ssiroos/netsmartapp repository overview

⁠NetSmartApp

Run DNS, DHCP, NTP, LDAP directory, Kerberos, mail, WireGuard, and external monitoring from one web administration panel.

NetSmartApp is an ASP.NET Core network-services appliance backed by MySQL. Individual services can be configured and started or stopped from the browser, and their desired state persists across container restarts.

⁠Learn more

NetSmartApp page on PWAApps:

https://pwaapps.com/smartnetwork/⁠

Feature article:

https://pwaapps.com/blog/netsmartapp-network-services-in-one-docker-package-for-teams-and-developers/⁠

Video tutorial:

https://pwaapps.com/blog/netsmartapp-tutorial-2026-dns-dhcp-ldap-mail-wireguard-vpn/⁠

⁠Image

docker pull ssiroos/netsmartapp:1.0.7

The floating tag is also available:

docker pull ssiroos/netsmartapp:latest

Use the versioned tag for predictable production deployments.

⁠Simple Docker Compose

Create docker-compose.yml with the following minimal stack. It starts NetSmartApp and MySQL, publishes the web panel and SNMP, and persists database and application security keys.

services:
  mysql:
    image: mysql:8.4
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: change-this-root-password
      MYSQL_DATABASE: netsmart_db
      MYSQL_USER: netsmart_user
      MYSQL_PASSWORD: change-this-database-password
    volumes:
      - mysql_data:/var/lib/mysql
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u$$MYSQL_USER -p$$MYSQL_PASSWORD"]
      interval: 10s
      timeout: 5s
      retries: 12

  netsmart:
    image: ssiroos/netsmartapp:1.0.7
    restart: unless-stopped
    depends_on:
      mysql:
        condition: service_healthy
    environment:
      ASPNETCORE_URLS: http://+:8080
      ConnectionStrings__DefaultConnection: Server=mysql;Port=3306;Database=netsmart_db;User ID=netsmart_user;Password=change-this-database-password;AllowUserVariables=true
      Monitoring__SnmpCommunity: change-this-community
    ports:
      - "8080:8080"
      - "161:161/udp"
    volumes:
      - app_logs:/app/logs
      - data_protection_keys:/app/data-protection-keys
      - wireguard_config:/app/wireguard

volumes:
  mysql_data:
  app_logs:
  data_protection_keys:
  wireguard_config:

Change all example passwords and the SNMP community, then start the stack:

docker compose up -d
docker compose ps

Open http://localhost:8080. The Prometheus endpoint uses the same published HTTP port at http://localhost:8080/metrics after it is enabled in the web UI. Add only the network-service ports you plan to use; the full repository Compose files include the host-network configuration required for infrastructure deployment on Linux.

⁠Included services

• DNS server with managed records, forwarding, cache, and query logs
• DHCP gateway with address pools, leases, gateway, and DNS options
• NTP server with ordered upstream failover
• Lightweight LDAP v3 directory with users, organizational units, policies, and AD-aware searches
• Kerberos v5 KDC with managed user and service principals
• SMTP, submission, SMTPS, POP3, and IMAP mail services with multiple domains, TLS, and DKIM support
• WireGuard VPN with peer management, NAT, live status, and downloadable client configurations
• Prometheus-compatible /metrics endpoint
• Read-only SNMP v2c agent
• Health dashboard and consolidated service logs
• Optional CAPTCHA, email MFA, and authenticator-app MFA for administrator login
• Optional local assistant using Ollama or another compatible model provider

⁠Quick start on Linux

The repository Compose deployment uses host networking because DNS, DHCP, NTP, Kerberos, WireGuard, and other infrastructure protocols need direct access to the host network.

cp .env.example .env
docker compose up -d
docker compose ps

Open:

http://localhost:8080

Initial administrator account:

Username: sa
Password: sa123456

Change the administrator password immediately after the first sign-in. Replace the example MySQL passwords in .env before deployment.

⁠Docker Desktop on Windows

Docker Desktop cannot provide the same LAN-facing host-network behavior as a native Linux host. Use the included bridge-network override for local evaluation:

docker compose -f docker-compose.yml -f docker-compose.windows.yml up -d

With NETSMART_HTTP_PORT=8888, open:

http://localhost:8888

Published TCP and UDP ports work for direct requests, but DHCP broadcast delivery, WireGuard routing, and a practical Active Directory Domain Controller should be deployed on a Linux host or VM.

