Skip to content

Document the remote-jobs opt-in and MDM keys #914

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mlsmaycon wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Document the remote-jobs opt-in and MDM keys #914

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/pages/client/mdm-integration.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,8 @@ PascalCase variant in the Group Policy Editor — both are recognized.
| `preSharedKey` | string | WireGuard pre-shared key. Treated as secret and redacted in logs. |
| `wireguardPort` | integer | UDP port the local WireGuard interface binds to. Range `1–65535`. |
| `allowServerSSH` | boolean | Allow the embedded NetBird SSH server on this peer. |
| `allowRemoteJobs` | boolean | Allow management-requested remote jobs (e.g. debug bundles) on this peer. Off by default; equivalent to `--allow-remote-jobs`. |
| `debugBundleUploadURL` | string | Override the upload service used for debug bundles produced by remote jobs, taking precedence over the value requested by Management. Must be an `https` URL with a host. |
Comment on lines +73 to +74

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Update the policy count.

The preceding text at Line 63 says that the reference contains 16 keys, but the table now contains 20 rows, including these two new keys. Remove the hard-coded count or update it so administrators are not given incorrect documentation.

Proposed fix 
-The same 16 keys apply on every platform.
+The same policy keys apply across platform payloads.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/pages/client/mdm-integration.mdx` around lines 73 - 74, Update the
policy-key count in the surrounding documentation to match the table’s 20 rows,
or remove the hard-coded count so it cannot become stale. Keep the descriptions
for allowRemoteJobs and debugBundleUploadURL unchanged.

| `disableAutoConnect` | boolean | Skip auto-connecting on startup; require an explicit `netbird up`. |
| <span id="disableAutostart"></span>`disableAutostart` | boolean | Prevent the GUI from registering itself as an OS autostart entry on fresh installs, and — when enabled at any later point — remove an existing registration on the next GUI launch (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`). Desktop GUIs only; no-op on iOS/Android. Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings. |
| `lazyConnection` | boolean | Local override for lazy connections. `true` forces lazy connections on, `false` forces them off, and an absent key defers to the Management setting. `NB_LAZY_CONN` takes precedence when both are configured. |
Expand Down
9 changes: 8 additions & 1 deletion src/pages/manage/peers/remote-jobs.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@ Remote Jobs allow administrators to trigger actions on connected peers without r
Remote Jobs require the target peer to be **online** and running **NetBird v0.64.0 or later**.
</Note>

<Note>
Remote Jobs are **opt-in on the peer** and disabled by default. A peer accepts remote jobs only when started with `--allow-remote-jobs`, or when the `allowRemoteJobs` [MDM policy](/client/mdm-integration) is set. Enabling it is a privileged operation on the client (like enabling the embedded SSH server). Peers that have not opted in report this to Management, and the Dashboard disables the **Run Remote Job** button for them.
</Note>
Comment on lines +11 to +13

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

State that the MDM policy must be true.

allowRemoteJobs is a boolean policy. “The policy is set” can be read as “the key is present,” including allowRemoteJobs: false. State that the policy must be set to true in both opt-in descriptions.

Proposed fix 
-    ... when the `allowRemoteJobs` MDM policy is set.
+    ... when `allowRemoteJobs` is set to `true` in the MDM policy.
...
-- The target peer must have **opted into remote jobs** (`--allow-remote-jobs` or the `allowRemoteJobs` MDM policy)
+- The target peer must have **opted into remote jobs** (`--allow-remote-jobs` or `allowRemoteJobs: true` in the MDM policy)

Also applies to: 146-146

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/pages/manage/peers/remote-jobs.mdx` around lines 11 - 13, Update both
opt-in descriptions in the Note to explicitly state that the allowRemoteJobs MDM
policy must be set to true, not merely present, while preserving the existing
--allow-remote-jobs option wording.


## Overview

Remote Jobs are managed per-peer and follow a simple lifecycle:
Expand Down Expand Up @@ -57,6 +61,8 @@ The Debug Bundle job remotely collects diagnostic information from a peer, inclu
| Log File Count | Number of log files to include | 1 - 1000 | 10 |
| Bundle Duration | Time period to collect logs before creating the bundle | 1 - 5 minutes | Disabled |
| Anonymize | Remove sensitive information (IP addresses, domains, etc.) | On / Off | Off |
| Anonymization Level | With Anonymize on, `default` keeps internal (private) IP ranges readable; `strict` also anonymizes private, CGNAT and link-local addresses | `default` / `strict` | `default` |
| Upload URL | Upload service the peer requests an upload URL from (must be an `https` URL). A peer with the `debugBundleUploadURL` [MDM policy](/client/mdm-integration) set overrides this value | https URL | Default upload server |

**Result:**

Expand All @@ -81,7 +87,7 @@ On success, the job returns an **upload key** that can be used to retrieve the d
</p>

<Note>
The **Run Remote Job** button is disabled when the peer is offline or when you lack the required permissions.
The **Run Remote Job** button is disabled when the peer is offline, when the peer has not opted into remote jobs, or when you lack the required permissions.
</Note>

### Viewing Job History
Expand Down Expand Up @@ -137,6 +143,7 @@ curl https://api.netbird.io/api/peers/{peerId}/jobs/{jobId} \
## Limitations

- The target peer must be **online and connected** to the management server
- The target peer must have **opted into remote jobs** (`--allow-remote-jobs` or the `allowRemoteJobs` MDM policy)
- Only **one pending job** per peer at a time
- Peers must be running **NetBird v0.64.0 or later**
- Jobs time out after **5 minutes** if the peer does not respond
Expand Down
Loading