poslop/rice-flakes
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects 3 Releases 1 Wiki Activity

refactor(netbird): migrate to single netbird-server container

Browse Source
This commit is contained in:
poslop
2026-07-21 19:06:19 -05:00
parent 9b5af62a47
commit d2a6887834
10 changed files with 178 additions and 225 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/k3s/k3s.nix
+5 -9
View File
@@ -1,13 +1,11 @@
{
networking.firewall.allowedTCPPorts = [ 6443 80 443 10000 33073 ];
networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
networking.firewall.allowedUDPPorts = [ 3478 ];
networking.firewall.allowedUDPPortRanges = [
{ from = 49152; to = 65535; }
];
services.k3s = {
enable = true;
role = "server";
extraFlags = "--write-kubeconfig-mode 644";
manifests = {
traefik-namespace = { source = ./traefik/namespace.yaml; };
traefik-rbac = { source = ./traefik/rbac.yaml; };
@@ -15,11 +13,9 @@
traefik-deployment = { source = ./traefik/deployment.yaml; };
traefik-service = { source = ./traefik/service.yaml; };
netbird-namespace = { source = ./netbird/namespace.yaml; };
netbird-secrets = { source = ./netbird/secrets.yaml; };
netbird-coturn = { source = ./netbird/coturn.yaml; };
netbird-signal = { source = ./netbird/signal.yaml; };
netbird-management = { source = ./netbird/management.yaml; };
netbird-relay = { source = ./netbird/relay.yaml; };
netbird-config = { source = ./netbird/config.yaml; };
netbird-server = { source = ./netbird/server.yaml; };
netbird-dashboard = { source = ./netbird/dashboard.yaml; };
netbird-ingress = { source = ./netbird/ingress.yaml; };
};
};
modules/k3s/netbird/config.yaml
+40
View File
@@ -0,0 +1,40 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: netbird-server-config
namespace: netbird
data:
config.yaml: |
server:
listenAddress: ":80"
exposedAddress: "https://netbird.archfox.org:443"
metricsPort: 9090
healthcheckAddress: ":9000"
logLevel: "info"
logFile: "console"
tls:
certFile: ""
keyFile: ""
letsencrypt:
enabled: false
dataDir: ""
domains: []
email: ""
awsRoute53: false
authSecret: "CHANGE_ME_openssl_rand_-hex_32"
dataDir: "/var/lib/netbird/"
disableAnonymousMetrics: false
disableGeoliteUpdate: false
auth:
issuer: "https://netbird.archfox.org/oauth2"
localAuthDisabled: false
signKeyRefreshEnabled: true
dashboardRedirectURIs:
- "https://netbird.archfox.org/nb-auth"
- "https://netbird.archfox.org/nb-silent-auth"
cliRedirectURIs:
- "http://localhost:53000/"
store:
engine: "sqlite"
dsn: ""
encryptionKey: ""
modules/k3s/netbird/coturn.yaml
-31
View File
@@ -1,31 +0,0 @@
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: coturn
namespace: netbird
spec:
selector:
matchLabels:
app: coturn
template:
metadata:
labels:
app: coturn
spec:
hostNetwork: true
containers:
- name: coturn
image: coturn/coturn
args:
- --log-file=stdout
- --external-ip=archfox.org
- --listening-port=3478
- --min-port=49152
- --max-port=65535
- --tls-listening-port=5349
- --no-tls
- --no-dtls
- --realm=netbird.archfox.org
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
modules/k3s/netbird/dashboard.yaml
+56
View File
@@ -0,0 +1,56 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: dashboard
namespace: netbird
spec:
replicas: 1
selector:
matchLabels:
app: dashboard
template:
metadata:
labels:
app: dashboard
spec:
containers:
- name: dashboard
image: netbirdio/dashboard:latest
ports:
- containerPort: 80
env:
- name: NETBIRD_MGMT_API_ENDPOINT
value: "https://netbird.archfox.org"
- name: NETBIRD_MGMT_GRPC_API_ENDPOINT
value: "https://netbird.archfox.org"
- name: AUTH_AUDIENCE
value: "netbird-dashboard"
- name: AUTH_CLIENT_ID
value: "netbird-dashboard"
- name: AUTH_CLIENT_SECRET
value: ""
- name: AUTH_AUTHORITY
value: "https://netbird.archfox.org/oauth2"
- name: USE_AUTH0
value: "false"
- name: AUTH_SUPPORTED_SCOPES
value: "openid profile email groups"
- name: AUTH_REDIRECT_URI
value: "/nb-auth"
- name: AUTH_SILENT_REDIRECT_URI
value: "/nb-silent-auth"
- name: LETSENCRYPT_DOMAIN
value: "none"
---
apiVersion: v1
kind: Service
metadata:
name: dashboard
namespace: netbird
spec:
selector:
app: dashboard
ports:
- name: http
port: 80
targetPort: 80
modules/k3s/netbird/ingress.yaml
+9 -14
View File
@@ -1,33 +1,28 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: netbird-management
name: netbird
namespace: netbird
spec:
entryPoints:
- websecure
routes:
- match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`)
- match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
