Merge pull request 'Dev' (#2) from dev into master

Reviewed-on: #2

.write-test

@@ -1 +0,0 @@
-test

flake.lock

@@ -41,11 +41,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464219,
+        "lastModified": 1784368054,
-        "narHash": "sha256-WKqWL8r7CyTDYueTr2ffJ9ya50dellv6IR1JX5PghDY=",
+        "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=",
         "owner": "hyprwm",
         "repo": "aquamarine",
-        "rev": "f3d1804205e8158c15595cdda1b566f93349ffae",
+        "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0",
         "type": "github"
       },
       "original": {
@@ -100,11 +100,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1772408722,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
         "type": "github"
       },
       "original": {
@@ -116,7 +116,6 @@
     "hermes-agent": {
       "inputs": {
         "flake-parts": "flake-parts",
-        "home-manager": "home-manager_2",
         "nixpkgs": "nixpkgs_2",
         "npm-lockfile-fix": "npm-lockfile-fix",
         "pyproject-build-systems": "pyproject-build-systems",
@@ -124,11 +123,11 @@
         "uv2nix": "uv2nix"
       },
       "locked": {
-        "lastModified": 1787314587,
+        "lastModified": 1784644108,
-        "narHash": "sha256-oeFJlEoFybqKkbuWT4mW8PRauusjt3y44ZJXAcA7TPY=",
+        "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=",
         "owner": "NousResearch",
         "repo": "hermes-agent",
-        "rev": "fcbd1076a93841fa88855acce810e342a5b78101",
+        "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d",
         "type": "github"
       },
       "original": {
@@ -144,11 +143,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787194407,
+        "lastModified": 1784601896,
-        "narHash": "sha256-hMgbN6InoW+S5G/cqGrVwHUmOJcGIT/yUg1Xe6y7t8Q=",
+        "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=",
         "owner": "feel-co",
         "repo": "hjem",
-        "rev": "7cd7f1c567beaf5527781e0b51647a98acde54e6",
+        "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679",
         "type": "github"
       },
       "original": {
@@ -162,16 +161,17 @@
         "hjem": [
           "hjem"
         ],
+        "nix-darwin": "nix-darwin",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1787315974,
+        "lastModified": 1784361899,
-        "narHash": "sha256-LLToYudTlFqNY0NsG//CnE2I/zF0cpktX44ZhFJ2alY=",
+        "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=",
         "owner": "snugnug",
         "repo": "hjem-rum",
-        "rev": "217c6e1f445b3973ca8f988f070c9b84cceaa1ca",
+        "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60",
         "type": "github"
       },
       "original": {
@@ -201,27 +201,6 @@
         "type": "github"
       }
     },
-    "home-manager_2": {
-      "inputs": {
-        "nixpkgs": [
-          "hermes-agent",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1786487128,
-        "narHash": "sha256-ad60hrRVhH/bo3Jl1YLzO+QcS3mUNZr9LNJdzhMO2P4=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "f404edbfa4117810c96b97048299242fc50e5362",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
     "hyprcursor": {
       "inputs": {
         "hyprlang": [
@@ -238,11 +217,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464181,
+        "lastModified": 1776511930,
-        "narHash": "sha256-2alOMkLjXANh7unkZnYnCF2K2rApZaOLMoQ3o+VX2CY=",
+        "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=",
         "owner": "hyprwm",
         "repo": "hyprcursor",
-        "rev": "e4ed7c08123df5af460a0a70961380cbfb872f76",
+        "rev": "39435900785d0c560c6ae8777d29f28617d031ef",
         "type": "github"
       },
       "original": {
@@ -267,11 +246,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464367,
+        "lastModified": 1782566056,
-        "narHash": "sha256-k58p4wbzIXWyRWrW84pP8tD+iaZSSYiiM+fr0Auk4oU=",
+        "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=",
         "owner": "hyprwm",
         "repo": "hyprgraphics",
-        "rev": "7c895c44e3ca6d28ed68ddd80ec02b02b925e7fc",
+        "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8",
         "type": "github"
       },
       "original": {
@@ -297,11 +276,11 @@
         "xdph": "xdph"
       },
       "locked": {
-        "lastModified": 1787311583,
+        "lastModified": 1784641930,
-        "narHash": "sha256-EXpfUX7oLzqwd+m/T1TvH/rHwnTNtZL+TZ5wiCwklMo=",
+        "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=",
         "owner": "hyprwm",
         "repo": "Hyprland",
-        "rev": "0f97a22d1172d8fbd77834ec932383ed18110edb",
+        "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda",
         "type": "github"
       },
       "original": {
@@ -343,11 +322,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464504,
+        "lastModified": 1784196523,
-        "narHash": "sha256-7sHwM86KILQyHDHDuE2SDBlQ2jvZ0EW3hY7sW009/cg=",
+        "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=",
         "owner": "hyprwm",
         "repo": "hyprland-guiutils",
-        "rev": "4c30cf3097ea963c0e250749ee0c59f8b08816d6",
+        "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0",
         "type": "github"
       },
       "original": {
@@ -397,11 +376,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464129,
+        "lastModified": 1777320127,
-        "narHash": "sha256-339AkTlpMYSIvFuG0rnR+8Yg4/AZKeJalshJavlnKfg=",
+        "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=",
         "owner": "hyprwm",
