k3s init

modules/k3s/netbird/coturn.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: coturn
+  namespace: netbird
+spec:
+  selector:
+    matchLabels:
+      app: coturn
+  template:
+    metadata:
+      labels:
+        app: coturn
+    spec:
+      hostNetwork: true
+      containers:
+        - name: coturn
+          image: coturn/coturn
+          args:
+            - --log-file=stdout
+            - --external-ip=archfox.org
+            - --listening-port=3478
+            - --min-port=49152
+            - --max-port=65535
+            - --tls-listening-port=5349
+            - --no-tls
+            - --no-dtls
+            - --realm=netbird.archfox.org
+          securityContext:
+            capabilities:
+              add: ["NET_BIND_SERVICE"]

modules/k3s/netbird/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird-management
+  namespace: netbird
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`)
+      kind: Rule
+      services:
+        - name: management
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`)
+      kind: Rule
+      services:
+        - name: management
+          port: 80
+    - match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`)
+      kind: Rule
+      services:
+        - name: signal
+          port: 10000
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`)
+      kind: Rule
+      services:
+        - name: relay
+          port: 33073
+  tls:
+    certResolver: letsencrypt

modules/k3s/netbird/management.yaml

@@ -0,0 +1,62 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: management
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: management
+  template:
+    metadata:
+      labels:
+        app: management
+    spec:
+      containers:
+        - name: management
+          image: netbirdio/management:latest
+          args:
+            - --port=80
+            - --log-file=stdout
+            - --log-level=info
+            - --disable-anonymous-metrics=false
+            - --single-account-mode-domain=netbird.archfox.org
+            - --dns-domain=netbird.archfox.org
+          env:
+            - name: NETBIRD_STORE_ENGINE
+              value: "sqlite"
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: mgmt-data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: mgmt-data
+          persistentVolumeClaim:
+            claimName: mgmt-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mgmt-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: management
+  namespace: netbird
+spec:
+  selector:
+    app: management
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

modules/k3s/netbird/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird

modules/k3s/netbird/relay.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: relay
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: relay
+  template:
+    metadata:
+      labels:
+        app: relay
+    spec:
+      containers:
+        - name: relay
+          image: netbirdio/relay:latest
+          env:
+            - name: NB_LOG_LEVEL
+              value: "info"
+            - name: NB_LISTEN_ADDRESS
+              value: ":33073"
+            - name: NB_EXPOSED_ADDRESS
+              value: "rels://netbird.archfox.org:443/relay"
+            - name: NB_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-secrets
+                  key: relay-auth-secret
+          ports:
+            - containerPort: 33073
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: relay
+  namespace: netbird
+spec:
+  selector:
+    app: relay
+  ports:
+    - name: relay
+      port: 33073
+      targetPort: 33073

modules/k3s/netbird/secrets.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: netbird-secrets
+  namespace: netbird
+type: Opaque
+stringData:
+  # Generate with: openssl rand -base64 32
+  relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32"

modules/k3s/netbird/signal.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: signal
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: signal
+  template:
+    metadata:
+      labels:
+        app: signal
+    spec:
+      containers:
+        - name: signal
+          image: netbirdio/signal:latest
+          env:
+            - name: COALESCE_INTERVAL
+              value: "5s"
+          ports:
+            - containerPort: 10000
+          volumeMounts:
+            - name: signal-data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: signal-data
+          persistentVolumeClaim:
+            claimName: signal-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: signal-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: signal
+  namespace: netbird
+spec:
+  selector:
+    app: signal
+  ports:
+    - name: grpc
+      port: 10000
+      targetPort: 10000