Merge pull request 'Dev' (#2 ) from dev into master

Reviewed-on: #2
remove hermes permission service
2026-07-23 12:48:53 -05:00 · 2026-07-23 11:18:42 -05:00 · 2026-07-23 11:15:51 -05:00 · 2026-07-21 21:25:58 -05:00 · 2026-07-21 21:18:20 -05:00 · 2026-07-21 20:15:00 -05:00
15 changed files with 371 additions and 78 deletions
@@ -41,11 +41,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782073106,
-        "narHash": "sha256-dnS5SaZlPqR1E0dPXaPc+lFkBwLUbAgbwsVMk7uA6dY=",
+        "lastModified": 1784368054,
+        "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=",
        "owner": "hyprwm",
        "repo": "aquamarine",
-        "rev": "6d6e2384f381def4ea4ea81543cba4bbdac72457",
+        "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0",
        "type": "github"
      },
      "original": {
@@ -123,11 +123,11 @@
        "uv2nix": "uv2nix"
      },
      "locked": {
-        "lastModified": 1784144249,
-        "narHash": "sha256-Ud5AegeU8Fm+0g1czJP+8riQEw4+kuefo2yl0PLcEMw=",
+        "lastModified": 1784644108,
+        "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=",
        "owner": "NousResearch",
        "repo": "hermes-agent",
-        "rev": "8b209e0dd7b8e308d5b923fa80f7a72f71042636",
+        "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d",
        "type": "github"
      },
      "original": {
@@ -143,11 +143,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782267080,
-        "narHash": "sha256-so1hIImuLtTKTVUokJ/6C2D2b2D4znCx+/PAjMSAnpw=",
+        "lastModified": 1784601896,
+        "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=",
        "owner": "feel-co",
        "repo": "hjem",
-        "rev": "dd0ba9e22fb46581f843e6121de33ca7a4a80224",
+        "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679",
        "type": "github"
      },
      "original": {
@@ -167,11 +167,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783395473,
-        "narHash": "sha256-oIIP2d7qELHfumkhHuofn7tryoAcuBwtYt0mDSyHF4s=",
+        "lastModified": 1784361899,
+        "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=",
        "owner": "snugnug",
        "repo": "hjem-rum",
-        "rev": "64e395fe298cd25279c6086c23ae53636e7dbf1f",
+        "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60",
        "type": "github"
      },
      "original": {
@@ -276,11 +276,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1784118734,
-        "narHash": "sha256-sWiTb0IOA1MoLYfUIvGlG4Ahyu9gbtiOiCa3xz7HaRc=",
+        "lastModified": 1784641930,
+        "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "d7fc7240f4efd0abac1c1f23f09b78b30b4e0782",
+        "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda",
        "type": "github"
      },
      "original": {
@@ -322,11 +322,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782563850,
-        "narHash": "sha256-rs/EzgrgPHbCtJjFZN4aR1HYldH/0NtGAempWVpWQTs=",
+        "lastModified": 1784196523,
+        "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=",
        "owner": "hyprwm",
        "repo": "hyprland-guiutils",
-        "rev": "5ba080ee036c30cb2485f2647ff8a61f7aa08178",
+        "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0",
        "type": "github"
      },
      "original": {
@@ -453,11 +453,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783002634,
-        "narHash": "sha256-xGqHIUK0wIZoW7SiMalwvO6uGOO/VrlQwoRobpE7dDI=",
+        "lastModified": 1784323413,
+        "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "41fb809557abd29a57151b6e1aaeabd05f9437e1",
+        "rev": "5f03477ab3a005ff27c527486f551883535aea2f",
        "type": "github"
      },
      "original": {
@@ -575,11 +575,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1783522502,
-        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
+        "lastModified": 1784356753,
+        "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
+        "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a",
        "type": "github"
      },
      "original": {
@@ -591,11 +591,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1784007870,
-        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
+        "lastModified": 1784497964,
+        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
+        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
        "type": "github"
      },
      "original": {
@@ -635,11 +635,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1783008725,
-        "narHash": "sha256-jGiy6+sxjNWXSjp25uoJuNfyH9zBK1PEDY0lVoL4ibQ=",
+        "lastModified": 1784288435,
+        "narHash": "sha256-ReRHaLgr/uVqdD8afFSn+myXIfpHeOhP0yYe0TJqAA8=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "bca82caa46d5ec0f5d422c61fb1e30bc51313cbe",
+        "rev": "43b3c1ab9d40fb1dbb008f451988a91e375825e9",
        "type": "github"
      },
      "original": {
@@ -791,11 +791,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1782644412,
-        "narHash": "sha256-/iSa/bL1QQFLv+uJ9gI0N87J8gOeZXvca7EjoPGKE6w=",
+        "lastModified": 1784371182,
+        "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=",
        "owner": "hyprwm",
        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "c01c99fc278ec68c82e9865923088f043c7c1621",
+        "rev": "08d99f727944dd15e4740090305e31c5fb92a50a",
        "type": "github"
      },
      "original": {
@@ -4,6 +4,7 @@
  imports = [
    ./hardware-configuration.nix
    ../../modules
+    ../../modules/k3s/k3s.nix
  ];

  boot.loader.systemd-boot.enable = true;
@@ -15,6 +15,8 @@ alias gc='git commit'
 alias gp='git push'
 alias gs='git status'

+alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes'
+
 alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key'

 ga() {
@@ -1,7 +1,6 @@
 {
  inputs,
  config,
-  pkgs,
  ...
 }:

@@ -53,55 +52,12 @@
        group_sessions_per_user = false;
        reactions = false;
      };
-
-      dashboard = {
-        basic_auth = {
-          username = "poslop";
-          password_hash = "scrypt$16384$8$1$XpurTBPYAwR7lqHEXjmudg==$1tKObL9EWptqLNHjCyTX+phYB7Qp0RuIgF2X8C/jO0A=";
-        };
-      };
    };
  };

  networking.firewall.allowedTCPPorts = [
+    8080
    9119
    8642
  ];
-
-  systemd = {
-    timers.hermes-perms-maintenance = {
-      description = "Periodically fix hermes file permissions";
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "10s";
-        OnUnitActiveSec = "30s";
-      };
-    };
-
-    services = {
-      hermes-dashboard = {
-        description = "Hermes Agent Web Dashboard";
-        after = [ "hermes-agent.service" ];
-        bindsTo = [ "hermes-agent.service" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          Type = "simple";
-          ExecStart = "${pkgs.docker}/bin/docker exec -u hermes hermes-agent /data/current-package/bin/hermes dashboard --host 0.0.0.0 --port 9119 --no-open";
-          Restart = "on-failure";
-          RestartSec = 5;
-          StartLimitIntervalSec = 60;
-          StartLimitBurst = 3;
-        };
-      };
-
-      hermes-perms-maintenance = {
-        description = "Fix hermes file permissions for gateway access";
-        serviceConfig = {
-          Type = "oneshot";
-          ExecStartPre = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type d -not -perm -2770 -exec ${pkgs.coreutils}/bin/chmod 2770 {} +";
-          ExecStart = "${pkgs.findutils}/bin/find /var/lib/hermes/.hermes/ -type f -not -perm -0660 -exec ${pkgs.coreutils}/bin/chmod 660 {} +";
-        };
-      };
-    };
-  };
 }
@@ -0,0 +1,22 @@
+{
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
+  networking.firewall.allowedUDPPorts = [ 3479 ];
+
+  services.k3s = {
+    enable = true;
+    role = "server";
+    extraFlags = "--write-kubeconfig-mode 644";
+    manifests = {
+      traefik-namespace    = { source = ./traefik/namespace.yaml; };
+      traefik-rbac         = { source = ./traefik/rbac.yaml; };
+      traefik-pvc          = { source = ./traefik/pvc.yaml; };
+      traefik-deployment   = { source = ./traefik/deployment.yaml; };
+      traefik-service      = { source = ./traefik/service.yaml; };
+      netbird-namespace    = { source = ./netbird/namespace.yaml; };
+      netbird-config       = { source = ./netbird/config.yaml; };
+      netbird-server       = { source = ./netbird/server.yaml; };
+      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
+      netbird-ingress      = { source = ./netbird/ingress.yaml; };
+    };
+  };
+}
@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      stunPorts:
+        - 3479
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: ""
+      reverseProxy:
+        trustedHTTPProxies:
+          - "10.0.1.45/32"
@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
@@ -0,0 +1,26 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  entryPoints:
+    - web
+  routes:
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+          scheme: h2c
