netbird: fresh setup routed through built-in traefik, secrets via kubectl not git

modules/k3s/k3s.nix

@@ -1,9 +1,17 @@
 {
-  networking.firewall.allowedTCPPorts = [ 6443 80 443 ];
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedUDPPorts = [ 3479 ];
 
   services.k3s = {
     enable = true;
     role = "server";
     extraFlags = "--write-kubeconfig-mode 644";
+    manifests = {
+      netbird-namespace = { source = ./netbird/namespace.yaml; };
+      netbird-config    = { source = ./netbird/config.yaml; };
+      netbird-server    = { source = ./netbird/server.yaml; };
+      netbird-dashboard = { source = ./netbird/dashboard.yaml; };
+      netbird-ingress   = { source = ./netbird/ingress.yaml; };
+    };
   };
 }

modules/k3s/netbird/config.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml.tpl: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      stunPorts:
+        - 3479
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "__AUTH_SECRET__"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: "__STORE_ENCRYPTION_KEY__"
+      reverseProxy:
+        trustedHTTPProxies:
+          - "10.0.1.45/32"

modules/k3s/netbird/dashboard.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

modules/k3s/netbird/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+    - match: Host(`netbird.archfox.org`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: dashboard
+          port: 80

modules/k3s/netbird/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird

modules/k3s/netbird/server.yaml

@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      initContainers:
+        - name: render-config
+          image: busybox
+          env:
+            - name: AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-relay-auth
+                  key: authSecret
+            - name: STORE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-encryption
+                  key: encryptionKey
+          command:
+            - sh
+            - -c
+            - |
+              sed -e "s|__AUTH_SECRET__|$AUTH_SECRET|g" \
+                  -e "s|__STORE_ENCRYPTION_KEY__|$STORE_KEY|g" \
+                  /tpl/config.yaml.tpl > /etc/netbird/config.yaml
+          volumeMounts:
+            - name: config-tpl
+              mountPath: /tpl
+            - name: config-rendered
+              mountPath: /etc/netbird
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3479
+              protocol: UDP
+            - containerPort: 33073
+          volumeMounts:
+            - name: config-rendered
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config-tpl
+          configMap:
+            name: netbird-server-config
+        - name: config-rendered
+          emptyDir: {}
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3479
+      targetPort: 3479
+      protocol: UDP