NetBird Registration hyphae

Operator portal — mint SM registration tokens paired with one-off NetBird setup keys, and check which fleet units are on the mesh. Reachable from home and the NetBird mesh only.

SM API token

Bearer token (same as the hyphae CLI credentials — kept in this browser only)

New registration pair

Creates one SM registration token and one SM-tracked one-off NetBird setup key. The pair goes into the unit's /etc/hyphae/seed.conf; the unit joins the mesh and self-registers on first boot.

Token lifetime (hours)

Max registrations per token

SM token: —
Token expires: —
NetBird VPN key: —
VPN key expires: —
SM key id: —

Seed file for the unit (/etc/hyphae/seed.conf, 0600 root:root)

The VPN key is one-off: it is consumed on the first mesh join. Reboots and re-joins afterwards use plain netbird up and do not consume the key again. Don't re-run the setup-key join on an already-joined unit.

Join your device

For a personal device (laptop, phone): your platform is detected automatically and the other platforms are folded below. The setup key is one-off: if it was already consumed, generate a fresh pair above — the commands below update automatically. Fleet units keep using the seed.conf / hyphae node register flow above.

Setup keys are one-off and expire (the real expiry is shown after generating a pair) — generate a pair, then join your new device before the key expires.

Registration tokens

Fleet — mesh status

Offsite runbook

Generate a pair above (or run hyphae node register on the SM host — same endpoint).

Write the seed file on the unit:

DOMAIN=hyphae.mesh.berrion.garden
VPN_CLIENT_KEY=<vpn key>
REGISTRATION_TOKEN=***

Boot the unit. The node manager joins NetBird with the VPN key, gets a 100.64.0.0/10 mesh IP, and registers with the SM over the mesh. The seed file is burned after successful registration.
From then on the unit reaches every domain-hosted route from any network — the Caddy edge allows the mesh range (100.64.0.0/10) on all agent sites. Units not on the mesh get 403 offsite; no edge configuration changes that.