NetBird Registration hyphae

Operator portal — mint SM registration tokens paired with one-off NetBird setup keys, and check which fleet units are on the mesh. Reachable from home and the NetBird mesh only.

SM API token

Bearer token (same as the hyphae CLI credentials — kept in this browser only)

New registration pair

Creates one SM registration token and one SM-tracked one-off NetBird setup key. The pair goes into the unit's /etc/hyphae/seed.conf; the unit joins the mesh and self-registers on first boot.

Token lifetime (hours)

Max registrations per token

SM token: —
Token expires: —
NetBird VPN key: —
VPN key expires: —
SM key id: —

Seed file for the unit (/etc/hyphae/seed.conf, 0600 root:root)

The VPN key is one-off: it is consumed on the first mesh join. Reboots and re-joins afterwards use plain netbird up and do not consume the key again. Don't re-run the setup-key join on an already-joined unit.

Registration tokens

Fleet — mesh status

Offsite runbook

Generate a pair above (or run hyphae node register on the SM host — same endpoint).

Write the seed file on the unit:

DOMAIN=hyphae.mesh.berrion.garden
VPN_CLIENT_KEY=<vpn key>
REGISTRATION_TOKEN=***

Boot the unit. The node manager joins NetBird with the VPN key, gets a 100.64.0.0/10 mesh IP, and registers with the SM over the mesh. The seed file is burned after successful registration.
From then on the unit reaches every domain-hosted route from any network — the Caddy edge allows the mesh range (100.64.0.0/10) on all agent sites. Units not on the mesh get 403 offsite; no edge configuration changes that.