feat(netbird): manifest-driven migration via reusable orchestrator primitives
Migrate the netbird stack (server/dashboard/proxy) off ~500 lines of per-app Rust to 3 declarative manifests, adding 4 reusable primitives: - SecretGenKind::Base64 (netbird relay authSecret + sqlite store encryptionKey) - GeneratedCert schema + ensure_manifest_certs (self-signed TLS so the dashboard gets a secure context for OIDC PKCE — issue #15; https proxy on 8087 preserved) - templated GeneratedFile render: {{HOST_IP}}/{{HOST_MDNS}}/{{NETWORK_GATEWAY}} (aardvark resolver for the #15 stale-IP fix) /{{secret:NAME}} (never logged) - legacy create_container now honours port.protocol (3478/udp STUN) install_netbird_stack routes via the orchestrator first (legacy kept as fallback, mirroring indeedhub); launch URL derives https://{host_ip}:8087 from host facts. Legacy Rust deletion deferred to post-live-verify. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
archipelago
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
3c36cf1c40
commit
a8b9b0f5e8
@@ -0,0 +1,77 @@
|
||||
app:
|
||||
id: netbird-dashboard
|
||||
name: NetBird Dashboard
|
||||
version: "2.38.0"
|
||||
description: NetBird management dashboard (SPA). Internal stack member served through the netbird proxy.
|
||||
category: networking
|
||||
|
||||
# Hyphen name matches runtime references + the live container (adoption).
|
||||
# Alias `netbird-dashboard` is the short hostname the proxy's nginx proxies to.
|
||||
container_name: netbird-dashboard
|
||||
|
||||
container:
|
||||
image: docker.io/netbirdio/dashboard:v2.38.0
|
||||
pull_policy: if-not-present
|
||||
network: netbird-net
|
||||
network_aliases: [netbird-dashboard]
|
||||
# The dashboard SPA bakes its API/OIDC base URL from these at container
|
||||
# start. They must point at the proxy's public HTTPS origin (8087) so the
|
||||
# browser uses a secure context (window.crypto.subtle / OIDC PKCE, #15).
|
||||
# {{HOST_IP}} is the node's primary host IP, resolved at apply time.
|
||||
derived_env:
|
||||
- key: NETBIRD_MGMT_API_ENDPOINT
|
||||
template: "https://{{HOST_IP}}:8087"
|
||||
- key: NETBIRD_MGMT_GRPC_API_ENDPOINT
|
||||
template: "https://{{HOST_IP}}:8087"
|
||||
- key: AUTH_AUTHORITY
|
||||
template: "https://{{HOST_IP}}:8087/oauth2"
|
||||
|
||||
dependencies:
|
||||
- app_id: netbird-server
|
||||
|
||||
resources:
|
||||
memory_limit: 256Mi
|
||||
|
||||
security:
|
||||
# cap-drop=ALL is applied by the orchestrator. The dashboard image runs
|
||||
# nginx (master as root, drops workers) binding :80 — needs the worker-drop
|
||||
# caps + NET_BIND_SERVICE for the privileged port.
|
||||
capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID, NET_BIND_SERVICE]
|
||||
readonly_root: false
|
||||
network_policy: isolated
|
||||
|
||||
# Internal only — reached container-to-container by the proxy via netbird-net.
|
||||
ports: []
|
||||
|
||||
volumes: []
|
||||
|
||||
environment:
|
||||
- AUTH_AUDIENCE=netbird-dashboard
|
||||
- AUTH_CLIENT_ID=netbird-dashboard
|
||||
- AUTH_CLIENT_SECRET=
|
||||
- USE_AUTH0=false
|
||||
- AUTH_SUPPORTED_SCOPES=openid profile email groups
|
||||
- AUTH_REDIRECT_URI=/nb-auth
|
||||
- AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
|
||||
- NETBIRD_TOKEN_SOURCE=idToken
|
||||
- NGINX_SSL_PORT=443
|
||||
- LETSENCRYPT_DOMAIN=none
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:80
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
|
||||
metadata:
|
||||
author: NetBird
|
||||
icon: /assets/img/app-icons/netbird.svg
|
||||
website: https://netbird.io
|
||||
repo: https://github.com/netbirdio/dashboard
|
||||
license: BSD-3-Clause
|
||||
tags:
|
||||
- networking
|
||||
- vpn
|
||||
- dashboard
|
||||
@@ -0,0 +1,122 @@
|
||||
app:
|
||||
id: netbird-server
|
||||
name: NetBird Server
|
||||
version: "0.71.2"
|
||||
description: NetBird combined management / signal / relay server with an embedded identity provider and STUN. Backend for the self-hosted NetBird mesh VPN.
