gitops/homelab-v
1
0
Fork 0
mirror of https://github.com/outbackdingo/homelab-v.git synced 2026-08-25 14:53:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

wip(netbird): fix config

Browse Source 
Signed-off-by: Vegard Hagen <[email protected]>
This commit is contained in:
Vegard Hagen
2025-11-16 19:00:02 +01:00
parent 3b812ed476
commit 6f93a2c9d4
12 changed files with 250 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/apps/dev/whoami/http-route.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: whoami
namespace: whoami
spec:
parentRefs:
- { name: external, namespace: gateway }
- { name: internal, namespace: gateway }
hostnames: [ "whoami.stonegarden.dev" ]
rules:
- backendRefs: [ { name: whoami, port: 80 } ]
matches:
- path: { type: PathPrefix, value: / }
k8s/apps/dev/whoami/kustomization.yaml
+1
View File
@@ -4,4 +4,5 @@ kind: Kustomization
resources:
- ns.yaml
- svc.yaml
- http-route.yaml
- deployment.yaml
k8s/infra/network/cilium/values.yaml
+1 -1
View File
@@ -81,7 +81,7 @@ loadBalancer:
gatewayAPI:
enabled: true
enableAlpn: true
# enableAppProtocol: true
enableAppProtocol: true
envoy:
prometheus:
k8s/infra/vpn/netbird/agent/daemon-set.yaml
+5
View File
@@ -12,6 +12,11 @@ spec:
labels:
app: agent
spec:
dnsConfig:
nameservers:
- 10.96.0.12 # AdGuard Home
- 10.96.0.11 # Unbound
dnsPolicy: None
securityContext:
seccompProfile:
type: RuntimeDefault
k8s/infra/vpn/netbird/grpc-route.yaml
+1 -1
View File
@@ -13,7 +13,7 @@ spec:
matches:
- headers: [ { name: Content-Type, value: application/grpc } ]
- method: { service: management.ManagementService }
- backendRefs: [ { name: signal, port: 80 } ]
- backendRefs: [ { name: signal, port: 10000 } ]
matches:
- headers: [ { name: Content-Type, value: application/grpc } ]
- method: { service: signalexchange.SignalExchange }
k8s/infra/vpn/netbird/kustomization.yaml
+9
View File
@@ -13,3 +13,12 @@ resources:
- management
- relay
- signal
#helmCharts:
# - name: netbird
# repo: https://netbirdio.github.io/helms
# version: 1.9.0 # renovate: github-releases=netbirdio/helms
# releaseName: netbird
# includeCRDs: true
# namespace: netbird
# valuesFile: values.yaml
k8s/infra/vpn/netbird/management/deployment.yaml
-1
View File
@@ -20,7 +20,6 @@ spec:
topology.kubernetes.io/zone: abel
dnsConfig:
nameservers:
- 172.20.10.153 # AdGuard Home
- 10.96.0.12 # AdGuard Home
- 10.96.0.11 # Unbound
dnsPolicy: None
k8s/infra/vpn/netbird/management/svc.yaml
+1 -1
View File
@@ -10,5 +10,5 @@ spec:
ports:
- name: http
port: 80
appProtocol: kubernetes.io/h2c
targetPort: http
appProtocol: kubernetes.io/h2c
k8s/infra/vpn/netbird/relay/svc.yaml
-2
View File
@@ -3,8 +3,6 @@ kind: Service
metadata:
name: relay
namespace: netbird
labels:
app.kubernetes.io/name: relay
spec:
type: ClusterIP
selector:
k8s/infra/vpn/netbird/signal/deployment.yaml
+2
View File
@@ -39,6 +39,8 @@ spec:
ports:
- name: http
containerPort: 80
