Add netbird-docker volume
This commit is contained in:
parent
d97a085af5
commit
d1cfaf7acf
2 changed files with 206 additions and 4 deletions
8
flake.lock
generated
8
flake.lock
generated
|
|
@ -338,11 +338,11 @@
|
|||
"secrets": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1777076192,
|
||||
"narHash": "sha256-N7n2OPN2IRWwL73Cr6mc5nNhucHmMeFas9hQ/NF0bFg=",
|
||||
"lastModified": 1777152364,
|
||||
"narHash": "sha256-yS8TxtPFFf7xIDNbsErZUnTBLn2fnyCcC4On+t3v1Zs=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "34ff1c4b0460a2e103a8fec183f53f274dc123ed",
|
||||
"revCount": 32,
|
||||
"rev": "bfb7da1297d73100a56a044d09792fc6e59357e6",
|
||||
"revCount": 34,
|
||||
"type": "git",
|
||||
"url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"
|
||||
},
|
||||
|
|
|
|||
202
modules/netbird-docker.nix
Normal file
202
modules/netbird-docker.nix
Normal file
|
|
@ -0,0 +1,202 @@
|
|||
{
|
||||
pkgs,
|
||||
utils,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
|
||||
cfg = config.services.netbird-docker;
|
||||
netbirdCfg = config.services.netbird;
|
||||
|
||||
serverVersion = "0.69.0";
|
||||
dashboardVersion = "2.37.1";
|
||||
|
||||
in {
|
||||
|
||||
options.services.netbird-docker = {
|
||||
enable = lib.mkEnableOption "Netbird Server stack, comprising the dashboard, management API, signal service, relay and STUN server";
|
||||
enableLocalAuth = lib.mkEnableOption "local authentication";
|
||||
proxy = lib.mkOption {
|
||||
description = "Configuration for proxy";
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
domain = lib.mkOption {
|
||||
description = "Domain the proxy is reachable at. Custom domains will need to add a CNAME record of the wildcard subdomain to this domain.";
|
||||
type = lib.types.str;
|
||||
};
|
||||
token-secret = lib.mkOption {
|
||||
description = ''
|
||||
Proxy token in env-file notation.
|
||||
Name of the environment variable is `NB_PROXY_TOKEN`.
|
||||
Create the proxy token after netbird is installed with the following command: docker exec -it netbird-server /go/bin/netbird-server --config /etc/netbird/config.yaml token create --name local
|
||||
'';
|
||||
type = lib.types.anything;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
secrets = lib.mkOption {
|
||||
description = ''
|
||||
Secret for combined server in env-file notation.
|
||||
Name of the relevant environment variables:
|
||||
- NETBIRD_RELAY_AUTH_SECRET - Shared authentication secret for relay
|
||||
- NETBIRD_DATASTORE_ENC_KEY - Encryption key for sensitive data
|
||||
'';
|
||||
type = lib.types.anything;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
virtualisation.oci-containers.containers = {
|
||||
netbird-dashboard = {
|
||||
image = "netbirdio/dashboard:v${dashboardVersion}";
|
||||
autoStart = true;
|
||||
networks = [
|
||||
"webproxy"
|
||||
];
|
||||
environment = {
|
||||
NETBIRD_MGMT_API_ENDPOINT = "https://${netbirdCfg.server.management.domain}";
|
||||
NETBIRD_MGMT_GRPC_API_ENDPOINT = "https://${netbirdCfg.server.management.domain}";
|
||||
AUTH_AUDIENCE="netbird-dashboard";
|
||||
AUTH_CLIENT_ID="netbird-dashboard";
|
||||
AUTH_CLIENT_SECRET="";
|
||||
AUTH_AUTHORITY = "https://${netbirdCfg.server.domain}/oauth2";
|
||||
USE_AUTH0="false";
|
||||
AUTH_SUPPORTED_SCOPES="openid profile email groups";
|
||||
AUTH_REDIRECT_URI="/nb-auth";
|
||||
AUTH_SILENT_REDIRECT_URI="/nb-silent-auth";
|
||||
NGINX_SSL_PORT="443";
|
||||
LETSENCRYPT_DOMAIN="none";
|
||||
};
|
||||
labels = {
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.netbird-dashboard.rule" = "Host(`${netbirdCfg.server.dashboard.domain}`)";
|
||||
"traefik.http.routers.netbird-dashboard.entrypoints" = "websecure";
|
||||
"traefik.http.routers.netbird-dashboard.tls" = "true";
|
||||
"traefik.http.routers.netbird-dashboard.tls.certresolver" = "letsencrypt";
|
||||
"traefik.http.routers.netbird-dashboard.service" = "dashboard";
|
||||
"traefik.http.routers.netbird-dashboard.priority" = "1";
|
||||
"traefik.http.services.dashboard.loadbalancer.server.port" = "80";
|
||||
};
|
||||
};
|
||||
netbird-server = {
|
||||
image = "netbirdio/netbird-server:${serverVersion}";
|
||||
autoStart = true;
|
||||
networks = [
|
||||
"webproxy"
|
||||
];
|
||||
entrypoint = "/bin/sh";
|
||||
cmd = [
|
||||
"-c"
|
||||
''sed -e "s|__AUTH_SECRET__|$NETBIRD_RELAY_AUTH_SECRET|" -e "s|__DATASTORE_ENC_KEY__|$NETBIRD_DATASTORE_ENC_KEY|" /etc/netbird/config.yaml.tmpl > /etc/netbird/config.yaml && /go/bin/netbird-server --config /etc/netbird/config.yaml''