|
||||
category: networking
|
||||
|
||||
# Hyphen name matches the runtime references (crash_recovery / dependencies /
|
||||
# config startup order) + the live container, so on an existing node the
|
||||
# orchestrator ADOPTS the running server rather than recreating it (data +
|
||||
# the sqlite store under /var/lib/netbird preserved). Alias `netbird-server`
|
||||
# is the short hostname the proxy's nginx proxies/grpc-passes to.
|
||||
container_name: netbird-server
|
||||
|
||||
container:
|
||||
image: docker.io/netbirdio/netbird-server:0.71.2
|
||||
pull_policy: if-not-present
|
||||
network: netbird-net
|
||||
network_aliases: [netbird-server]
|
||||
# The relay authSecret and the sqlite store encryptionKey are base64 keys
|
||||
# (the server base64-decodes them to recover raw bytes — hex would decode to
|
||||
# the wrong value). Generated once and reused: ensure_generated_secrets
|
||||
# no-ops when the file already exists, so a re-render of config.yaml on an
|
||||
# adopted node keeps the same keys (regenerating would orphan the store).
|
||||
generated_secrets:
|
||||
- name: netbird-relay-auth-secret
|
||||
kind: base64
|
||||
- name: netbird-store-encryption-key
|
||||
kind: base64
|
||||
# Pass the rendered config explicitly, mirroring the legacy `--config` arg.
|
||||
custom_args: ["--config", "/etc/netbird/config.yaml"]
|
||||
|
||||
dependencies:
|
||||
- storage: 1Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 1Gi
|
||||
|
||||
security:
|
||||
# cap-drop=ALL is applied by the orchestrator. The server binds :80
|
||||
# (management/signal/relay HTTP + gRPC) inside the container — a privileged
|
||||
# port — so it needs NET_BIND_SERVICE. STUN is 3478/udp (unprivileged).
|
||||
capabilities: [NET_BIND_SERVICE]
|
||||
readonly_root: false
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
- host: 8086
|
||||
container: 80
|
||||
protocol: tcp # management API + embedded OIDC issuer (/oauth2)
|
||||
- host: 3478
|
||||
container: 3478
|
||||
protocol: udp # STUN — must be UDP; tcp here breaks relay discovery
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/netbird/data
|
||||
target: /var/lib/netbird
|
||||
options: [rw]
|
||||
# The rendered config.yaml, read-only. Re-rendered on every reconcile from
|
||||
# host facts + the base64 secrets; idempotent (stable bytes → no restart).
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/netbird/config.yaml
|
||||
target: /etc/netbird/config.yaml
|
||||
options: [ro]
|
||||
|
||||
environment: []
|
||||
|
||||
# The server's config. {{HOST_IP}} is the node's primary host IP (the proxy's
|
||||
# public origin is https on 8087 — the dashboard needs a secure context for
|
||||
# OIDC PKCE, issue #15). {{secret:...}} are read 0600 from the secrets dir.
|
||||
files:
|
||||
- path: /var/lib/archipelago/netbird/config.yaml
|
||||
overwrite: true
|
||||
content: |
|
||||
server:
|
||||
listenAddress: ":80"
|
||||
exposedAddress: "https://{{HOST_IP}}:8087"
|
||||
stunPorts:
|
||||
- 3478
|
||||
metricsPort: 9090
|
||||
healthcheckAddress: ":9000"
|
||||
logLevel: "info"
|
||||
logFile: "console"
|
||||
authSecret: "{{secret:netbird-relay-auth-secret}}"
|
||||
dataDir: "/var/lib/netbird"
|
||||
auth:
|
||||
issuer: "https://{{HOST_IP}}:8087/oauth2"
|
||||
localAuthDisabled: false
|
||||
signKeyRefreshEnabled: false
|
||||
dashboardRedirectURIs:
|
||||
- "https://{{HOST_IP}}:8087/nb-auth"
|
||||
- "https://{{HOST_IP}}:8087/nb-silent-auth"
|
||||
dashboardPostLogoutRedirectURIs:
|
||||
- "https://{{HOST_IP}}:8087/"
|
||||
cliRedirectURIs:
|
||||
- "http://localhost:53000/"
|
||||
store:
|
||||
engine: "sqlite"
|
||||
encryptionKey: "{{secret:netbird-store-encryption-key}}"
