From a9d55866f103ca45780e10436062bfc02e8a4694 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Thu, 30 Jul 2026 09:26:48 +0200 Subject: [PATCH 1/5] Document that privileged daemon operations require root or administrator --- src/pages/client/grpc-socket.mdx | 86 +++++++++++++++++-- src/pages/client/json-socket.mdx | 31 +++++-- src/pages/get-started/cli.mdx | 10 +-- .../setup-keys-add-servers-to-network.mdx | 2 +- src/pages/manage/peers/ssh.mdx | 15 +++- 5 files changed, 123 insertions(+), 21 deletions(-) diff --git a/src/pages/client/grpc-socket.mdx b/src/pages/client/grpc-socket.mdx index 20d4b71c5..722fc9d3a 100644 --- a/src/pages/client/grpc-socket.mdx +++ b/src/pages/client/grpc-socket.mdx @@ -21,14 +21,25 @@ The HTTP/JSON gateway is optional. The gRPC socket is available whenever the Net | Platform | Default address | | --------------- | ------------------------------ | | Linux and macOS | `unix:///var/run/netbird.sock` | -| Windows | `tcp://127.0.0.1:41731` | +| Windows | `npipe://netbird` | + +On Windows the daemon serves a named pipe. Which path that is depends on what the +daemon may create: running as a service or elevated it serves +`\\.\pipe\ProtectedPrefix\Administrators\netbird`, a namespace only administrators +can create in, and otherwise it falls back to `\\.\pipe\netbird`. Clients try both +and check who owns the pipe before using the plain name, so passing +`npipe://netbird` is enough. Windows installations that predate the named pipe are +migrated from `tcp://127.0.0.1:41731` automatically. - **Security warning:** On supported Linux installations, the default Unix - socket allows read and write access for local users. The API exposes control - operations as well as status. If you require local-user isolation, place a - custom socket inside a restricted directory and ensure that the directory is - recreated securely at boot. + **Security warning:** The default Unix socket allows read and write access for + local users, so any local user can read status and configuration and perform + operations that do not require privileges. Operations that decide who may + obtain a shell on the machine are refused unless the caller is root, or an + administrator on Windows: see [Privileged + operations](#privileged-operations). If you require local-user isolation + beyond that, place a custom socket inside a restricted directory and ensure + that the directory is recreated securely at boot. On Linux installations that use an instance-specific systemd service, the socket can instead be under `/var/run/netbird/.sock`. The NetBird CLI automatically uses the only socket in that directory when the default socket does not exist. If multiple instance sockets exist, pass the intended address explicitly with `--daemon-addr`. @@ -46,6 +57,7 @@ Use the global `--daemon-addr` option when installing or reconfiguring the servi ```text unix:///path/to/netbird.sock tcp://host:port +npipe://name ``` @@ -92,8 +104,56 @@ netbird --daemon-addr tcp://127.0.0.1:41731 status TLS. Keep TCP listeners bound to a trusted interface such as `127.0.0.1` and do not expose them to an untrusted network. The API includes operations that can read or change the local NetBird daemon's state. + + A TCP connection also carries no caller identity, so the daemon cannot tell + who is calling and refuses every [privileged + operation](#privileged-operations) on that socket, whoever runs the client. + Use a Unix socket, or `npipe://` on Windows, if your integration needs them. +## Privileged Operations + +Any local user can reach the socket, so the daemon authorizes individual operations +by the identity of whoever calls it, read from the kernel rather than supplied by +the client: `SO_PEERCRED` on Linux, `LOCAL_PEERCRED` on macOS, and the named-pipe +client token on Windows. A caller whose identity cannot be established is refused. + +Since 0.76.0 the following require root, or an administrator on Windows, because +they decide who may obtain a shell on the machine: + +| Change | Refused when | +| --- | --- | +| Enable the NetBird SSH server | the caller is not privileged | +| Enable SSH root login | the caller is not privileged | +| Disable SSH authentication | the caller is not privileged | +| Change the management URL | the caller is not privileged and that profile has the SSH server enabled | +| Deregister the peer (logout, profile removal) | the caller is not privileged and that profile has the SSH server enabled | + +Only the direction