Install on Linux

Nardeboon for Linux runs as a systemd service, nardeboond, which you control with the nardeboon CLI. It supports amd64 and arm64 and ships as .deb and .rpm packages. Windows has its own installer; macOS, Android and iOS come later.

Install

The install script is the quickest way:

curl -fsSL https://nardeboon.io/install.sh | sh

To add the package repository yourself, use the commands for your distribution.

Debian and Ubuntu

curl -fsSL https://pkgs.nardeboon.io/nardeboon.gpg | sudo tee /usr/share/keyrings/nardeboon.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/nardeboon.gpg] https://pkgs.nardeboon.io/deb stable main" | sudo tee /etc/apt/sources.list.d/nardeboon.list
sudo apt update && sudo apt install nardeboon

Fedora and RHEL

sudo dnf config-manager addrepo --from-repofile=https://pkgs.nardeboon.io/rpm/nardeboon.repo
sudo dnf install nardeboon

On systems with dnf 4, add the repository with sudo dnf config-manager --add-repo https://pkgs.nardeboon.io/rpm/nardeboon.repo instead.

Join your network

To join with a login URL, run:

sudo nardeboon up

up prints a login URL. Open it in a browser and sign in, and the device joins your network.

On servers and in scripts, join with an auth key instead. Create one in the dashboard, then pass it to up:

sudo nardeboon up --auth-key "$NB_AUTH_KEY"

Networks and devices explains which kind of key to use.

Check the connection with nardeboon status. Running up again changes only the flags you pass. For example, this sets the device's name and leaves everything else as it was:

sudo nardeboon up --hostname web-1

sudo nardeboon down disconnects but leaves the daemon running. sudo nardeboon logout logs the device out and removes its key.

Where Nardeboon's servers are blocked

Some networks cut every connection to Nardeboon's servers, as some datacenters in Iran do. A device already in your network keeps working there, and reaches Nardeboon through its peers. A new device can get in through one of your network's own relays:

1. On a device whose connection is open, for example a server in another datacenter, turn on Also use this node as a relay in the dashboard.
2. Once it's online, create the auth key. The key then also carries that relay's address.
3. Join the new device with the key, as above. If it can't reach Nardeboon's servers, it gets in through the relay, which passes the connection on without being able to read it.

If the device can't download Nardeboon either, install it from a copy: in the dashboard, Add device → The device can't reach the internet? lists the latest release's packages. Download the one for the device, copy it over, and install it:

sudo dpkg -i nardeboon_*.deb   # Debian, Ubuntu
sudo rpm -i nardeboon-*.rpm    # Fedora, RHEL

Its updates then come from its peers, your network's own relays first, as Updates below explains.

A login URL needs the dashboard, so where it's blocked, join with an auth key.

Manage the service

To pass extra flags to the daemon, add them to FLAGS in /etc/default/nardeboond and restart the service. A device's own settings, such as its name or the routes it uses, are changed with nardeboon set <setting> <value>; see the CLI reference.

Where things live

For example, to see the device's address in your network:

ip addr show nardeboon0

Use the CLI without sudo

The CLI talks to the daemon through its control socket, which only root and members of the nardeboon group can use. To drop sudo, add yourself to the group, then log out and back in:

sudo usermod -aG nardeboon "$USER"

A command run without the right permission exits with code 7 (permission).

Updates

Nodes update automatically, and every update is signed. A node installs only versions with a valid signature, and never an older version than the one it runs. If the signature or integrity check fails, nardeboon update exits with code 9 (verify).

A node installs a new release at a random time within a couple of hours of it coming out, so a network's devices don't all restart at once, and the same way it was installed: the release's signed package, or, for a bare binary, its own files replaced. Its connections come back on their own once the new version starts.

Where Nardeboon's servers are blocked, a node gets the release from its peers instead, your network's own relays first: they keep each new release for the devices that can't fetch it. The node checks what it gets against the same signature, so a peer can't give it anything else.

Admins, and a device's owner, can also start an update from the device's page in the dashboard. That only asks the node to install the latest signed release on its channel; it can never run arbitrary commands on the device.

To turn automatic updates off on one device, run sudo nardeboon set auto-update off; for a whole network, turn off Automatic updates in its settings. Either way, sudo nardeboon update apply still installs a release when you choose. Devices follow the stable channel; sudo nardeboon update channel beta gets new releases sooner.

Uninstall

1. Log out

   This logs the device out and removes its key:

   sudo nardeboon logout

2. Remove the package

   On Debian and Ubuntu:

   sudo apt remove nardeboon

   On Fedora and RHEL:

   sudo dnf remove nardeboon

3. Delete state and repository (optional)

   Removing the package keeps the node's state, so installing it again brings the same device back. To delete the state too, purge the package on Debian and Ubuntu (sudo apt purge nardeboon), or delete it yourself:

   sudo rm -rf /var/lib/nardeboon

   On Debian and Ubuntu, also remove the repository and its key:

   sudo rm /etc/apt/sources.list.d/nardeboon.list /usr/share/keyrings/nardeboon.gpg

   On Fedora and RHEL, delete the Nardeboon .repo file in /etc/yum.repos.d/.