modules/k3s/k3s.nix

@@ -1,13 +1,11 @@
 {
-  networking.firewall.allowedTCPPorts = [ 6443 80 443 10000 33073 ];
+  networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
   networking.firewall.allowedUDPPorts = [ 3478 ];
-  networking.firewall.allowedUDPPortRanges = [
-    { from = 49152; to = 65535; }
-  ];
 
   services.k3s = {
     enable = true;
     role = "server";
+    extraFlags = "--write-kubeconfig-mode 644";
     manifests = {
       traefik-namespace    = { source = ./traefik/namespace.yaml; };
       traefik-rbac         = { source = ./traefik/rbac.yaml; };
@@ -15,11 +13,9 @@
       traefik-deployment   = { source = ./traefik/deployment.yaml; };
       traefik-service      = { source = ./traefik/service.yaml; };
       netbird-namespace    = { source = ./netbird/namespace.yaml; };
-      netbird-secrets      = { source = ./netbird/secrets.yaml; };
+      netbird-config       = { source = ./netbird/config.yaml; };
-      netbird-coturn       = { source = ./netbird/coturn.yaml; };
+      netbird-server       = { source = ./netbird/server.yaml; };
-      netbird-signal       = { source = ./netbird/signal.yaml; };
+      netbird-dashboard    = { source = ./netbird/dashboard.yaml; };
-      netbird-management   = { source = ./netbird/management.yaml; };
-      netbird-relay        = { source = ./netbird/relay.yaml; };
       netbird-ingress      = { source = ./netbird/ingress.yaml; };
     };
   };

modules/k3s/netbird/config.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-server-config
+  namespace: netbird
+data:
+  config.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://netbird.archfox.org:443"
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: "info"
+      logFile: "console"
+      tls:
+        certFile: ""
+        keyFile: ""
+        letsencrypt:
+          enabled: false
+          dataDir: ""
+          domains: []
+          email: ""
+          awsRoute53: false
+      authSecret: "CHANGE_ME_openssl_rand_-hex_32"
+      dataDir: "/var/lib/netbird/"
+      disableAnonymousMetrics: false
+      disableGeoliteUpdate: false
+      auth:
+        issuer: "https://netbird.archfox.org/oauth2"
+        localAuthDisabled: false
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://netbird.archfox.org/nb-auth"
+          - "https://netbird.archfox.org/nb-silent-auth"
+        cliRedirectURIs:
+          - "http://localhost:53000/"
+      store:
+        engine: "sqlite"
+        dsn: ""
+        encryptionKey: ""

modules/k3s/netbird/coturn.yaml

@@ -1,31 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: coturn
-  namespace: netbird
-spec:
-  selector:
-    matchLabels:
-      app: coturn
-  template:
-    metadata:
-      labels:
-        app: coturn
-    spec:
-      hostNetwork: true
-      containers:
-        - name: coturn
-          image: coturn/coturn
-          args:
-            - --log-file=stdout
-            - --external-ip=archfox.org
-            - --listening-port=3478
-            - --min-port=49152
-            - --max-port=65535
-            - --tls-listening-port=5349
-            - --no-tls
-            - --no-dtls
-            - --realm=netbird.archfox.org
-          securityContext:
-            capabilities:
-              add: ["NET_BIND_SERVICE"]

modules/k3s/netbird/dashboard.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dashboard
+  template:
+    metadata:
+      labels:
+        app: dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:latest
+          ports:
+            - containerPort: 80
+          env:
+            - name: NETBIRD_MGMT_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: NETBIRD_MGMT_GRPC_API_ENDPOINT
+              value: "https://netbird.archfox.org"
+            - name: AUTH_AUDIENCE
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_ID
+              value: "netbird-dashboard"
+            - name: AUTH_CLIENT_SECRET
+              value: ""
+            - name: AUTH_AUTHORITY
+              value: "https://netbird.archfox.org/oauth2"
+            - name: USE_AUTH0
+              value: "false"
+            - name: AUTH_SUPPORTED_SCOPES
+              value: "openid profile email groups"
+            - name: AUTH_REDIRECT_URI
+              value: "/nb-auth"
+            - name: AUTH_SILENT_REDIRECT_URI
+              value: "/nb-silent-auth"
+            - name: LETSENCRYPT_DOMAIN
+              value: "none"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard
+  namespace: netbird
+spec:
+  selector:
+    app: dashboard
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80

