Networks and devices

Everything in Nardeboon belongs to an organisation. An organisation has members and one or more networks, and every device belongs to exactly one network.

Members and roles

Invite people to your organisation and give each member a role: Owner, Admin, Network admin, Billing admin, Auditor or Member.

Owner, Admin and Member are on every plan. Network admin, Billing admin and Auditor come with the Team and Business plans. If your plan stops including them, whoever has one keeps it but acts as a Member until the plan includes it again.

Members sign in with an email and password (with email verification), or with Google, GitHub or Microsoft. They can add MFA with an authenticator app (TOTP) or a passkey, and get recovery codes as a fallback.

Every important action is recorded in the audit log.

Devices

A device joins a network through a browser login (sudo nardeboon up prints the URL) or with an auth key. It then gets an address from the network's IP range, and a name.

Admins can manage each device:

Approval

With device approval on, a new device waits until an admin approves it. User approval does the same for new users. Subnet routes and exit nodes always need an admin's approval; see Subnet routes and Exit nodes.

Key expiry

Device keys can expire. When a device's key has expired, or an admin asks it to re-authenticate, sign in again on the device:

sudo nardeboon login

The CLI reports an expired key with exit code 4 (auth).

Revocation

Revoking a device takes effect immediately. Revocations are signed and peers pass them on to each other, so they also reach devices that can't contact the control plane at the moment. See Resilience.

Auth keys

Auth keys add devices without a browser login, which suits servers and automation:

sudo nardeboon up --auth-key "$NB_AUTH_KEY"

Treat auth keys like passwords: keep them out of shell history and source control.

IP ranges

Each network has its own IP range (10.100.0.0/16 unless you choose another), and every device in it gets an address from that range. On Team and Business you can move a network to another private range without downtime, in the network's settings:

1. Start the move. Every device gets a second address in the new range. Its old address and its name keep working.
2. Move what uses the old addresses, such as firewall rules or configuration files, and check it works.
3. Finish. The old addresses stop working, and names resolve to the new ones.

Until you finish, Roll back drops the new addresses and leaves the network as it was. A device already inside the new range keeps its address, so narrowing the range only moves the devices outside it.

Device names

Every device gets a name automatically, so you rarely need its IP address. Both the short name and the full name work:

ping mypc
ssh mypc.home.nb.internal

Choose the name when the device joins, with sudo nardeboon up --hostname mypc, or rename it later. nardeboon whois 100.101.12.4 tells you which device an address or name belongs to. To send chosen domains to chosen nameservers, use split DNS; see DNS.