- name: legacy-grpc
containerPort: 10000
livenessProbe:
tcpSocket:
port: http
k8s/infra/vpn/netbird/signal/svc.yaml
+5 -1
View File
@@ -10,5 +10,9 @@ spec:
ports:
- name: http
port: 80
appProtocol: kubernetes.io/h2c
targetPort: http
# appProtocol: kubernetes.io/h2c
- name: grpc
port: 10000
targetPort: legacy-grpc
appProtocol: kubernetes.io/h2c
k8s/infra/vpn/netbird/values.yaml
+211
View File
@@ -0,0 +1,211 @@
# https://github.com/netbirdio/helms/blob/main/charts/netbird/values.yaml
fullnameOverride: netbird
management:
configmap: |-
{
"Stuns": [
{
"Proto": "udp",
"URI": "{{ .STUN_SERVER }}",
"Username": "",
"Password": ""
}
],
"TURNConfig": {
"TimeBasedCredentials": false,
"CredentialsTTL": "12h0m0s",
"Secret": "secret",
"Turns": [
{
"Proto": "udp",
"URI": "{{ .TURN_SERVER }}",
"Username": "{{ .TURN_SERVER_USER }}",
"Password": "{{ .TURN_SERVER_PASSWORD }}"
}
]
},
"Relay": {
"Addresses": ["rels://netbird.example.com:443/relay"],
"CredentialsTTL": "24h",
"Secret": "{{ .RELAY_PASSWORD }}"
},
"Signal": {
"Proto": "https",
"URI": "netbird.example.com:443",
"Username": "",
"Password": ""
},
"Datadir": "/var/lib/netbird/",
"DataStoreEncryptionKey": "{{ .DATASTORE_ENCRYPTION_KEY }}",
"HttpConfig": {
"LetsEncryptDomain": "",
"CertFile": "",
"CertKey": "",
"AuthAudience": "{{ .IDP_CLIENT_ID }}",
"AuthIssuer": "https://idp.example.com/application/o/netbird/",
"AuthUserIDClaim": "",
"AuthKeysLocation": "https://idp.example.com/application/o/netbird/jwks/",
"OIDCConfigEndpoint": "https://idp.example.com/application/o/netbird/.well-known/openid-configuration",
"IdpSignKeyRefreshEnabled": false
},
"IdpManagerConfig": {
"ManagerType": "authentik",
"ClientConfig": {
"Issuer": "https://idp.example.com/application/o/totmicro-traefik-netbird",
"TokenEndpoint": "https://idp.example.com/application/o/token/",
"ClientID": "{{ .IDP_CLIENT_ID }}",
"ClientSecret": "",
"GrantType": "client_credentials"
},
"ExtraConfig": {
"Password": "{{ .IDP_SERVICE_ACCOUNT_PASSWORD }}",
"Username": "{{ .IDP_SERVICE_ACCOUNT_USER }}"
},
"Auth0ClientCredentials": null,
"AzureClientCredentials": null,
"KeycloakClientCredentials": null,
"ZitadelClientCredentials": null
},
"DeviceAuthorizationFlow": {
"Provider": "hosted",
"ProviderConfig": {
"ClientID": "{{ .IDP_CLIENT_ID }}",
"ClientSecret": "",
"Domain": "idp.example.com",
"Audience": "{{ .IDP_CLIENT_ID }}",
"TokenEndpoint": "https://idp.example.com/application/o/token/",
"DeviceAuthEndpoint": "https://idp.example.com/application/o/device/",
"AuthorizationEndpoint": "",
"Scope": "openid",
"UseIDToken": false,
"RedirectURLs": null
}
},
"PKCEAuthorizationFlow": {
"ProviderConfig": {
"ClientID": "{{ .IDP_CLIENT_ID }}",
"ClientSecret": "",
"Domain": "",
"Audience": "{{ .IDP_CLIENT_ID }}",
"TokenEndpoint": "https://idp.example.com/application/o/token/",
"DeviceAuthEndpoint": "",
"AuthorizationEndpoint": "https://idp.example.com/application/o/authorize/",