         "repo": "hyprlang",
-        "rev": "9508458be316a0d70d37ebed1ab725ccd10411ff",
+        "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc",
         "type": "github"
       },
       "original": {
@@ -449,11 +428,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785930473,
+        "lastModified": 1782554491,
-        "narHash": "sha256-DitTu625BhEYpZjtjxtGpjrEJwPwW+X/+jJvhSZNSJM=",
+        "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=",
         "owner": "hyprwm",
         "repo": "hyprtoolkit",
-        "rev": "af515b69dfbe366dc7873aa1475cb2f4db3ebad7",
+        "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35",
         "type": "github"
       },
       "original": {
@@ -474,11 +453,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464080,
+        "lastModified": 1784323413,
-        "narHash": "sha256-W1hxvumEM57yV+QwsZ4QdAHEqOkr7e4S8VAkLX60qDE=",
+        "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=",
         "owner": "hyprwm",
         "repo": "hyprutils",
-        "rev": "c157fe1e3092b980cc69315a6631f89aff09dcce",
+        "rev": "5f03477ab3a005ff27c527486f551883535aea2f",
         "type": "github"
       },
       "original": {
@@ -499,11 +478,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464033,
+        "lastModified": 1777159683,
-        "narHash": "sha256-QM8Qe4/L8lpdVN4bgwahmi+jyyc4fisseDMe4afcDxA=",
+        "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=",
         "owner": "hyprwm",
         "repo": "hyprwayland-scanner",
-        "rev": "62e62c1ca23da17612c6890d4ad2064f575643db",
+        "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404",
         "type": "github"
       },
       "original": {
@@ -528,11 +507,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464294,
+        "lastModified": 1778410714,
-        "narHash": "sha256-ZQsZ2WvBdkboCIyh8LStDPdAIARmxzn0XMNxxoOhjPE=",
+        "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=",
         "owner": "hyprwm",
         "repo": "hyprwire",
-        "rev": "4ce7cd6b6128c1ac41caf23c58a30a26b327f9dd",
+        "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc",
         "type": "github"
       },
       "original": {
@@ -541,6 +520,27 @@
         "type": "github"
       }
     },
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "hjem-rum",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779036909,
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1754028485,
@@ -559,11 +559,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785318670,
+        "lastModified": 1775036866,
-        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
         "type": "github"
       },
       "original": {
@@ -575,11 +575,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1786247143,
+        "lastModified": 1784356753,
-        "narHash": "sha256-8S3Kcxs7D4UtxJxSJZz0m14CGhuW0MxfrIwJxeGWGnQ=",
+        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "279b4a8275f032c566576b3f181fa0f27197f588",
+        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
         "type": "github"
       },
       "original": {
@@ -591,11 +591,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1787135253,
+        "lastModified": 1784497964,
-        "narHash": "sha256-RD2kNWCG+Bjo6h+JVjWVNntZs2GtRoeY2xHjts/FNkA=",
+        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "ffb3c9b700e759be2ef13237c9d8f953b32a1e46",
+        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
         "type": "github"
       },
       "original": {
@@ -664,11 +664,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785115949,
+        "lastModified": 1772555609,
-        "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=",
+        "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=",
         "owner": "pyproject-nix",
         "repo": "build-system-pkgs",
-        "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9",
+        "rev": "c37f66a953535c394244888598947679af231863",
         "type": "github"
       },
       "original": {
@@ -685,11 +685,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784591072,
+        "lastModified": 1772865871,
-        "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=",
+        "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=",
         "owner": "pyproject-nix",
         "repo": "pyproject.nix",
-        "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3",
+        "rev": "e537db02e72d553cea470976b9733581bcf5b3ed",
         "type": "github"
       },
       "original": {
@@ -750,11 +750,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785277507,
+        "lastModified": 1773039484,
-        "narHash": "sha256-9Tq3UDX2hD/aveW/HvkBlAmEwJTOlY5HQXJM+L5BGmE=",
+        "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=",
         "owner": "pyproject-nix",
         "repo": "uv2nix",
-        "rev": "5a836d395cbf5fc22670eb98dd4aa4fc4d406977",
+        "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f",
         "type": "github"
       },
       "original": {
@@ -791,11 +791,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786464334,
+        "lastModified": 1784371182,
-        "narHash": "sha256-/TBQT5rhBB2Dm4HoZzhGDaCwYmRTs3W3DPhMXFWc/BU=",
+        "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=",
         "owner": "hyprwm",
         "repo": "xdg-desktop-portal-hyprland",
-        "rev": "9f0e9ff02739cd538d39bd706422dc50e9ca60dd",
+        "rev": "08d99f727944dd15e4740090305e31c5fb92a50a",
         "type": "github"
       },
       "original": {