|
||||
];
|
||||
ports = [
|
||||
"3478:3478/udp"
|
||||
];
|
||||
volumes = let
|
||||
server-config = (pkgs.formats.yaml {}).generate "netbird-server-config" {
|
||||
server = {
|
||||
listenAddress = ":80";
|
||||
exposedAddress = "https://${netbirdCfg.server.domain}:443";
|
||||
stunPorts = [ 3478 ];
|
||||
metricsPort = 9090;
|
||||
healthCheckAddress = ":9000";
|
||||
logLevel = netbirdCfg.server.management.logLevel;
|
||||
logFile = "console";
|
||||
authSecret = "__AUTH_SECRET__";
|
||||
dataDir = "/var/lib/netbird";
|
||||
auth = {
|
||||
issuer = "https://${netbirdCfg.server.dashboard.domain}/oauth2";
|
||||
localAuthDisabled = !cfg.enableLocalAuth;
|
||||
signKeyRefreshEnabled = true;
|
||||
dashboardRedirectURIs = [
|
||||
"https://${netbirdCfg.server.dashboard.domain}/nb-auth"
|
||||
"https://${netbirdCfg.server.dashboard.domain}/nb-silent-auth"
|
||||
];
|
||||
cliRedirectURIs = [
|
||||
"http://localhost:53000"
|
||||
];
|
||||
};
|
||||
reverseProxy.trustedHTTPProxies = [
|
||||
"172.18.0.2/32"
|
||||
];
|
||||
store = {
|
||||
engine = "sqlite";
|
||||
encryptionKey = "__DATASTORE_ENC_KEY__";
|
||||
};
|
||||
};
|
||||
};
|
||||
in [
|
||||
"${server-config}:/etc/netbird/config.yaml.tmpl"
|
||||
];
|
||||
environmentFiles = [
|
||||
cfg.secrets.path
|
||||
];
|
||||
extraOptions = [
|
||||
''--mount=type=volume,source=netbird_data,target=/var/lib/netbird,volume-driver=local''
|
||||
];
|
||||
labels = {
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.netbird-grpc.rule" = "Host(`${netbirdCfg.server.signal.domain}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`))";
|
||||
"traefik.http.routers.netbird-grpc.entrypoints" = "websecure";
|
||||
"traefik.http.routers.netbird-grpc.tls" = "true";
|
||||
"traefik.http.routers.netbird-grpc.tls.certresolver" = "letsencrypt";
|
||||
"traefik.http.routers.netbird-grpc.service" = "netbird-server-h2c";
|
||||
"traefik.http.routers.netbird-grpc.priority" = "100";
|
||||
"traefik.http.routers.netbird-backend.rule" = "Host(`${netbirdCfg.server.domain}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))";
|
||||
"traefik.http.routers.netbird-backend.entrypoints" = "websecure";
|
||||
"traefik.http.routers.netbird-backend.tls" = "true";
|
||||
"traefik.http.routers.netbird-backend.tls.certresolver" = "letsencrypt";
|
||||
"traefik.http.routers.netbird-backend.service" = "netbird-server";
|
||||
"traefik.http.routers.netbird-backend.priority" = "100";
|
||||
"traefik.http.services.netbird-server.loadbalancer.server.port" = "80";
|
||||
"traefik.http.services.netbird-server-h2c.loadbalancer.server.port" = "80";
|
||||
"traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme" = "h2c";
|
||||
};
|
||||
};
|
||||
netbird-proxy = {
|
||||
image = "netbirdio/reverse-proxy:${serverVersion}";
|
||||
autoStart = true;
|
||||
ports = [
|
||||
"51820:51820/udp"
|
||||
];
|
||||
networks = [
|
||||
"webproxy"
|
||||
];
|
||||
dependsOn = [
|
||||
"netbird-server"
|
||||
];
|
||||
environment = {
|
||||
NB_PROXY_MANAGEMENT_ADDRESS="http://netbird-server:80";
|
||||
NB_PROXY_ALLOW_INSECURE="true";
|
||||
NB_PROXY_DOMAIN = cfg.proxy.domain;
|
||||
NB_PROXY_ADDRESS = ":8443";
|
||||
NB_PROXY_CERTIFICATE_DIRECTORY = "/certs";
|
||||
NB_PROXY_ACME_CERTIFICATES = "true";
|
||||
NB_PROXY_ACME_CHALLENGE_TYPE = "tls-alpn-01";
|
||||
NB_PROXY_FORWARDED_PROTO = "https";
|
||||
NB_PROXY_PROXY_PROTOCOL = "true";
|
||||
NB_PROXY_TRUSTED_PROXIES = "172.18.0.2";
|
||||
};
|
||||
environmentFiles = [
|
||||
cfg.proxy.token-secret.path
|
||||
];
|
||||
extraOptions = [
|
||||
''--mount=type=volume,source=netbird_proxy_certs,target=/certs,volume-driver=local''
|
||||
];
|
||||
labels = {
|
||||
"traefik.enable" = "true";
|
||||
"traefik.tcp.routers.proxy-passthrough.entrypoints" = "websecure";
|
||||
"traefik.tcp.routers.proxy-passthrough.rule" = "HostSNI(`*`)";
|
||||
"traefik.tcp.routers.proxy-passthrough.tls.passthrough" = "true";
|
||||
"traefik.tcp.routers.proxy-passthrough.service" = "proxy-tls";
|
||||
"traefik.tcp.routers.proxy-passthrough.priority" = "1";
|
||||
"traefik.tcp.services.proxy-tls.loadbalancer.server.port" = "8443";
|
||||
"traefik.tcp.services.proxy-tls.loadbalancer.serverstransport" = "pp-v2@file";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue