nixos/netbird: harden and extend options

[nazarewk]

Description of changes

I have recently extensively tested and fixed all features of Netbird in my own implementation of multi-instance Netbird installations.

While doing so I discovered another multi-instance implementation got merged into nixpkgs #246055 which is slightly different, but still a solid base to upstream the rest of my changes:

• running as DynamicUser it's own user with minimal set of permissions
  • it was there before, but was lacking some of capabilities,
• made some configurations situational
• add more unmanaged interface configurations
• quality of life improvements:
  • configure log level for each interface
  • optionally turn off starting during boot
  • openFirewall by default
  • add shortcuts/wrappers for each created instance

I think it's a pretty good time to upstream, because I will be extensively using it at work: just launched my first Colmena-managed NixOS into GCE.

There are plans to support multi-account connections on the same daemon in Q2/2024 (see the slack message), but it's not known what shape it will take at all.

I decided to implement following significant changes:

• instances must specify a port they will be listening on as it doesn't make much sense to give an immediately conflicting default,
• aliased tunnels to clients, because a word tunnel does not exist in Netbird's nomenclature (unlike some other VPNs) and is pretty misleading. Also clients.* play nicely with my plan to implement a server in near future.
• skipped destructuring expressions (eg: {name, ...}: name -> client: client.name) because they make the code very hard to follow and update with increased number of options,

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[oddlama]

When enabling ui.enable, only the netbird-<name> is added to the system path. The ui wrapper netbird-ui-<name> will not be easily accessible, except for the old netbird.enable where you add an explicit "as-default" wrapper.

And you currently cannot run more than one ui (if you have multiple clients), because the client wants to own /tmp/wiretrustee.pid (which is a bit weird), which especially causes problems when two users want to use netbird. The second user cannot start the ui because the file is already owned by the first user

[nazarewk]

This new module unfortunately causes netbird to segfault on start, except when you use the old enable option. This seems to be because /etc/netbird/config.json contains correct addresses for management url and admin url, while configurations with other directories will have them default to null which causes a segfault because url structs are not expected to be null.
...
EDIT: The culprit actually seems to be related to the prestart script. If the config.json file does not exist yet, netbird will usually populate it using the correct values. But if it doesn't exist before running the pre-start script, it will be created containing only a subset of the required values, causing netbird to assume they should be unset or something.

might be caused by merging/lack of netbirdio/netbird#1586 , I'll simply rebase today and try to address your comments tomorrow.

[nazarewk]

When enabling ui.enable, only the netbird-<name> is added to the system path. The ui wrapper netbird-ui-<name> will not be easily accessible, except for the old netbird.enable where you add an explicit "as-default" wrapper.

Works fine for me:

> which netbird-ui-priv netbird-ui-sc
/run/current-system/sw/bin/netbird-ui-priv
/run/current-system/sw/bin/netbird-ui-sc

[oddlama]

I think it would be better style to force the prefix in the relevant locations, otherwise /var/lib/${cfg.name} will always look problematic since it implies any name is possible.

[nazarewk]

sounds reasonable

[oddlama]

I think you'll have to adjust the release notes to apply to 24.11 now that 24.05 is out the door. But the important details look fine to me, so this is good to go from my side. We can iron out any possible details separately if necessary.

[oddlama]

There are still changes to nixos/doc/manual/release-notes/rl-2405.section.md

[nazarewk]

There are still changes to nixos/doc/manual/release-notes/rl-2405.section.md

Yeah, the nixos manual command refused to pass, assumed it was expecting me to change it?

[oddlama]

Yeah, the nixos manual command refused to pass, assumed it was expecting me to change it?

I guess it complains because you cannot edit old release notes

[nazarewk]

Yeah, the nixos manual command refused to pass, assumed it was expecting me to change it?

I guess it complains because you cannot edit old release notes

it refused to pass without changes https://github.com/NixOS/nixpkgs/actions/runs/9399057023/job/25885722356

[PatrickDaG]

Module looks great. Hope it gets merged soon, been long enough.
I would like to test this more myself, but I'm working on a rewrite of the netbird-server modules right now and while I don't think they actually conflict, the merges do.

[PatrickDaG]

Do you plan to add more override files, or why do you first write the file in /etc and later iterate over the one file? I think it would be simpler to skip this and directly access the file from the nix-store in the derivation, skipping one indirection.

[nazarewk]

I'm using those on some of my machines and while testing stuff.

[PatrickDaG]

Should the client.ui.enable option then be removed as it doesn't do anything?

[PatrickDaG]

Probs would be better to use formatType.generate "config.json" cfg.config; since you're using the json format type already

[nazarewk]

don't think that's necessary, I think the generation uses jq with a separate derivation underneath.

[PatrickDaG]

There is an disable-auto-connect flag but it seems to only apply to netbird up, the link however seems to have run stale as there is no mention of such a feature being planned as far as I can see.

[nazarewk]

gotta look into it, I'm using some form of this in my configs successfully

[fricklerhandwerk]

I'd merge but NixOS tests seem to be broken or hanging? @Mic92 how to unblock this?

[oddlama]

(And this still modifies old release notes)

[nazarewk]

(And this still modifies old release notes)

any idea how to prevent that? nixpkgs is not activatable without this modification

[Mic92]

I'd merge but NixOS tests seem to be broken or hanging? @Mic92 how to unblock this?

Fixing the test? I am not using netbird and have currently other things on my list. Sorry.

[fricklerhandwerk]

I'm not sure if and how the test is even broken. All that's observable is that it's running seemingly forever, and I wondered how to re-trigger it or something. Is any of that ofborg stuff documented anywhere @dasJ?

[nazarewk]

I'd merge but NixOS tests seem to be broken or hanging? @Mic92 how to unblock this?

Fixing the test? I am not using netbird and have currently other things on my list. Sorry.

I'll adress remaining things this week. Otherwise I didn't touch it apart from rebasing for months already.

[nazarewk]

I have fixed the tests (I did some incompatible changes to the module on the way), but even though I've added option rename, the manual still doesn't build:
https://github.com/NixOS/nixpkgs/blob/c65c0c24c0b1fe683cea50f1c32893304cf0b1f7/nixos/modules/services/networking/netbird.nix#L75-L77

[nazarewk]

I have fixed the tests (I did some incompatible changes to the module on the way), but even though I've added option rename, the manual still doesn't build:

https://github.com/NixOS/nixpkgs/blob/c65c0c24c0b1fe683cea50f1c32893304cf0b1f7/nixos/modules/services/networking/netbird.nix#L75-L77

seems like there is some (actually quite a lot, just not AS relevant as this one) precedent to removing & editing old release notes:
e3812e1#diff-9538c800780031db3dfa7746f5a36fbbc895c60fdc896385bedd36940927427dL79-L81

[nazarewk]

I have fixed the tests (I did some incompatible changes to the module on the way), but even though I've added option rename, the manual still doesn't build:
https://github.com/NixOS/nixpkgs/blob/c65c0c24c0b1fe683cea50f1c32893304cf0b1f7/nixos/modules/services/networking/netbird.nix#L75-L77

seems like there is some (actually quite a lot, just not AS relevant as this one) precedent to removing & editing old release notes: e3812e1#diff-9538c800780031db3dfa7746f5a36fbbc895c60fdc896385bedd36940927427dL79-L81

As per #287236 (comment) , I am temporarily using mkAliasOptionModule until there is a better implementation to build release notes without errors.

[fricklerhandwerk]

Thanks a great deal for sticking through it, and sorry for the long delay.