modules/k3s/netbird/ingress.yaml

@@ -1,33 +1,28 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: netbird-management
+  name: netbird
   namespace: netbird
 spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`netbird.archfox.org`) && PathPrefix(`/management.ManagementService/`)
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
       kind: Rule
       services:
-        - name: management
+        - name: netbird-server
           port: 80
           scheme: h2c
-    - match: Host(`netbird.archfox.org`) && PathPrefix(`/api/`)
+    - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
       kind: Rule
       services:
-        - name: management
+        - name: netbird-server
           port: 80
-    - match: Host(`netbird.archfox.org`) && PathPrefix(`/signalexchange.SignalExchange/`)
+    - match: Host(`netbird.archfox.org`)
       kind: Rule
+      priority: 1
       services:
-        - name: signal
+        - name: dashboard
-          port: 10000
+          port: 80
-          scheme: h2c
-    - match: Host(`netbird.archfox.org`) && PathPrefix(`/relay`)
-      kind: Rule
-      services:
-        - name: relay
-          port: 33073
   tls:
     certResolver: letsencrypt

modules/k3s/netbird/management.yaml

@@ -1,62 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: management
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: management
-  template:
-    metadata:
-      labels:
-        app: management
-    spec:
-      containers:
-        - name: management
-          image: netbirdio/management:latest
-          args:
-            - --port=80
-            - --log-file=stdout
-            - --log-level=info
-            - --disable-anonymous-metrics=false
-            - --single-account-mode-domain=netbird.archfox.org
-            - --dns-domain=netbird.archfox.org
-          env:
-            - name: NETBIRD_STORE_ENGINE
-              value: "sqlite"
-          ports:
-            - containerPort: 80
-          volumeMounts:
-            - name: mgmt-data
-              mountPath: /var/lib/netbird
-      volumes:
-        - name: mgmt-data
-          persistentVolumeClaim:
-            claimName: mgmt-data
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mgmt-data
-  namespace: netbird
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: management
-  namespace: netbird
-spec:
-  selector:
-    app: management
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80

modules/k3s/netbird/relay.yaml

@@ -1,45 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: relay
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: relay
-  template:
-    metadata:
-      labels:
-        app: relay
-    spec:
-      containers:
-        - name: relay
-          image: netbirdio/relay:latest
-          env:
-            - name: NB_LOG_LEVEL
-              value: "info"
-            - name: NB_LISTEN_ADDRESS
-              value: ":33073"
-            - name: NB_EXPOSED_ADDRESS
-              value: "rels://netbird.archfox.org:443/relay"
-            - name: NB_AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: netbird-secrets
-                  key: relay-auth-secret
-          ports:
-            - containerPort: 33073
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: relay
-  namespace: netbird
-spec:
-  selector:
-    app: relay
-  ports:
-    - name: relay
-      port: 33073
-      targetPort: 33073

modules/k3s/netbird/secrets.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: netbird-secrets
-  namespace: netbird
-type: Opaque
-stringData:
-  # Generate with: openssl rand -base64 32
-  relay-auth-secret: "CHANGE_ME_openssl_rand_-base64_32"

modules/k3s/netbird/server.yaml

@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:latest
+          args: ["--config", "/etc/netbird/config.yaml"]
+          ports:
+            - containerPort: 80
+            - containerPort: 3478
+              protocol: UDP
+            - containerPort: 33073
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /var/lib/netbird
+      volumes:
+        - name: config
+          configMap:
+            name: netbird-server-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: netbird-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-data
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+    - name: grpc-compat
+      port: 33073
+      targetPort: 33073
+    - name: stun
+      port: 3478
+      targetPort: 3478
+      protocol: UDP

modules/k3s/netbird/signal.yaml

@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: signal
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: signal
-  template:
-    metadata:
-      labels:
-        app: signal
-    spec:
-      containers:
-        - name: signal
-          image: netbirdio/signal:latest
-          env:
-            - name: COALESCE_INTERVAL
-              value: "5s"
-          ports:
-            - containerPort: 10000
-          volumeMounts:
-            - name: signal-data
-              mountPath: /var/lib/netbird
-      volumes:
-        - name: signal-data
-          persistentVolumeClaim:
-            claimName: signal-data
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: signal-data
-  namespace: netbird
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: signal
-  namespace: netbird
-spec:
-  selector:
-    app: signal
-  ports:
-    - name: grpc
-      port: 10000
-      targetPort: 10000