kind: Rule
services:
- name: management
- name: netbird-server
port: 80
scheme: h2c
- match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`)
- match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
kind: Rule
services:
- name: management
- name: netbird-server
port: 80
- match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`)
- match: Host(`netbird.archfox.org`)
kind: Rule
priority: 1
services:
- name: signal
port: 10000
scheme: h2c
- match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`)
kind: Rule
services:
- name: relay
port: 33073
- name: dashboard
port: 80
tls:
certResolver: letsencrypt
modules/k3s/netbird/management.yaml
-62
View File
@@ -1,62 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: management
namespace: netbird
spec:
replicas: 1
selector:
matchLabels:
app: management
template:
metadata:
labels:
app: management
spec:
containers:
- name: management
image: netbirdio/management:latest
args:
- --port=80
- --log-file=stdout
- --log-level=info
- --disable-anonymous-metrics=false
- --single-account-mode-domain=netbird.archfox.org
- --dns-domain=netbird.archfox.org
env:
- name: NETBIRD_STORE_ENGINE
value: "sqlite"
ports:
- containerPort: 80
volumeMounts:
- name: mgmt-data
mountPath: /var/lib/netbird
volumes:
- name: mgmt-data
persistentVolumeClaim:
claimName: mgmt-data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mgmt-data
namespace: netbird
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi
---
apiVersion: v1
kind: Service
metadata:
name: management
namespace: netbird
spec:
selector:
app: management
ports:
- name: http
port: 80
targetPort: 80
modules/k3s/netbird/relay.yaml
-45
View File
@@ -1,45 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: relay
namespace: netbird
spec:
replicas: 1
selector:
matchLabels:
app: relay
template:
metadata:
labels:
app: relay
spec:
containers:
- name: relay
image: netbirdio/relay:latest
env:
- name: NB_LOG_LEVEL
value: "info"
- name: NB_LISTEN_ADDRESS
value: ":33073"
- name: NB_EXPOSED_ADDRESS
value: "rels://netbird.archfox.org:443/relay"
- name: NB_AUTH_SECRET
valueFrom:
secretKeyRef:
name: netbird-secrets
key: relay-auth-secret
ports:
- containerPort: 33073
---
apiVersion: v1
kind: Service
metadata:
name: relay
namespace: netbird
spec:
selector:
app: relay
ports:
- name: relay
port: 33073
targetPort: 33073
modules/k3s/netbird/secrets.yaml
-9
View File
@@ -1,9 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: netbird-secrets
namespace: netbird
type: Opaque
stringData:
# Generate with: openssl rand -base64 32
relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32"
modules/k3s/netbird/server.yaml
+68
View File
@@ -0,0 +1,68 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: netbird-server
namespace: netbird
spec:
replicas: 1
selector:
matchLabels:
app: netbird-server
template:
metadata:
labels:
app: netbird-server
spec:
containers:
- name: netbird-server
image: netbirdio/netbird-server:latest
args: ["--config", "/etc/netbird/config.yaml"]
ports:
- containerPort: 80
- containerPort: 3478
protocol: UDP
- containerPort: 33073
volumeMounts:
- name: config
mountPath: /etc/netbird
- name: data
mountPath: /var/lib/netbird
volumes:
- name: config
configMap:
name: netbird-server-config
- name: data
persistentVolumeClaim:
claimName: netbird-data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: netbird-data
namespace: netbird
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi
---
apiVersion: v1
kind: Service
metadata:
name: netbird-server
namespace: netbird
spec:
selector:
app: netbird-server
ports:
- name: http
port: 80
targetPort: 80
- name: grpc-compat
port: 33073
targetPort: 33073
- name: stun
port: 3478
targetPort: 3478
protocol: UDP
modules/k3s/netbird/signal.yaml
-55
View File
@@ -1,55 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: signal
namespace: netbird
spec:
replicas: 1
selector:
matchLabels:
app: signal
template:
metadata:
labels:
app: signal
spec:
containers:
- name: signal
image: netbirdio/signal:latest
env:
- name: COALESCE_INTERVAL
value: "5s"
ports:
- containerPort: 10000
volumeMounts:
- name: signal-data
mountPath: /var/lib/netbird
volumes:
- name: signal-data
persistentVolumeClaim:
claimName: signal-data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: signal-data
namespace: netbird
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
name: signal
namespace: netbird
spec:
selector:
app: signal
ports:
- name: grpc
port: 10000
targetPort: 10000