k3s: wipe netbird/traefik manifests, back to bare k3s

modules/k3s/k3s.nix

@@ -1,22 +1,9 @@
 {
-  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 ];
-  networking.firewall.allowedUDPPorts = [ 3479 ];
 
   services.k3s = {
     enable = true;
     role = "server";
     extraFlags = "--write-kubeconfig-mode 644";
-    manifests = {
-      traefik-namespace    = { source = ./traefik/namespace.yaml; };
-      traefik-rbac         = { source = ./traefik/rbac.yaml; };
-      traefik-pvc          = { source = ./traefik/pvc.yaml; };
-      traefik-deployment   = { source = ./traefik/deployment.yaml; };
-      traefik-service      = { source = ./traefik/service.yaml; };
-      netbird-namespace    = { source = ./netbird/namespace.yaml; };
-      netbird-config       = { source = ./netbird/config.yaml; };
-      netbird-server       = { source = ./netbird/server.yaml; };
-      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
-      netbird-ingress      = { source = ./netbird/ingress.yaml; };
-    };
   };
 }

modules/k3s/netbird/config.yaml

@@ -1,45 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: netbird-server-config
-  namespace: netbird
-data:
-  config.yaml.tpl: |
-    server:
-      listenAddress: ":80"
-      exposedAddress: "https://netbird.archfox.org:443"
-      metricsPort: 9090
-      healthcheckAddress: ":9000"
-      logLevel: "info"
-      logFile: "console"
-      stunPorts:
-        - 3479
-      tls:
-        certFile: ""
-        keyFile: ""
-        letsencrypt:
-          enabled: false
-          dataDir: ""
-          domains: []
-          email: ""
-          awsRoute53: false
-      authSecret: "__AUTH_SECRET__"
-      dataDir: "/var/lib/netbird/"
-      disableAnonymousMetrics: false
-      disableGeoliteUpdate: false
-      auth:
-        issuer: "https://netbird.archfox.org/oauth2"
-        localAuthDisabled: false
-        signKeyRefreshEnabled: true
-        dashboardRedirectURIs:
-          - "https://netbird.archfox.org/nb-auth"
-          - "https://netbird.archfox.org/nb-silent-auth"
-        cliRedirectURIs:
-          - "http://localhost:53000/"
-      store:
-        engine: "sqlite"
-        dsn: ""
-        encryptionKey: ""
-      reverseProxy:
-        trustedHTTPProxies:
-          - "10.0.1.45/32"

modules/k3s/netbird/dashboard.yaml

@@ -1,56 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: dashboard
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: dashboard
-  template:
-    metadata:
-      labels:
-        app: dashboard
-    spec:
-      containers:
-        - name: dashboard
-          image: netbirdio/dashboard:latest
-          ports:
-            - containerPort: 80
-          env:
-            - name: NETBIRD_MGMT_API_ENDPOINT
-              value: "https://netbird.archfox.org"
-            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
-              value: "https://netbird.archfox.org"
-            - name: AUTH_AUDIENCE
-              value: "netbird-dashboard"
-            - name: AUTH_CLIENT_ID
-              value: "netbird-dashboard"
-            - name: AUTH_CLIENT_SECRET
-              value: ""
-            - name: AUTH_AUTHORITY
-              value: "https://netbird.archfox.org/oauth2"
-            - name: USE_AUTH0
-              value: "false"
-            - name: AUTH_SUPPORTED_SCOPES
-              value: "openid profile email groups"
-            - name: AUTH_REDIRECT_URI
-              value: "/nb-auth"
-            - name: AUTH_SILENT_REDIRECT_URI
-              value: "/nb-silent-auth"
-            - name: LETSENCRYPT_DOMAIN
-              value: "none"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: dashboard
-  namespace: netbird
-spec:
-  selector:
-    app: dashboard
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80

modules/k3s/netbird/ingress.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: netbird
-  namespace: netbird
-spec:
-  entryPoints:
-    - web
-  routes:
-    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
-      kind: Rule
-      services:
-        - name: netbird-server
-          port: 80
-          scheme: h2c
-    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      kind: Rule
-      services:
-        - name: netbird-server
-          port: 80
-    - match: Host(`netbird.archfox.org`)
-      kind: Rule
-      priority: 1
-      services:
-        - name: dashboard
-          port: 80

modules/k3s/netbird/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbird

modules/k3s/netbird/server.yaml

@@ -1,95 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-server
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbird-server
-  template:
-    metadata:
-      labels:
-        app: netbird-server
-    spec:
-      initContainers:
-        - name: render-config
-          image: busybox
-          env:
-            - name: AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: netbird-relay-auth
-                  key: authSecret
-          command:
-            - sh
-            - -c
-            - |
-              sed "s|__AUTH_SECRET__|$AUTH_SECRET|g" /tpl/config.yaml.tpl > /etc/netbird/config.yaml
-          volumeMounts:
-            - name: config-tpl
-              mountPath: /tpl
-            - name: config-rendered
-              mountPath: /etc/netbird
-      containers:
-        - name: netbird-server
-          image: netbirdio/netbird-server:latest
-          args: ["--config", "/etc/netbird/config.yaml"]
-          ports:
-            - containerPort: 80
-            - containerPort: 3479
-              protocol: UDP
-            - containerPort: 33073
-          env:
-            - name: NETBIRD_STORE_ENCRYPTION_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: netbird-encryption
-                  key: encryptionKey
-          volumeMounts:
-            - name: config-rendered
-              mountPath: /etc/netbird
-            - name: data
-              mountPath: /var/lib/netbird
-      volumes:
-        - name: config-tpl
-          configMap:
-            name: netbird-server-config
-        - name: config-rendered
-          emptyDir: {}
-        - name: data
-          persistentVolumeClaim:
-            claimName: netbird-data
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: netbird-data
-  namespace: netbird
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbird-server
-  namespace: netbird
-spec:
-  selector:
-    app: netbird-server
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-    - name: grpc-compat
-      port: 33073
-      targetPort: 33073
-    - name: stun
-      port: 3479
-      targetPort: 3479
-      protocol: UDP

modules/k3s/traefik/deployment.yaml

@@ -1,35 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: traefik
-  template:
-    metadata:
-      labels:
-        app: traefik
-    spec:
-      serviceAccountName: traefik
-      containers:
-        - name: traefik
-          image: traefik:v3.4
-          args:
-            - --log.level=INFO
-            - --api.dashboard=true
-            - --entrypoints.web.address=:80
-            - --providers.kubernetescrd=true
-            - --providers.kubernetesingress=true
-          ports:
-            - name: web
-              containerPort: 80
-          volumeMounts:
-            - name: acme-storage
-              mountPath: /data
-      volumes:
-        - name: acme-storage
-          persistentVolumeClaim:
-            claimName: traefik-acme

modules/k3s/traefik/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik

modules/k3s/traefik/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: traefik-acme
-  namespace: traefik
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 128Mi

modules/k3s/traefik/rbac.yaml

@@ -1,41 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik
-  namespace: traefik
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: traefik
-rules:
-  - apiGroups: [""]
-    resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses", "ingressclasses"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses/status"]
-    verbs: ["update"]
-  - apiGroups: ["traefik.io"]
-    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
-                "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
-                "serverstransports", "serverstransporttcps"]
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: traefik
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: traefik
-subjects:
-  - kind: ServiceAccount
-    name: traefik
-    namespace: traefik

modules/k3s/traefik/service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  type: LoadBalancer
-  selector:
-    app: traefik
-  ports:
-    - name: web
-      port: 80
-      targetPort: 80
-    - name: websecure
-      port: 443
-      targetPort: 443