|
||||
|
||||
# TCP liveness on the management port. Binds at startup, stays green; an http
|
||||
# check of /oauth2 would false-fail while the issuer warms up.
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:80
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
start_period: 30s
|
||||
|
||||
metadata:
|
||||
author: NetBird
|
||||
icon: /assets/img/app-icons/netbird.svg
|
||||
website: https://netbird.io
|
||||
repo: https://github.com/netbirdio/netbird
|
||||
license: BSD-3-Clause
|
||||
tags:
|
||||
- networking
|
||||
- vpn
|
||||
- wireguard
|
||||
- mesh
|
||||
@@ -0,0 +1,182 @@
|
||||
app:
|
||||
id: netbird
|
||||
name: NetBird
|
||||
version: "2.38.0"
|
||||
description: Self-hosted WireGuard mesh VPN control plane with dashboard, embedded identity provider, management API, signal, relay, and STUN. The user-facing entry point — a TLS proxy in front of the dashboard + server.
|
||||
category: networking
|
||||
|
||||
# The user-facing launcher (app_id + container both "netbird", matching the
|
||||
# runtime references + the live container so the orchestrator adopts it). This
|
||||
# is the nginx that terminates TLS on 8087 and fans out to the dashboard +
|
||||
# server by their short aliases on netbird-net.
|
||||
container_name: netbird
|
||||
|
||||
container:
|
||||
image: docker.io/library/nginx:1.27-alpine
|
||||
pull_policy: if-not-present
|
||||
network: netbird-net
|
||||
# Self-signed TLS cert materialised before create — the dashboard needs a
|
||||
# secure context (window.crypto.subtle / OIDC PKCE, issue #15), so the proxy
|
||||
# serves HTTPS. Idempotent: kept as-is when crt+key already exist (a user
|
||||
# accepts it once). SAN defaults to the host IP + 127.0.0.1 + localhost.
|
||||
generated_certs:
|
||||
- crt: /var/lib/archipelago/netbird/tls.crt
|
||||
key: /var/lib/archipelago/netbird/tls.key
|
||||
|
||||
dependencies:
|
||||
- app_id: netbird-server
|
||||
- app_id: netbird-dashboard
|
||||
- storage: 1Gi
|
||||
|
||||
resources:
|
||||
memory_limit: 256Mi
|
||||
|
||||
security:
|
||||
# cap-drop=ALL is applied by the orchestrator. nginx (master as root, drops
|
||||
# workers) binds :443 — needs the worker-drop caps + NET_BIND_SERVICE.
|
||||
capabilities: [CHOWN, DAC_OVERRIDE, SETGID, SETUID, NET_BIND_SERVICE]
|
||||
readonly_root: false
|
||||
network_policy: isolated
|
||||
|
||||
ports:
|
||||
# 8087 publishes the TLS listener (container :443). HTTPS is required for the
|
||||
# dashboard's secure context (issue #15).
|
||||
- host: 8087
|
||||
container: 443
|
||||
protocol: tcp
|
||||
|
||||
volumes:
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/netbird/nginx.conf
|
||||
target: /etc/nginx/conf.d/default.conf
|
||||
options: [ro]
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/netbird/tls.crt
|
||||
target: /etc/nginx/tls.crt
|
||||
options: [ro]
|
||||
- type: bind
|
||||
source: /var/lib/archipelago/netbird/tls.key
|
||||
target: /etc/nginx/tls.key
|
||||
options: [ro]
|
||||
|
||||
environment: []
|
||||
|
||||
# The proxy config. {{NETWORK_GATEWAY}} is the netbird-net bridge gateway =
|
||||
# Podman's aardvark DNS. nginx uses it as an explicit `resolver` with VARIABLE
|
||||
# upstreams so it re-resolves container names per request — without it nginx
|
||||
# pins a container IP at startup and 502s forever once that IP moves on a
|
||||
# restart/reboot (issue #15, observed live on .198). Every #15 fix below
|
||||
# (CORS $http_origin reflect, grpc pass, nb-auth/nb-silent-auth rewrite to
|
||||
# index.html, /relay websocket) is preserved verbatim from the legacy config.
|
||||
files:
|
||||
- path: /var/lib/archipelago/netbird/nginx.conf
|
||||
overwrite: true
|
||||
content: |
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name _;