"Scope": "openid profile email offline_access api",
"UseIDToken": false,
"RedirectURLs": ["http://localhost:53000"]
}
},
"StoreConfig": {
"Engine": "postgres"
},
"ReverseProxy": {
"TrustedHTTPProxies": null,
"TrustedHTTPProxiesCount": 0,
"TrustedPeers": null
}
}
image:
tag: 0.32.0
persistentVolume:
enabled: false
envFromSecret:
NETBIRD_STORE_ENGINE_POSTGRES_DSN: netbird/postgresDSN
STUN_SERVER: netbird/stunServer
TURN_SERVER: netbird/turnServer
TURN_SERVER_USER: netbird/turnServerUser
TURN_SERVER_PASSWORD: netbird/turnServerPassword
RELAY_PASSWORD: netbird/relayPassword
IDP_CLIENT_ID: netbird/idpClientID
IDP_SERVICE_ACCOUNT_USER: netbird/idpServiceAccountUser
IDP_SERVICE_ACCOUNT_PASSWORD: netbird/idpServiceAccountPassword
DATASTORE_ENCRYPTION_KEY: netbird/datastoreEncryptionKey
signal:
image:
tag: 0.32.0
relay:
image:
tag: 0.32.0
envFromSecret:
NB_AUTH_SECRET: netbird/relayPassword
env:
NB_LOG_LEVEL: info
NB_LISTEN_ADDRESS: ":33080"
NB_EXPOSED_ADDRESS: rels://netbird.example.com:443/relay
dashboard:
enabled: true
image:
tag: v2.9.0
env:
# Endpoints
NETBIRD_MGMT_API_ENDPOINT: https://netbird.example.com:443
NETBIRD_MGMT_GRPC_API_ENDPOINT: https://netbird.example.com:443
# OIDC
AUTH_CLIENT_SECRET:
AUTH_AUTHORITY: https://idp.example.com/application/o/netbird/
USE_AUTH0: false
AUTH_SUPPORTED_SCOPES: openid profile email offline_access api
AUTH_REDIRECT_URI:
AUTH_SILENT_REDIRECT_URI:
NETBIRD_TOKEN_SOURCE: accessToken
NGINX_SSL_PORT:
LETSENCRYPT_DOMAIN:
LETSENCRYPT_EMAIL:
envFromSecret:
AUTH_CLIENT_ID: netbird/idpClientID
AUTH_AUDIENCE: netbird/idpClientID
#extraManifests:
# - apiVersion: traefik.io/v1alpha1
# kind: IngressRoute
# metadata:
# name: netbird-traefik
# labels:
# argocd.argoproj.io/instance: netbird-traefik
# spec:
# entryPoints:
# - websecure
# routes:
# - kind: Rule
# match: Host(`netbird.example.com`) && !PathPrefix(`/api`) && !PathPrefix(`/management`) && !PathPrefix(`/signalexchange`) && !PathPrefix(`/relay`)
# services:
# - name: netbird-traefik-dashboard
# namespace: netbird-traefik
# passHostHeader: true
# port: 80
# - kind: Rule
# match: Host(`netbird.example.com`) && PathPrefix(`/api`)
# services:
# - name: netbird-traefik-management
# namespace: netbird-traefik
# passHostHeader: true
# port: 80
# - kind: Rule
# match: Host(`netbird.example.com`) && PathPrefix(`/relay`)
# services:
# - name: netbird-traefik-relay
# namespace: netbird-traefik
# passHostHeader: true
# port: 33080
# - kind: Rule
# match: Host(`netbird.example.com`) && PathPrefix(`/management`)
# services:
# - name: netbird-traefik-management
# namespace: netbird-traefik
# passHostHeader: true
# port: 80
# scheme: h2c
# - kind: Rule
# match: Host(`netbird.example.com`) && PathPrefix(`/signalexchange`)
# services:
# - name: netbird-traefik-signal
# namespace: netbird-traefik
# passHostHeader: true
# port: 80
# scheme: h2c
# tls:
# secretName: netbird-tls