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      services:
+        - name: netbird-server
+          port: 80
+    - match: Host(`netbird.archfox.org`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: dashboard
+          port: 80
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird
@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3479
+              protocol: UDP
+            - containerPort: 33073
+          env:
+            - name: NETBIRD_STORE_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-encryption
+                  key: encryptionKey
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config
+          configMap:
+            name: netbird-server-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3479
+      targetPort: 3479
+      protocol: UDP
@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik
+      containers:
+        - name: traefik
+          image: traefik:v3.4
+          args:
+            - --log.level=INFO
+            - --api.dashboard=true
+            - --entrypoints.web.address=:80
+            - --providers.kubernetescrd=true
+            - --providers.kubernetesingress=true
+          ports:
+            - name: web
+              containerPort: 80
+          volumeMounts:
+            - name: acme-storage
+              mountPath: /data
+      volumes:
+        - name: acme-storage
+          persistentVolumeClaim:
+            claimName: traefik-acme
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-acme
+  namespace: traefik
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 128Mi
@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik
+  namespace: traefik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: traefik
+rules:
+  - apiGroups: [""]
+    resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses", "ingressclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses/status"]
+    verbs: ["update"]
+  - apiGroups: ["traefik.io"]
+    resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
+                "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
+                "serverstransports", "serverstransporttcps"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  type: LoadBalancer
+  selector:
+    app: traefik
+  ports:
+    - name: web
+      port: 80
+      targetPort: 80
+    - name: websecure
+      port: 443
+      targetPort: 443
Author	SHA1	Message	Date
poslop	35b065ec49	Merge pull request 'Dev' (#2 ) from dev into master Reviewed-on: #2	2026-07-23 12:48:53 -05:00
poslop	9698a57aa0	remove hermes permission service	2026-07-23 11:18:42 -05:00
poslop	6ab209cd5e	k3s into configuration for goyplex	2026-07-23 11:15:51 -05:00
poslop	9a0e03657a	netbird: pull encryptionKey from k8s secret	2026-07-21 21:25:58 -05:00
poslop	fcaa023730	netbird: change STUN to port 3479, add trustedHTTPProxies	2026-07-21 21:18:20 -05:00
poslop	f42fd8684e	traefik: add nodes, namespaces, pods to rbac	2026-07-21 20:15:00 -05:00
poslop	2e30fec972	traefik: add endpointslices and configmaps rbac	2026-07-21 20:14:35 -05:00
poslop	7af7864701	traefik: remove TLS/redirect, caddy handles TLS	2026-07-21 20:09:28 -05:00
poslop	40a82aad64	netbird: use web entrypoint, caddy handles TLS	2026-07-21 19:28:35 -05:00
poslop	d2a6887834	refactor(netbird): migrate to single netbird-server container	2026-07-21 19:06:19 -05:00
poslop	9b5af62a47	k3s init	2026-07-21 17:58:58 -05:00
poslop	106cf13597	hermes alias	2026-07-21 11:26:41 -05:00
poslop	336242e201	hermes update	2026-07-21 11:26:28 -05:00