diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix index 6c86640..1bca8d4 100644 --- a/modules/k3s/k3s.nix +++ b/modules/k3s/k3s.nix @@ -1,13 +1,11 @@ { - networking.firewall.allowedTCPPorts = [ 6443 80 443 10000 33073 ]; + networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ]; networking.firewall.allowedUDPPorts = [ 3478 ]; - networking.firewall.allowedUDPPortRanges = [ - { from = 49152; to = 65535; } - ]; services.k3s = { enable = true; role = "server"; + extraFlags = "--write-kubeconfig-mode 644"; manifests = { traefik-namespace = { source = ./traefik/namespace.yaml; }; traefik-rbac = { source = ./traefik/rbac.yaml; }; @@ -15,11 +13,9 @@ traefik-deployment = { source = ./traefik/deployment.yaml; }; traefik-service = { source = ./traefik/service.yaml; }; netbird-namespace = { source = ./netbird/namespace.yaml; }; - netbird-secrets = { source = ./netbird/secrets.yaml; }; - netbird-coturn = { source = ./netbird/coturn.yaml; }; - netbird-signal = { source = ./netbird/signal.yaml; }; - netbird-management = { source = ./netbird/management.yaml; }; - netbird-relay = { source = ./netbird/relay.yaml; }; + netbird-config = { source = ./netbird/config.yaml; }; + netbird-server = { source = ./netbird/server.yaml; }; + netbird-dashboard = { source = ./netbird/dashboard.yaml; }; netbird-ingress = { source = ./netbird/ingress.yaml; }; }; }; diff --git a/modules/k3s/netbird/config.yaml b/modules/k3s/netbird/config.yaml new file mode 100644 index 0000000..65edc3c --- /dev/null +++ b/modules/k3s/netbird/config.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: netbird-server-config + namespace: netbird +data: + config.yaml: | + server: + listenAddress: ":80" + exposedAddress: "https://netbird.archfox.org:443" + metricsPort: 9090 + healthcheckAddress: ":9000" + logLevel: "info" + logFile: "console" + tls: + certFile: "" + keyFile: "" + letsencrypt: + enabled: false + dataDir: "" + domains: [] + email: "" + awsRoute53: false + authSecret: "CHANGE_ME_openssl_rand_-hex_32" + dataDir: "/var/lib/netbird/" + disableAnonymousMetrics: false + disableGeoliteUpdate: false + auth: + issuer: "https://netbird.archfox.org/oauth2" + localAuthDisabled: false + signKeyRefreshEnabled: true + dashboardRedirectURIs: + - "https://netbird.archfox.org/nb-auth" + - "https://netbird.archfox.org/nb-silent-auth" + cliRedirectURIs: + - "http://localhost:53000/" + store: + engine: "sqlite" + dsn: "" + encryptionKey: "" diff --git a/modules/k3s/netbird/coturn.yaml b/modules/k3s/netbird/coturn.yaml deleted file mode 100644 index fa1ae0f..0000000 --- a/modules/k3s/netbird/coturn.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: coturn - namespace: netbird -spec: - selector: - matchLabels: - app: coturn - template: - metadata: - labels: - app: coturn - spec: - hostNetwork: true - containers: - - name: coturn - image: coturn/coturn - args: - - --log-file=stdout - - --external-ip=archfox.org - - --listening-port=3478 - - --min-port=49152 - - --max-port=65535 - - --tls-listening-port=5349 - - --no-tls - - --no-dtls - - --realm=netbird.archfox.org - securityContext: - capabilities: - add: ["NET_BIND_SERVICE"] diff --git a/modules/k3s/netbird/dashboard.yaml b/modules/k3s/netbird/dashboard.yaml new file mode 100644 index 0000000..3766dfa --- /dev/null +++ b/modules/k3s/netbird/dashboard.yaml @@ -0,0 +1,56 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: dashboard + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: dashboard + template: + metadata: + labels: + app: dashboard + spec: + containers: + - name: dashboard + image: netbirdio/dashboard:latest + ports: + - containerPort: 80 + env: + - name: NETBIRD_MGMT_API_ENDPOINT + value: "https://netbird.archfox.org" + - name: NETBIRD_MGMT_GRPC_API_ENDPOINT + value: "https://netbird.archfox.org" + - name: AUTH_AUDIENCE + value: "netbird-dashboard" + - name: AUTH_CLIENT_ID + value: "netbird-dashboard" + - name: AUTH_CLIENT_SECRET + value: "" + - name: AUTH_AUTHORITY + value: "https://netbird.archfox.org/oauth2" + - name: USE_AUTH0 + value: "false" + - name: AUTH_SUPPORTED_SCOPES + value: "openid profile email groups" + - name: AUTH_REDIRECT_URI + value: "/nb-auth" + - name: AUTH_SILENT_REDIRECT_URI + value: "/nb-silent-auth" + - name: LETSENCRYPT_DOMAIN + value: "none" +--- +apiVersion: v1 +kind: Service +metadata: + name: dashboard + namespace: netbird +spec: + selector: + app: dashboard + ports: + - name: http + port: 80 + targetPort: 80 diff --git a/modules/k3s/netbird/ingress.yaml b/modules/k3s/netbird/ingress.yaml index 2f007a4..213a035 100644 --- a/modules/k3s/netbird/ingress.yaml +++ b/modules/k3s/netbird/ingress.yaml @@ -1,33 +1,28 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: netbird-management + name: netbird namespace: netbird spec: entryPoints: - websecure routes: - - match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`) + - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`)) kind: Rule services: - - name: management + - name: netbird-server port: 80 scheme: h2c - - match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`) + - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`)) kind: Rule services: - - name: management + - name: netbird-server port: 80 - - match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`) + - match: Host(`netbird.archfox.org`) kind: Rule + priority: 1 services: - - name: signal - port: 10000 - scheme: h2c - - match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`) - kind: Rule - services: - - name: relay - port: 33073 + - name: dashboard + port: 80 tls: certResolver: letsencrypt diff --git a/modules/k3s/netbird/management.yaml b/modules/k3s/netbird/management.yaml deleted file mode 100644 index be1617f..0000000 --- a/modules/k3s/netbird/management.yaml +++ /dev/null @@ -1,62 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: management - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: management - template: - metadata: - labels: - app: management - spec: - containers: - - name: management - image: netbirdio/management:latest - args: - - --port=80 - - --log-file=stdout - - --log-level=info - - --disable-anonymous-metrics=false - - --single-account-mode-domain=netbird.archfox.org - - --dns-domain=netbird.archfox.org - env: - - name: NETBIRD_STORE_ENGINE - value: "sqlite" - ports: - - containerPort: 80 - volumeMounts: - - name: mgmt-data - mountPath: /var/lib/netbird - volumes: - - name: mgmt-data - persistentVolumeClaim: - claimName: mgmt-data ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: mgmt-data - namespace: netbird -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 2Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: management - namespace: netbird -spec: - selector: - app: management - ports: - - name: http - port: 80 - targetPort: 80 diff --git a/modules/k3s/netbird/relay.yaml b/modules/k3s/netbird/relay.yaml deleted file mode 100644 index ad8f51c..0000000 --- a/modules/k3s/netbird/relay.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: relay - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: relay - template: - metadata: - labels: - app: relay - spec: - containers: - - name: relay - image: netbirdio/relay:latest - env: - - name: NB_LOG_LEVEL - value: "info" - - name: NB_LISTEN_ADDRESS - value: ":33073" - - name: NB_EXPOSED_ADDRESS - value: "rels://netbird.archfox.org:443/relay" - - name: NB_AUTH_SECRET - valueFrom: - secretKeyRef: - name: netbird-secrets - key: relay-auth-secret - ports: - - containerPort: 33073 ---- -apiVersion: v1 -kind: Service -metadata: - name: relay - namespace: netbird -spec: - selector: - app: relay - ports: - - name: relay - port: 33073 - targetPort: 33073 diff --git a/modules/k3s/netbird/secrets.yaml b/modules/k3s/netbird/secrets.yaml deleted file mode 100644 index 7553639..0000000 --- a/modules/k3s/netbird/secrets.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: netbird-secrets - namespace: netbird -type: Opaque -stringData: - # Generate with: openssl rand -base64 32 - relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32" diff --git a/modules/k3s/netbird/server.yaml b/modules/k3s/netbird/server.yaml new file mode 100644 index 0000000..dde5284 --- /dev/null +++ b/modules/k3s/netbird/server.yaml @@ -0,0 +1,68 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: netbird-server + namespace: netbird +spec: + replicas: 1 + selector: + matchLabels: + app: netbird-server + template: + metadata: + labels: + app: netbird-server + spec: + containers: + - name: netbird-server + image: netbirdio/netbird-server:latest + args: ["--config", "/etc/netbird/config.yaml"] + ports: + - containerPort: 80 + - containerPort: 3478 + protocol: UDP + - containerPort: 33073 + volumeMounts: + - name: config + mountPath: /etc/netbird + - name: data + mountPath: /var/lib/netbird + volumes: + - name: config + configMap: + name: netbird-server-config + - name: data + persistentVolumeClaim: + claimName: netbird-data +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: netbird-data + namespace: netbird +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 2Gi +--- +apiVersion: v1 +kind: Service +metadata: + name: netbird-server + namespace: netbird +spec: + selector: + app: netbird-server + ports: + - name: http + port: 80 + targetPort: 80 + - name: grpc-compat + port: 33073 + targetPort: 33073 + - name: stun + port: 3478 + targetPort: 3478 + protocol: UDP diff --git a/modules/k3s/netbird/signal.yaml b/modules/k3s/netbird/signal.yaml deleted file mode 100644 index f6db99b..0000000 --- a/modules/k3s/netbird/signal.yaml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: signal - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: signal - template: - metadata: - labels: - app: signal - spec: - containers: - - name: signal - image: netbirdio/signal:latest - env: - - name: COALESCE_INTERVAL - value: "5s" - ports: - - containerPort: 10000 - volumeMounts: - - name: signal-data - mountPath: /var/lib/netbird - volumes: - - name: signal-data - persistentVolumeClaim: - claimName: signal-data ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: signal-data - namespace: netbird -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 1Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: signal - namespace: netbird -spec: - selector: - app: signal - ports: - - name: grpc - port: 10000 - targetPort: 10000