|
||||
|
||||
# netbird's dashboard needs a secure context (window.crypto.subtle for
|
||||
# OIDC PKCE), so the proxy terminates TLS with a self-signed cert (#15).
|
||||
ssl_certificate /etc/nginx/tls.crt;
|
||||
ssl_certificate_key /etc/nginx/tls.key;
|
||||
|
||||
# Rootless Podman can hand a container a new IP across restarts/reboots.
|
||||
# nginx resolves a literal upstream name ONCE at startup and caches it,
|
||||
# so after the IP moves every request 502s with "host unreachable"
|
||||
# (issue #15, observed live on .198: nginx pinned to a dead
|
||||
# netbird-dashboard IP). Fix: point `resolver` at the netbird-net
|
||||
# gateway (Podman's aardvark DNS) and use VARIABLE upstreams, which
|
||||
# forces nginx to re-resolve the container names at request time.
|
||||
resolver {{NETWORK_GATEWAY}} valid=10s ipv6=off;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
location ~ ^/(relay|ws-proxy/) {
|
||||
set $nb_server netbird-server;
|
||||
proxy_pass http://$nb_server:80;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_read_timeout 1d;
|
||||
}
|
||||
|
||||
location ~ ^/(api|oauth2)(/|$) {
|
||||
# The dashboard is a SPA whose API/OIDC base URL is baked at build
|
||||
# time to one host:port. A single box is reached via several
|
||||
# addresses, so those fetches are cross-origin and the browser
|
||||
# blocks them with no Access-Control-Allow-Origin (#15, live on
|
||||
# .198). Reflect the caller's Origin and answer the CORS preflight.
|
||||
if ($request_method = OPTIONS) {
|
||||
add_header Access-Control-Allow-Origin $http_origin always;
|
||||
add_header Access-Control-Allow-Credentials true always;
|
||||
add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Accept" always;
|
||||
add_header Access-Control-Max-Age 86400 always;
|
||||
add_header Content-Length 0;
|
||||
return 204;
|
||||
}
|
||||
add_header Access-Control-Allow-Origin $http_origin always;
|
||||
add_header Access-Control-Allow-Credentials true always;
|
||||
add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
|
||||
add_header Access-Control-Allow-Headers "Authorization, Content-Type, Accept" always;
|
||||
set $nb_server netbird-server;
|
||||
proxy_pass http://$nb_server:80;
|
||||
}
|
||||
|
||||
location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService|management\.ProxyService)/ {
|
||||
set $nb_server netbird-server;
|
||||
grpc_pass grpc://$nb_server:80;
|
||||
grpc_read_timeout 1d;
|
||||
grpc_send_timeout 1d;
|
||||
}
|
||||
|
||||
# OIDC callback routes are client-side SPA routes with NO prebuilt page
|
||||
# in the dashboard bundle, so proxying them straight through 404s —
|
||||
# which crashes the dashboard's auth init and shows "Unauthenticated"
|
||||
# with dead buttons (#15, live on .198: /nb-auth + /nb-silent-auth
|
||||
# returned 404). Serve index.html at these paths (URL unchanged) so
|
||||
# react-oidc boots and completes the login / silent-SSO.
|
||||
location ~ ^/(nb-auth|nb-silent-auth) {
|
||||
set $nb_dashboard netbird-dashboard;
|
||||
rewrite ^.*$ /index.html break;
|
||||
proxy_pass http://$nb_dashboard:80;
|
||||
}
|
||||
|
||||
location / {
|
||||
set $nb_dashboard netbird-dashboard;
|
||||
proxy_pass http://$nb_dashboard:80;
|
||||
}
|
||||
}
|
||||
|
||||
health_check:
|
||||
type: tcp
|
||||
endpoint: localhost:443
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 20s
|
||||
|
||||
interfaces:
|
||||
main:
|
||||
name: Dashboard
|
||||
description: Manage your self-hosted NetBird mesh VPN
|
||||
type: ui
|
||||
port: 8087
|
||||
protocol: https
|
||||
path: /
|
||||
|
||||
metadata:
|
||||
author: NetBird
|
||||
icon: /assets/img/app-icons/netbird.svg
|
||||
website: https://netbird.io
|
||||
repo: https://github.com/netbirdio/netbird
|
||||
license: BSD-3-Clause
|
||||
tags:
|
||||
- networking
|
||||
- vpn
|
||||
- wireguard
|
||||
- mesh
|
||||
Reference in New Issue
Block a user