Help center

Audience: kommune or law-firm IT, plus your Northdocs org admin. Plan: Enterprise (or Trial) with the private_connectors entitlement. Goal: let Northdocs browse, import, and write back to systems that are not on the public internet, without opening inbound firewall ports to those systems.

Supported connectors: Danish ESDH (WorkZone, Nova, F2, cBrain, Acadre, SBSYS, GetOrganized), on-prem iManage and HighQ, private Datasite/API proxies, S3-compatible/MinIO, and webhook pull manifests. SharePoint and OneDrive stay on public Microsoft Graph only.

How it works: Northdocs self-hosts NetBird (open source) on OVH infrastructure (not NetBird Cloud). When you create a private link, Northdocs creates a setup key and mesh ACL so only the Northdocs gateway peers can reach your customer peer. Your network installs the NetBird agent (outbound only) on a VM or container that can reach the private API. Northdocs then fetches the private HTTPS API over the mesh. There is no public journal URL. Login credentials stay in Northdocs (encrypted). The mesh is transport only.

Before you create a private link: (1) Know the private target hostname or IP and port as seen from a host on your network (often :443). (2) Have a VM, container host, or Windows server that can resolve and TCP-connect to that target (same VLAN/VPN is fine). (3) Allow outbound HTTPS/UDP from that host to the Northdocs NetBird management endpoint (and STUN/TURN as required by NetBird). No inbound ports are required for the mesh. (4) Plan for two NetBird peers if you need HA (same setup key when the usage limit allows). (5) Have the usual ESDH/DMS integration account ready for the Connect page later (client id/secret or service user).

1. 1

   Create the private link

   Org admin → Integrations → Private links → Create private link. Enter a display name and the private target host. Leave Set up private connector now checked (recommended). Submit Create and set up. Northdocs provisions the setup key and ACL. If auto-setup is unavailable, submit a request and contact support@northdocs.com (staff can provision from Admin → Tenant → Private links). A requested, pending, or failed link can be deleted from the same page so you can start over.

2. 2

   Install the NetBird agent

   On the host that can reach the private target, install NetBird from https://docs.netbird.io/how-to/installation (Linux, Windows, macOS, or Docker). Then open Integrations → Private links → Install instructions and run the shown command: netbird up --management-url … --setup-key …. That registers the peer against Northdocs' self-hosted management URL (not NetBird Cloud). Prefer two peers for HA when allowed.

3. 3

   Health check and activate

   When the NetBird agent shows connected, click Health check on the private link. The first successful check activates the link and revokes the setup key so a leaked install command cannot join extra peers. Install every HA peer before that first successful health check. If the peer is not connected yet, finish step 2, confirm the agent is up, then retry. If you lost the setup key, use Refresh setup key and run the new install command.

4. 4

   Connect a connector

   Integrations → Connect on your ESDH/DMS → Network: Private link → select the active link → set the API/instance URL to the private hostname → connect with credentials. For S3/MinIO, Endpoint can be the private MinIO host (mesh-routed; SigV4 Host stays on that hostname). Use a sandbox case for write-back pilots.

What Northdocs provides: Self-hosted NetBird management; setup key and install command under Private links; mesh ACL limited to the Northdocs gateway; health check that activates the link. Northdocs does not permanently run the NetBird agent inside your LAN.

What you should not do: expose the full LAN through overly broad routes; share one setup key across unrelated organizations; put citizen production cases in a pilot write-back; rely on NTLM inside Northdocs (GetOrganized still needs Basic/Bearer at a proxy in front of the journal, which can be the same private host the agent reaches).

S3 / MinIO note: With a NetBird private link, Endpoint can be the private MinIO host. SigV4 signs the Host header against that hostname, and Northdocs does not rewrite Host on the mesh.

Security: Public connectors and webhooks still cannot call RFC1918 or metadata addresses. Only connectors that reference an active private link for your org may reach that link's allowlisted hosts over the mesh. Mesh ACLs limit which peers can talk. Disabling the link in admin is a kill switch. Org admins can delete requested, pending, or failed links (tears down unused NetBird resources). Active links stay staff deprovision. Audit events: connector.private_link.create, provision, delete, activate/disable (staff), health, plus normal connector.connect / import / writeback.

Limits: Mesh connectivity requires your peer to reach Northdocs management; no customer inbound firewall hole. Northdocs does not replace your ESDH vendor support or run your VM long-term.

See also: Danish ESDH connectors, ESDH write-back certification, Integrations troubleshooting. Contacts: sales@northdocs.com (commercial), security@northdocs.com (architecture review).