-up cycle used as a workaround. Activity continued through August 26, 2026. One report does not establish behavior on every current Mac, but its age and participation justify a sleep-and-wake acceptance test before deployment.
A useful pilot should also cover Wi-Fi switching, split DNS, exit nodes, relay fallback, key expiry, client upgrades, and a control-plane restart. NetBird's v0.77.1 notes contain fixes involving several operating-system network transitions. Test the actual supported fleet rather than proving one Linux server can reach another and treating that as sufficient evidence for laptops and phones.
Four server directories carry AGPLv3 terms
The top-level license says BSD-3-Clause applies except to management/, signal/, relay/, and combined/, which use AGPLv3. The README's shorter legal note names only three directories, while the current license file also names combined/. Self-hosters modifying server behavior or offering it over a network should use the license file as the source and obtain legal advice for a commercial distribution or service.
The architecture and deployment path are documented, and stable releases arrive regularly. The 900-second timeout still calls for targeted checks and qualification of each chosen release. Source compilation is not the main barrier. The adoption work lies in a 3-port public deployment, identity policy, platform behavior, monitoring, and upgrade ownership.
NetBird fits a managed fleet better than 2 static hosts
For two fixed Linux hosts, plain WireGuard is easier to reason about and has fewer services. NetBird starts earning its place when users, devices, sites, and access rules change often enough that manual key and configuration work becomes unsafe. Groups, setup keys, posture checks, DNS, routes, and activity records then solve real operating problems.
Choose the hosted service if running a control plane is unwanted. Choose self-hosting when infrastructure control justifies the mixed-license server stack and the team can treat it as production networking. In either case, use a released client, reproduce the 11 failed package results, and test the transitions that users notice: sleep, roaming, DNS changes, and upgrades.