⁠Ports

Only allow the services that you enable through the host and cloud firewalls.

⁠External monitoring

Administrators can independently enable or disable both monitoring interfaces from Monitoring in the web UI.

When enabled, Prometheus can scrape:

http://HOST:8080/metrics

The endpoint exposes process uptime and memory, request and scrape counters, and managed-service availability in Prometheus text format 0.0.4. It returns HTTP 404 while disabled.

The SNMP v2c agent listens on UDP 161 and exposes the standard SNMPv2-MIB::system scalar group. Set a private community before enabling it:

SNMP_COMMUNITY=replace-with-a-private-community
SNMP_CONTACT=Network Operations
SNMP_LOCATION=Server Room

Restrict both monitoring interfaces to trusted monitoring networks.

⁠Configuration

ASP.NET Core configuration uses double underscores in environment-variable names. Common settings include:

ConnectionStrings__DefaultConnection
DefaultAdmin__Username
DefaultAdmin__Password
DnsServer__AutoStart
DirectoryService__AutoStart
MailService__AutoStart
DhcpService__AutoStart
NtpService__AutoStart
KerberosService__AutoStart
KerberosService__Realm
Monitoring__MetricsAutoStart
Monitoring__SnmpAutoStart
Monitoring__SnmpPort
Monitoring__SnmpCommunity
WireGuard__Enabled
WireGuard__EndpointHost
Assistant__Provider
Assistant__Endpoint
Assistant__Model
Assistant__ApiKey

Service start/stop choices made in the web UI are stored in MySQL and override the initial AutoStart defaults on subsequent starts.

⁠Persistent data

The supplied Compose stack persists:

• MySQL application data in ./mysql_data
• Service logs in netsmart_app_logs
• ASP.NET authentication and antiforgery keys in netsmart_data_protection_keys
• WireGuard configuration in netsmart_wireguard_config
• Ollama models in netsmart_ollama_data
• Mounted TLS certificates and DKIM keys under /app/certs

Back up the database, data-protection keys, WireGuard configuration, certificates, and any optional Samba AD volumes together. Data-protection keys are required to decrypt protected application secrets after restoration.

⁠Directory and Active Directory modes

The built-in Directory service is a lightweight LDAP v3 server for application authentication and directory searches. It is not a Windows domain controller.

For Windows domain join and a unified identity store across Kerberos, LDAP, DNS, SMB/RPC, and Global Catalog, use the optional Samba AD profile on a Linux host:

docker compose -f docker-compose.yml -f docker-compose.ad.yml --profile ad-domain up -d --build

Set SAMBA_REALM, SAMBA_DOMAIN, SAMBA_HOSTNAME, and a strong SAMBA_ADMIN_PASSWORD in .env first. Stop the built-in DNS, Directory, and Kerberos listeners before starting Samba because they use overlapping ports.

⁠Operational notes

• Put the administration panel behind HTTPS or a trusted reverse proxy.
• Do not expose MySQL to untrusted networks.
• Change the default administrator password and SNMP community.
• DHCP requires LAN broadcast reachability; native Linux host networking or macvlan is recommended.
• WireGuard requires NET_ADMIN, IP forwarding, NAT for full-tunnel clients, and an inbound UDP firewall rule.
• Kerberos and Active Directory require accurate client and server time; enable NTP or another reliable time source.
• Host ports below 1024 can conflict with existing DNS, mail, LDAP, NTP, Kerberos, or SNMP services.
• The embedded Kerberos service uses its own principals. Use Samba AD when Kerberos and LDAP must share one Windows-compatible identity database.

⁠Update

docker compose pull
docker compose up -d --force-recreate
docker compose ps

Review logs when troubleshooting:

docker compose logs --tail=200 netsmart

⁠More information

• Product page: https://pwaapps.com/smartnetwork/index.html⁠
• Feature article: https://pwaapps.com/blog/netsmartapp-network-services-in-one-docker-package-for-teams-and-developers/⁠
• Full deployment guide: docs/DOCKER_DEPLOYMENT.md
• Active Directory guide: docs/AD_DOMAIN_SERVICES.md
• Monitoring guide: docs/EXTERNAL_MONITORING.md