hosts/hermes-vm/configuration.nix

@@ -3,7 +3,7 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../modules/core
+    ../../modules
     ../../modules/hermes
   ];
 

modules/core/network.nix

@@ -3,6 +3,4 @@
 {
   networking.hostName = host;
   networking.networkmanager.enable = true;
-
-  services.netbird.enable = true;
 }

modules/core/packages/dev.nix

@@ -5,7 +5,6 @@
     neovim
     git
     tree-sitter
-    yamlfmt
     gcc
 
     # lua

modules/core/zsh/.zshrc

@@ -17,7 +17,7 @@ alias gs='git status'
 
 alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes'
 
-alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
+alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'
 
 ga() {
   if [[ -z "$1" ]]; then

modules/hermes/hermes.nix

@@ -1,8 +1,6 @@
 {
   inputs,
   config,
-  lib,
-  pkgs,
   ...
 }:
 
@@ -16,10 +14,6 @@
       config.age.secrets.hermes-env.path
     ];
 
-    environment = {
-      BW_SERVERURL = "https://vault.archfox.org";
-    };
-
     container = {
       image = "debian:bookworm";
       backend = "docker";
@@ -30,8 +24,6 @@
         "9119:9119"
         "-p"
         "8642:8642"
-        "-p"
-        "9120:9120"
       ];
     };
 
@@ -52,8 +44,8 @@
       };
 
       delegation = {
-        model = "us.anthropic.claude-sonnet-5";
+        model = "openai/gpt-5.6-luna";
-        provider = "bedrock";
+        provider = "nous";
       };
 
       discord = {
@@ -63,66 +55,9 @@
     };
   };
 