that creates the capability is guarded. Turning any of them off +is always allowed, and restating a value that is already set is not a change, so an +integration that submits a whole settings form does not start failing once an +administrator enables SSH. + +A refusal comes back as gRPC `PermissionDenied` carrying a `google.rpc.ErrorInfo` +detail, so an integration can recognise it without parsing the message: + +```text +reason: PRIVILEGE_REQUIRED +domain: daemon.netbird.io +metadata: summary = "Enabling the NetBird SSH server requires root." + command = "sudo netbird down; sudo netbird up --allow-server-ssh" +``` + +Render `summary` and `command` rather than the raw error: `command` is the same +operation with the privileges it needs, ready to run. + + + When the daemon itself runs unprivileged, as in a rootless container or on + Windows in netstack mode, a caller running as the daemon's own user is treated + as privileged. Such a caller can already rewrite the configuration the daemon + reads, so refusing it would protect nothing. + + ## Service Definition The socket provides `daemon.DaemonService`. NetBird's @@ -165,7 +225,10 @@ grpcurl \ ### Query Status Through a TCP Socket -For the default Windows listener or a custom loopback TCP listener: +For a custom loopback TCP listener. Note that `grpcurl` cannot dial a Windows named +pipe, so the Windows default is not reachable this way; use a client that can open +the pipe, or configure a TCP listener for testing and accept that [privileged +operations](#privileged-operations) are refused on it: ```shell grpcurl \ @@ -230,6 +293,15 @@ This is expected. Supply `daemon.proto` with your tool's equivalent of the `grpc Confirm that the daemon is running and that the integration uses the same socket address as the service. For a Unix socket, also verify access to the socket and each parent directory. For TCP, verify the host and port and ensure the listener remains bound to a trusted interface. +### A Call Is Refused With PermissionDenied + +The operation is one of the [privileged operations](#privileged-operations) and the +caller is not root, or not an administrator on Windows. Check the `ErrorInfo` detail +on the error: `PRIVILEGE_REQUIRED` in domain `daemon.netbird.io` means the daemon +identified the caller and refused the change, rather than failing to reach it. On a +TCP socket every such operation is refused, because the transport carries no caller +identity. + ### A Method or Field Is Unimplemented The integration's generated bindings may be newer than the installed NetBird daemon. Compare the installed client version with the revision of `daemon.proto` used to generate the bindings, then use a compatible schema or upgrade NetBird. diff --git a/src/pages/client/json-socket.mdx b/src/pages/client/json-socket.mdx index 36aca8282..73225b364 100644 --- a/src/pages/client/json-socket.mdx +++ b/src/pages/client/json-socket.mdx @@ -35,13 +35,20 @@ unix:///var/run/netbird-http.sock ``` - **Security warning:** On supported Linux installations, the default Unix - socket allows read and write access for local users. The API exposes control - operations as well as status. If you require local-user isolation, place a - custom socket inside a restricted directory and ensure that the directory is - recreated securely at boot. + **Security warning:** The default Unix socket allows read and write access for + local users. The API exposes control operations as well as status. If you + require local-user isolation, place a custom socket inside a restricted + directory and ensure that the directory is recreated securely at boot. +The gateway runs inside the daemon and re-dials it locally, so it reads the identity +of its own HTTP client and forwards it, which is what lets the daemon authorize the +request as that user rather than as the daemon itself. The +[privileged operations](/client/grpc-socket#privileged-operations) therefore behave +the same over HTTP as over gRPC, and a refusal comes back as HTTP 403 with the same +`PRIVILEGE_REQUIRED` detail. Metadata headers reserved for that forwarding are +dropped when a client supplies them. + To enable it on an existing installation, reconfigure the service: @@ -95,6 +102,11 @@ sudo netbird service reconfigure \ listeners bound to a trusted interface such as `127.0.0.1` and do not expose them to an untrusted network. The API includes operations that can read or change the local NetBird daemon's state. + + A TCP connection carries