From c4bb22f7ee9d99603ac470390f5e6295d600e13d Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Fri, 6 Feb 2026 16:28:31 +0100
Subject: [PATCH] Add dashboard env overrides for netbird-server

---
 netbird-server/DOCS.md                         | 11 +++++++++--
 .../rootfs/etc/cont-init.d/00-config.sh        | 18 ++++++++++++++++++
 .../rootfs/etc/services.d/dashboard/run        | 13 ++++++++++++-
 3 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/netbird-server/DOCS.md b/netbird-server/DOCS.md
index af21adbef..ab9aa89c0 100644
--- a/netbird-server/DOCS.md
+++ b/netbird-server/DOCS.md
@@ -12,13 +12,20 @@ The Dashboard container requires the `NETBIRD_MGMT_API_ENDPOINT` environment var
 
 1. Install the add-on.
 2. Start the add-on and verify all services are running in the log output.
-3. Stop the add-on, edit the generated `management.json` to configure your Identity Provider (IdP), then start the add-on again.
-4. Access the dashboard at `http://<HA_HOST>:8080`.
+3. Stop the add-on, edit the generated `management.json` to configure your Identity Provider (IdP).
+4. Update `/config/netbird/dashboard/env` with the `NETBIRD_MGMT_API_ENDPOINT` and `AUTH_*` values for the dashboard.
+5. Start the add-on again and access the dashboard at `http://<HA_HOST>:8080`.
 
 ## Configuration
 
 This add-on starts with zero configuration options. It writes default configs into `/config/netbird` and runs on the standard NetBird ports.
 
+### Dashboard environment overrides
+Edit `/config/netbird/dashboard/env` to configure the dashboard UI:
+
+- `NETBIRD_MGMT_API_ENDPOINT`: Public URL of the management API (for example, `https://netbird.example.com`).
+- `AUTH_AUTHORITY`, `AUTH_CLIENT_ID`, `AUTH_CLIENT_SECRET`, `AUTH_AUDIENCE`, `AUTH_SUPPORTED_SCOPES`, `USE_AUTH0`: OIDC settings for the dashboard UI.
+
 ### Generated configuration
 On first start, the add-on creates:
 - `management.json` in `$data_dir/management/`
diff --git a/netbird-server/rootfs/etc/cont-init.d/00-config.sh b/netbird-server/rootfs/etc/cont-init.d/00-config.sh
index 7d8859d39..b463bc276 100755
--- a/netbird-server/rootfs/etc/cont-init.d/00-config.sh
+++ b/netbird-server/rootfs/etc/cont-init.d/00-config.sh
@@ -210,3 +210,21 @@ sed "s/__DASHBOARD_PORT__/${DASHBOARD_PORT}/g" \
 
 mkdir -p /run/nginx
 chmod +x /usr/local/bin/init_react_envs.sh
+
+# Generate dashboard env file if missing
+DASHBOARD_ENV_FILE="$DATA_DIR/dashboard/env"
+if [[ ! -f "$DASHBOARD_ENV_FILE" ]]; then
+  bashio::log.info "Generating dashboard env file at ${DASHBOARD_ENV_FILE}."
+  cat <<'ENV' > "$DASHBOARD_ENV_FILE"
+# NetBird dashboard environment overrides.
+# Example: NETBIRD_MGMT_API_ENDPOINT="https://netbird.example.com"
+NETBIRD_MGMT_API_ENDPOINT=""
+AUTH_AUTHORITY=""
+AUTH_CLIENT_ID=""
+AUTH_CLIENT_SECRET=""
+AUTH_AUDIENCE=""
+AUTH_SUPPORTED_SCOPES="openid profile email api offline_access email_verified"
+USE_AUTH0="false"
+ENV
+  chmod 600 "$DASHBOARD_ENV_FILE"
+fi
diff --git a/netbird-server/rootfs/etc/services.d/dashboard/run b/netbird-server/rootfs/etc/services.d/dashboard/run
index fd42b60e4..ac20ab3d9 100644
--- a/netbird-server/rootfs/etc/services.d/dashboard/run
+++ b/netbird-server/rootfs/etc/services.d/dashboard/run
@@ -16,10 +16,21 @@ AUTH_CLIENT_SECRET=""
 AUTH_AUDIENCE=""
 AUTH_SUPPORTED_SCOPES="openid profile email api offline_access email_verified"
 USE_AUTH0="false"
+NETBIRD_MGMT_API_ENDPOINT=""
 
 MANAGEMENT_PORT="${MANAGEMENT_LISTEN##*:}"
 
-if [[ -n "$EXTERNAL_BASE_URL" ]]; then
+ENV_FILE="/config/netbird/dashboard/env"
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  . "$ENV_FILE"
+  set +a
+fi
+
+if [[ -n "$NETBIRD_MGMT_API_ENDPOINT" ]]; then
+  NETBIRD_MGMT_API_ENDPOINT="$NETBIRD_MGMT_API_ENDPOINT"
+elif [[ -n "$EXTERNAL_BASE_URL" ]]; then
   NETBIRD_MGMT_API_ENDPOINT="$EXTERNAL_BASE_URL"
 elif [[ -n "$DOMAIN" ]]; then
   NETBIRD_MGMT_API_ENDPOINT="http://${DOMAIN}:${MANAGEMENT_PORT}"