-  # Hermes serve (desktop app JSON-RPC backend, headless)
-  # Port 9120 avoids conflict with the gateway's API server on 9119.
-  systemd.services.hermes-serve = {
-    description = "Hermes Agent Serve (desktop remote backend)";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "hermes-agent.service" "network-online.target" ];
-    wants = [ "network-online.target" ];
-    requires = [ "hermes-agent.service" ];
-
-    serviceConfig = {
-      Type = "simple";
-      Restart = "always";
-      RestartSec = 5;
-      TimeoutStopSec = 15;
-    };
-
-    script = ''
-      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
-        -e HERMES_HOME=/data/.hermes \
-        -e HOME=/home/hermes \
-        hermes-agent \
-        /data/current-package/bin/hermes serve \
-          --host 0.0.0.0 \
-          --port 9120
-    '';
-  };
-
-  # Hermes dashboard (web UI for browser access)
-  # Port 9121, full web dashboard with login page.
-  systemd.services.hermes-dashboard = {
-    description = "Hermes Agent Dashboard (web UI)";
-    wantedBy = [ "multi-user.target" ];
-    after = [ "hermes-agent.service" "network-online.target" ];
-    wants = [ "network-online.target" ];
-    requires = [ "hermes-agent.service" ];
-
-    serviceConfig = {
-      Type = "simple";
-      Restart = "always";
-      RestartSec = 5;
-      TimeoutStopSec = 15;
-    };
-
-    script = ''
-      exec ${pkgs.docker}/bin/docker exec -i -u hermes \
-        -e HERMES_HOME=/data/.hermes \
-        -e HOME=/home/hermes \
-        hermes-agent \
-        /data/current-package/bin/hermes dashboard \
-          --host 0.0.0.0 \
-          --port 9121 \
-          --no-open
-    '';
-  };
-
   networking.firewall.allowedTCPPorts = [
     8080
     9119
-    9120
-    9121
     8642
   ];
 }

modules/k3s/k3s.nix

@@ -1,25 +1,22 @@
 {
-  networking.firewall.allowedTCPPorts = [
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
-    6443
-    80
-    443
-    8969
-    33073
-  ];
   networking.firewall.allowedUDPPorts = [ 3479 ];
 
   services.k3s = {
     enable = true;
     role = "server";
     extraFlags = "--write-kubeconfig-mode 644";
+    manifests = {
+      traefik-namespace    = { source = ./traefik/namespace.yaml; };
+      traefik-rbac         = { source = ./traefik/rbac.yaml; };
+      traefik-pvc          = { source = ./traefik/pvc.yaml; };
+      traefik-deployment   = { source = ./traefik/deployment.yaml; };
+      traefik-service      = { source = ./traefik/service.yaml; };
+      netbird-namespace    = { source = ./netbird/namespace.yaml; };
+      netbird-config       = { source = ./netbird/config.yaml; };
+      netbird-server       = { source = ./netbird/server.yaml; };
+      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
+      netbird-ingress      = { source = ./netbird/ingress.yaml; };
     };
-
-  fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = {
-    device = "/home/poslop/k3s/apps";
-    fsType = "none";
-    options = [
-      "bind"
-      "ro"
-    ];
   };
 }

modules/k3s/netbird/config.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      stunPorts:
+        - 3479
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: ""
+      reverseProxy:
+        trustedHTTPProxies:
+          - "10.0.1.45/32"

modules/k3s/netbird/dashboard.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

modules/k3s/netbird/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+    - match: Host(`netbird.archfox.org`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: dashboard
+          port: 80

modules/k3s/netbird/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird

modules/k3s/netbird/server.yaml

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3479
+              protocol: UDP
+            - containerPort: 33073
+          env:
+            - name: NETBIRD_STORE_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-encryption
+                  key: encryptionKey
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config
+          configMap:
+            name: netbird-server-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3479
+      targetPort: 3479
+      protocol: UDP

modules/k3s/traefik/deployment.yaml

@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik
+      containers:
+        - name: traefik
+          image: traefik:v3.4
+          args:
+            - --log.level=INFO
+            - --api.dashboard=true
+            - --entrypoints.web.address=:80
+            - --providers.kubernetescrd=true
+            - --providers.kubernetesingress=true
+          ports:
+            - name: web
+              containerPort: 80
+          volumeMounts:
+            - name: acme-storage
+              mountPath: /data
+      volumes:
+        - name: acme-storage
+          persistentVolumeClaim:
+            claimName: traefik-acme

modules/k3s/traefik/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik

modules/k3s/traefik/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-acme
+  namespace: traefik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 128Mi

modules/k3s/traefik/rbac.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik
+  namespace: traefik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["update"]
+  - apiGroups: ["traefik.io"]
+    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
+                "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
+                "serverstransports", "serverstransporttcps"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik

modules/k3s/traefik/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik
+  ports:
+    - name: web
+      port: 80
+      targetPort: 80
+    - name: websecure
+      port: 443
+      targetPort: 443