no caller identity, so the gateway cannot tell who is + calling and every + [privileged operation](/client/grpc-socket#privileged-operations) is refused on + such a socket, whoever runs the client. To disable the gateway again, run: @@ -241,6 +253,15 @@ If you supplied `--json-socket` without `--enable-json-socket`, NetBird rejects Verify that the process running the integration can access the socket and every parent directory in its path. A custom restricted directory can prevent access even when the socket itself allows it. +### A Request Is Refused With 403 + +The operation is one of the +[privileged operations](/client/grpc-socket#privileged-operations) and the HTTP +client is not root, or not an administrator on Windows. The response body carries a +`PRIVILEGE_REQUIRED` detail in domain `daemon.netbird.io`, with a summary and the +command that performs the same operation with the privileges it needs. On a TCP +gateway socket these operations are always refused. + ### A TCP Request Cannot Connect Confirm that the host and port in the request match the value passed to `--json-socket`. Prefer `127.0.0.1` over `0.0.0.0` unless remote access is explicitly required and protected by an additional security boundary. diff --git a/src/pages/get-started/cli.mdx b/src/pages/get-started/cli.mdx index 77f06b6ec..405920d31 100644 --- a/src/pages/get-started/cli.mdx +++ b/src/pages/get-started/cli.mdx @@ -42,7 +42,7 @@ Below is the list of global flags: --admin-url string Admin Panel URL [http|https]://[host]:[port] (default "https://app.netbird.io:443") -A, --anonymize anonymize IP addresses and non-netbird.io domains in logs and status output -c, --config string Overrides the default profile file location. Deprecated on `up` and `login`; use `--service-env NB_CONFIG=` instead. - --daemon-addr string Daemon service address to serve CLI requests [unix|tcp]://[path|host:port] (default "unix:///var/run/netbird.sock") + --daemon-addr string Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name] (default "unix:///var/run/netbird.sock", "npipe://netbird" on Windows) -n, --hostname string Sets a custom hostname for the device --log-file console Sets NetBird log paths written to simultaneously. If "console" is specified the log will be output to stdout. If "syslog" is specified the log will be sent to the syslog daemon. You can pass the flag multiple times or separate entries by comma (default [/var/log/netbird/client.log]) -l, --log-level string Sets NetBird log level (default "info") @@ -509,9 +509,9 @@ For SFTP and SCP, use native clients (`sftp` and `scp` commands) which work with **Connection fails:** -- Ensure SSH is enabled on the target peer: +- Ensure SSH is enabled on the target peer, which requires root or an administrator: ```shell - netbird up --allow-server-ssh + sudo netbird down; sudo netbird up --allow-server-ssh ``` - Verify SSH Access is enabled in the dashboard (Peers > your_peer > SSH Access) - Check that an ACL policy allows TCP port 22022 @@ -520,13 +520,13 @@ For SFTP and SCP, use native clients (`sftp` and `scp` commands) which work with - Complete the OIDC flow when prompted (browser window will open) - Verify your IdP is properly configured -- To disable JWT authentication: `netbird up --allow-server-ssh --disable-ssh-auth` +- To disable JWT authentication, as root or an administrator: `sudo netbird down; sudo netbird up --allow-server-ssh --disable-ssh-auth` **Port forwarding not working:** - Ensure the server has the appropriate flags: ```shell - netbird up --allow-server-ssh \ + sudo netbird up --allow-server-ssh \ --enable-ssh-local-port-forwarding \ --enable-ssh-remote-port-forwarding ``` diff --git a/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx b/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx index 7467c4087..a9b2b1130 100644 --- a/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx +++ b/src/pages/manage/peers/access-infrastructure/setup-keys-add-servers-to-network.mdx @@ -202,7 +202,7 @@ This feature allows you to securely access your VM with SSH without exposing it for distributing and managing SSH keys. To enable NetBird SSH access, run the following command on your VM: ```bash -netbird up --allow-server-ssh +sudo netbird up --allow-server-ssh ``` You can then use the NetBird SSH client to connect to your VM: diff --git a/src/pages/manage/peers/ssh.mdx b/src/pages/manage/peers/ssh.mdx index 529d84324..0318a4962 100644 --- a/src/pages/manage/peers/ssh.mdx +++ b/src/pages/manage/peers/ssh.mdx @@ -75,20 +75,29 @@ On the machine you want to access via SSH, enable the NetBird SSH server. **Using the CLI:** ```bash -netbird down # if NetBird is already running -netbird up --allow-server-ssh +sudo netbird down # if NetBird is already running +sudo netbird up --allow-server-ssh ``` For additional SSH server features, use these flags: ```bash -netbird up --allow-server-ssh \ +sudo netbird up --allow-server-ssh \ --enable-ssh-local-port-forwarding \ --enable-ssh-remote-port-forwarding \ --enable-ssh-sftp \ --enable-ssh-root ``` + + Enabling the SSH server, enabling root login, and disabling SSH + authentication require root on Linux and macOS, or an administrator on + Windows. The daemon reads the identity of whoever calls it locally and refuses + these changes to anyone else, since they decide who may obtain a shell on the + machine. Turning any of them off does not require privileges. Run the + commands with `sudo`, or from an elevated prompt on Windows. + + **Flag Reference:** - `--allow-server-ssh`: Enable the SSH server From 015edd9467d4d6205b656da2e3318e064e1007c0 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Thu, 30 Jul 2026 09:47:19 +0200 Subject: [PATCH 2/5] Note that the desktop app needs privileges for the SSH switches --- src/pages/client/desktop-app.mdx | 14 +++++++++++++- src/pages/manage/peers/ssh.mdx | 10 ++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/src/pages/client/desktop-app.mdx b/src/pages/client/desktop-app.mdx index 34cdf193f..c005cd973 100644 --- a/src/pages/client/desktop-app.mdx +++ b/src/pages/client/desktop-app.mdx @@ -66,7 +66,8 @@ The settings page uses a tabbed layout that groups options by what they control. * **Network** for connectivity, DNS, routes, and IPv6 settings. * **Security** for inbound traffic, LAN access, and quantum-resistant encryption settings. * **Profiles** for managing the accounts the app knows about. See [Profiles](/client/profiles). -* **SSH** for the native SSH server and its optional features. +* **SSH** for the native SSH server and its optional features. Some of these + require privileges: see the note below. * **Advanced** for log-level and custom configuration options. * **Troubleshoot** for [capturing a debug bundle](#capturing-a-debug-bundle). * **About** for version information, useful links, and updating the app. @@ -75,6 +76,17 @@ The settings page uses a tabbed layout that groups options by what they control. Settings page with the General tab and Display Language picker

+ + The switches that decide who may obtain a shell on the machine, **Enable SSH + Server**, **Enable Root Login** and SSH authentication, can only be changed by a + privileged caller, because the background service runs as root on Linux and macOS + and as LocalSystem on Windows while the app runs as you. The app shows those + switches as unavailable and puts the equivalent command next to them: run it in a + terminal with `sudo` on Linux and macOS, or from an elevated prompt on Windows, + where you can also start the app as administrator. A switch that is already on + stays operable, since turning these settings off never requires privileges. + + **Connect on Startup** controls whether the background service reconnects when it starts. **Launch NetBird UI at Login** controls only whether the graphical interface opens when you sign in to the operating system. On a fresh desktop installation, launch at login is enabled once by default. Upgrades preserve the user's existing preference. Administrators can manage this behavior with [`disableAutostart`](/client/mdm-integration#disableAutostart). ## MDM-Driven UI diff --git a/src/pages/manage/peers/ssh.mdx b/src/pages/manage/peers/ssh.mdx index 0318a4962..ef7d50b9c 100644 --- a/src/pages/manage/peers/ssh.mdx +++ b/src/pages/manage/peers/ssh.mdx @@ -67,6 +67,16 @@ On the machine you want to access via SSH, enable the NetBird SSH server. 2. Go to **Settings → SSH**. 3. Toggle **Enable SSH Server**. Configure local forwarding, remote forwarding, SFTP, or root access only when required. + + **Enable SSH Server**, **Enable Root Login** and the SSH authentication switch + require privileges. On Linux and macOS the desktop app runs as your own user, so + it cannot make these changes: it shows those switches as unavailable with the + equivalent command next to them, which you run in a terminal with `sudo`. On + Windows, either start the app as administrator or run the same command from an + elevated prompt. A switch that is already on stays operable, because turning + these settings off never requires privileges. + +

SSH server settings in the NetBird desktop app From 5f51194dae469f4c87d3455e59b39ea09139888e Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Thu, 30 Jul 2026 10:06:13 +0200 Subject: [PATCH 3/5] Say what unprivileged users can do when the SSH switches need privileges --- src/pages/client/desktop-app.mdx | 9 +++++---- src/pages/manage/peers/ssh.mdx | 18 ++++++++++++------ 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/src/pages/client/desktop-app.mdx b/src/pages/client/desktop-app.mdx index c005cd973..57e02e93b 100644 --- a/src/pages/client/desktop-app.mdx +++ b/src/pages/client/desktop-app.mdx @@ -81,10 +81,11 @@ The settings page uses a tabbed layout that groups options by what they control. Server**, **Enable Root Login** and SSH authentication, can only be changed by a privileged caller, because the background service runs as root on Linux and macOS and as LocalSystem on Windows while the app runs as you. The app shows those - switches as unavailable and puts the equivalent command next to them: run it in a - terminal with `sudo` on Linux and macOS, or from an elevated prompt on Windows, - where you can also start the app as administrator. A switch that is already on - stays operable, since turning these settings off never requires privileges. + switches as unavailable and puts the equivalent command next to them: run it with + `sudo` on Linux and macOS, or from an elevated prompt on Windows. Without those + rights, an administrator has to run it, or push the setting through + [MDM](#mdm-driven-ui), which the client applies itself. A switch that is already + on stays operable, since turning these settings off never requires privileges. **Connect on Startup** controls whether the background service reconnects when it starts. **Launch NetBird UI at Login** controls only whether the graphical interface opens when you sign in to the operating system. On a fresh desktop installation, launch at login is enabled once by default. Upgrades preserve the user's existing preference. Administrators can manage this behavior with [`disableAutostart`](/client/mdm-integration#disableAutostart). diff --git a/src/pages/manage/peers/ssh.mdx b/src/pages/manage/peers/ssh.mdx index ef7d50b9c..89da9ce07 100644 --- a/src/pages/manage/peers/ssh.mdx +++ b/src/pages/manage/peers/ssh.mdx @@ -69,12 +69,18 @@ On the machine you want to access via SSH, enable the NetBird SSH server. **Enable SSH Server**, **Enable Root Login** and the SSH authentication switch - require privileges. On Linux and macOS the desktop app runs as your own user, so - it cannot make these changes: it shows those switches as unavailable with the - equivalent command next to them, which you run in a terminal with `sudo`. On - Windows, either start the app as administrator or run the same command from an - elevated prompt. A switch that is already on stays operable, because turning - these settings off never requires privileges. + require privileges on every platform, because the background service runs as root + or LocalSystem while the desktop app runs as you. The app shows those switches as + unavailable and puts the equivalent command next to them, to run with `sudo` on + Linux and macOS or from an elevated prompt on Windows. + + On a machine where you do not have those rights, which is the normal case for a + managed workstation, you cannot enable the SSH server yourself: an administrator + has to run the command, or push + [`allowServerSSH`](/client/mdm-integration#policy-keys-reference) through MDM, + which the client applies itself and so needs nothing from you. A switch that is + already on stays operable, because turning these settings off never requires + privileges.

From 7751640c3d018fa5fc9efb98dfabbe0f50d5e9ce Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Thu, 30 Jul 2026 10:17:47 +0200 Subject: [PATCH 4/5] Say that only disabling SSH authentication is privileged --- src/pages/client/desktop-app.mdx | 6 +++--- src/pages/client/grpc-socket.mdx | 8 ++++---- src/pages/manage/peers/ssh.mdx | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/pages/client/desktop-app.mdx b/src/pages/client/desktop-app.mdx index 57e02e93b..1959f6a69 100644 --- a/src/pages/client/desktop-app.mdx +++ b/src/pages/client/desktop-app.mdx @@ -77,9 +77,9 @@ The settings page uses a tabbed layout that groups options by what they control.

- The switches that decide who may obtain a shell on the machine, **Enable SSH - Server**, **Enable Root Login** and SSH authentication, can only be changed by a - privileged caller, because the background service runs as root on Linux and macOS + The changes that decide who may obtain a shell on the machine, **Enable SSH + Server**, **Enable Root Login** and turning SSH authentication off, can only be + made by a privileged caller, because the background service runs as root on Linux and macOS and as LocalSystem on Windows while the app runs as you. The app shows those switches as unavailable and puts the equivalent command next to them: run it with `sudo` on Linux and macOS, or from an elevated prompt on Windows. Without those diff --git a/src/pages/client/grpc-socket.mdx b/src/pages/client/grpc-socket.mdx index 722fc9d3a..5f9624ea6 100644 --- a/src/pages/client/grpc-socket.mdx +++ b/src/pages/client/grpc-socket.mdx @@ -225,10 +225,10 @@ grpcurl \ ### Query Status Through a TCP Socket -For a custom loopback TCP listener. Note that `grpcurl` cannot dial a Windows named -pipe, so the Windows default is not reachable this way; use a client that can open -the pipe, or configure a TCP listener for testing and accept that [privileged -operations](#privileged-operations) are refused on it: +This applies to a custom loopback TCP listener, since `grpcurl` cannot dial a +Windows named pipe and the Windows default is therefore not reachable this way. Use +a client that can open the pipe, or configure a TCP listener for testing and accept +that [privileged operations](#privileged-operations) are refused on it: ```shell grpcurl \ diff --git a/src/pages/manage/peers/ssh.mdx b/src/pages/manage/peers/ssh.mdx index 89da9ce07..7d8fc996f 100644 --- a/src/pages/manage/peers/ssh.mdx +++ b/src/pages/manage/peers/ssh.mdx @@ -68,7 +68,7 @@ On the machine you want to access via SSH, enable the NetBird SSH server. 3. Toggle **Enable SSH Server**. Configure local forwarding, remote forwarding, SFTP, or root access only when required. - **Enable SSH Server**, **Enable Root Login** and the SSH authentication switch + **Enable SSH Server**, **Enable Root Login** and turning SSH authentication off require privileges on every platform, because the background service runs as root or LocalSystem while the desktop app runs as you. The app shows those switches as unavailable and puts the equivalent command next to them, to run with `sudo` on From 0d2cfd0417af263be0c4ab105c2f7bb5d6609c42 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Thu, 30 Jul 2026 12:18:27 +0200 Subject: [PATCH 5/5] Document the debug bundle upload privilege and https requirements --- src/pages/get-started/cli.mdx | 2 ++ src/pages/help/troubleshooting-client.mdx | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/src/pages/get-started/cli.mdx b/src/pages/get-started/cli.mdx index 405920d31..643479441 100644 --- a/src/pages/get-started/cli.mdx +++ b/src/pages/get-started/cli.mdx @@ -833,6 +833,7 @@ This will output: -S, --system-info Adds system information to the debug bundle (default true) -U, --upload-bundle Uploads the debug bundle to a server --upload-bundle-url string Service URL to get an upload URL for the debug bundle (default "https://upload.debug.netbird.io/upload-url") + --upload-bundle-insecure Allow uploading to an http or untrusted-TLS upload server (self-hosted); requires root ``` ### debug for @@ -872,6 +873,7 @@ Log level restored to INFO -S, --system-info Adds system information to the debug bundle (default true) -U, --upload-bundle Uploads the debug bundle to a server --upload-bundle-url string Service URL to get an upload URL for the debug bundle (default "https://upload.debug.netbird.io/upload-url") + --upload-bundle-insecure Allow uploading to an http or untrusted-TLS upload server (self-hosted); requires root ``` ### debug log diff --git a/src/pages/help/troubleshooting-client.mdx b/src/pages/help/troubleshooting-client.mdx index afa550b1c..52584f947 100644 --- a/src/pages/help/troubleshooting-client.mdx +++ b/src/pages/help/troubleshooting-client.mdx @@ -308,6 +308,11 @@ Upload file key: The flag `--anonymize` can be used to anonymize IP addresses and non-netbird.io domains in logs and status output when needed. + + + Uploading to a custom endpoint with `--upload-bundle-url` (for example a self-hosted upload server) requires root/administrator and an `https` URL. To upload to a server that uses `http` or an untrusted TLS certificate, add `--upload-bundle-insecure`. + + ### Debug bundle uploads with GUI The desktop app can create and optionally upload a debug bundle without using the CLI. Open **Settings → Troubleshoot**.