AZ-Intec-GmbH/AZ-NIX-SERVERS
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enable netbird agent network on existing proxy

Browse Source 
Agent Network needs NB_PROXY_PRIVATE=true on the single existing
reverse-proxy, not a separate container. The previous standalone
an-proxy had no TLS cert (removed certs volume + ACME) and crashed
with 'open certs/tls.crt: no such file', so its overlay peer IP
(100.91.226.149) never came up and drop.p.az-gruppe.com timed out.

The auto-generated endpoint under the existing *.p.az-gruppe.com
wildcard (drop.p.az-gruppe.com -> overlay peer IP via MagicDNS) is
the correct URL; the invented a.az-gruppe.com had no DNS.

- set NB_PROXY_PRIVATE=true on netbird-proxy (keeps ACME + certs)
- remove standalone netbird-an-proxy container, anProxyIp, anProxyDomain
- drop netbird-an-proxy-env secret (nix refs + age file)
This commit is contained in:
sascha.koenig
2026-08-04 12:47:23 +02:00
parent bdfeb1f36c
commit 165ac75ba9
4 changed files with 8 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/AZ-CLD-1/secrets.nix
-3
View File
@@ -61,9 +61,6 @@
netbird-proxy-env = {
file = ../../secrets/netbird-proxy-env.age;
};
netbird-an-proxy-env = {
file = ../../secrets/netbird-an-proxy-env.age;
};
outline-env = {
file = ../../secrets/outline-env.age;
owner = "outline";
hosts/AZ-CLD-1/services/containers/netbird.nix
+8 -18
View File
@@ -18,7 +18,6 @@
dashboardIp = "${ipBase}.${toString ipOffset}";
serverIp = "${ipBase}.${toString (ipOffset + 1)}";
proxyIp = "${ipBase}.${toString (ipOffset + 2)}";
anProxyIp = "${ipBase}.${toString (ipOffset + 3)}";
# Database configuration
dbName = "netbird";
@@ -95,7 +94,6 @@ in {
age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
age.secrets."${serviceName}-an-proxy-env".file = ../../../../secrets/${serviceName}-an-proxy-env.age;
# Systemd oneshot service to generate config with secrets
systemd.services."${serviceName}-config" = {
@@ -154,6 +152,14 @@ in {
volumes = [
"${serviceName}_proxy_certs:/certs"
];
environment = {
# Enable private services (NetBird Agent Network). Reachable only
# over the WireGuard overlay; endpoints are auto-generated under the
# proxy domain (e.g. <name>.p.az-gruppe.com) with a MagicDNS record
# pointing at this proxy's overlay peer IP. TLS is still terminated
# here via the existing ACME wildcard cert.
NB_PROXY_PRIVATE = "true";
};
environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
cmd = [
"--domain=${proxyDomain}"
@@ -169,22 +175,6 @@ in {
"--network=web"
];
};
"${serviceName}-an-proxy" = {
image = "netbirdio/reverse-proxy:latest";
autoStart = true;
environment = {
NB_PROXY_PRIVATE = "true";
NB_PROXY_MANAGEMENT_ADDRESS = "http://${serverIp}:80";
NB_PROXY_ALLOW_INSECURE = "true";
};
environmentFiles = [config.age.secrets."${serviceName}-an-proxy-env".path];
dependsOn = ["${serviceName}-server"];
extraOptions = [
"--ip=${anProxyIp}"
"--network=web"
];
};
};
services.traefik.dynamicConfigOptions = {