From f9289fa766d250994ec203d11057bee37a8ef666 Mon Sep 17 00:00:00 2001
From: poslop <poslop@archfox.org>
Date: Thu, 23 Jul 2026 13:45:04 -0500
Subject: [PATCH] netbird: move authSecret out of git into k8s secret
 (netbird-relay-auth), render via init container

---
 modules/k3s/netbird/config.yaml |  4 ++--
 modules/k3s/netbird/server.yaml | 25 +++++++++++++++++++++++--
 2 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/modules/k3s/netbird/config.yaml b/modules/k3s/netbird/config.yaml
index 3eb16ed..2448dcc 100644
--- a/modules/k3s/netbird/config.yaml
+++ b/modules/k3s/netbird/config.yaml
@@ -4,7 +4,7 @@ metadata:
   name: netbird-server-config
   namespace: netbird
 data:
-  config.yaml: |
+  config.yaml.tpl: |
     server:
       listenAddress: ":80"
       exposedAddress: "https://netbird.archfox.org:443"
@@ -23,7 +23,7 @@ data:
           domains: []
           email: ""
           awsRoute53: false
-      authSecret: "4bd2ecf3f8be38cd6e640d4eb5f844d8d73c094be7e036b7c6ce1e1b67396e1b"
+      authSecret: "__AUTH_SECRET__"
       dataDir: "/var/lib/netbird/"
       disableAnonymousMetrics: false
       disableGeoliteUpdate: false
diff --git a/modules/k3s/netbird/server.yaml b/modules/k3s/netbird/server.yaml
index 4b954e2..c74033d 100644
--- a/modules/k3s/netbird/server.yaml
+++ b/modules/k3s/netbird/server.yaml
@@ -13,6 +13,25 @@ spec:
       labels:
         app: netbird-server
     spec:
+      initContainers:
+        - name: render-config
+          image: busybox
+          env:
+            - name: AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-relay-auth
+                  key: authSecret
+          command:
+            - sh
+            - -c
+            - |
+              sed "s|__AUTH_SECRET__|$AUTH_SECRET|g" /tpl/config.yaml.tpl > /etc/netbird/config.yaml
+          volumeMounts:
+            - name: config-tpl
+              mountPath: /tpl
+            - name: config-rendered
+              mountPath: /etc/netbird
       containers:
         - name: netbird-server
           image: netbirdio/netbird-server:latest
@@ -29,14 +48,16 @@ spec:
                   name: netbird-encryption
                   key: encryptionKey
           volumeMounts:
-            - name: config
+            - name: config-rendered
               mountPath: /etc/netbird
             - name: data
               mountPath: /var/lib/netbird
       volumes:
-        - name: config
+        - name: config-tpl
           configMap:
             name: netbird-server-config
+        - name: config-rendered
+          emptyDir: {}
         - name: data
           persistentVolumeClaim:
             claimName: netbird-data