netbird: rework server and include new component - #354032
PatrickDaG wants to merge 3 commits into
Conversation
github-actions
Bot
added
6.topic: nixos
ofborg
Bot
added
10.rebuild-darwin: 1-10
wegank
added
the
2.status: merge conflict
h7x4
added
8.has: module (new)
d6f32bf to
67b0145
Compare
ofborg
Bot
removed
the
2.status: merge conflict
|
Result of 2 packages blacklisted:
3 packages built:
|
Same here, also on x86_64-linux. :) |
67b0145 to
6f81122
Compare
|
Fellow user of Kanidm/Netbird here. Can confirm that the server is non functional at the moment, again due to clashing ports. services.netbird.server.management.extraOptions = [ "--metrics-port=9091" ];to my configuration. ...Is it worth creating a separate PR to fix Also please let me know if I can help with testing in any way. |
|
Might be a good idea to put the More eyes and people testing are always welcome. I'm just gonna run the new module while I work on this PR for a few weeks and see if anything comes up. Seems like right now the blocker for both of us is kanidm kanidm/kanidm#3217 |
Yeah, can do - I was thinking add an extraOption to signal, and potentially even adding my snippet above as the default for one of them so it works out of the box again? |
|
I would say you could just add your snippet as the default and we can always switch to a dedicated option later, but thinking about it I'm not sure the newest update will work without the relay server packaged and setup so I'm not sure a new PR is worth it if it won't work anyway. |
I'm on nixpkgs |
Oh nice. Wasn't sure how much they already depend on the relay.
Sounds great. I'll try and finish this one soon as well, now that the branchoff happened. |
|
PR opened, input would be appreciated @PatrickDaG |
e72c0c9 to
06554e2
Compare
There was a problem hiding this comment.
I'm pretty sure there should be a way to supply this value externally instead of putting inside /nix/store
There was a problem hiding this comment.
something like config.d/*.json directory merged recursively by jq before the start of the service could work
There was a problem hiding this comment.
NetBird already natively supports loading this encryption key from a file, with DataStoreEncryptionKey._secret set to an arbitrary path.
nixos/netbird: introduce standalone proxy module
3c46d74 to
de8d525
Compare
nixpkgs-ci
Bot
added
10.rebuild-darwin: 0
de8d525 to
d597417
Compare
|
Rebased on master. Hope I didn't break anything. Should be ready again. |
d597417 to
e9b1384
Compare
| grpc_send_timeout 1d; | ||
| grpc_socket_keepalive on; | ||
| ''; | ||
| locations."/relay".extraConfig = '' |
There was a problem hiding this comment.
That doesn't seem right to always host relay on the same host as the control plane, I think it should be split into a different option that is possible to enable without the management/signal
There was a problem hiding this comment.
I see your point. However I intend the proxy module to be a easiest possible setup frontend, so people just have to enable a single option for hosting the complete stack. Anything beyond that I don't think we can anticipate what the setups look like.
What if they have the signal on another server? What if the api and dashboard aren't shared?
I would like to keep it as easy as possible and if people have more complicated setups, they can look at the configuration and adapt it to their needs.
But if a split is needed for this to be finally merged I can do it after the 25.11 release, it shouldn't be merged beforehand anyway.
There was a problem hiding this comment.
I think we could easily make the specific pieces optional in follow-up PRs. Seems like it would be pretty much a bunch of default-on *.enable options combined with mkIfs
nixpkgs-ci
Bot
removed
the
12.approvals: 1
|
I just stumbled across this PR while trying to finally migrate my Netbird deployment to NixOS. The fact that the relay cannot be configured via the Netbird module is currently preventing me from doing so. Is there anything still preventing the merge, and/or is there a timeline for it? I would really appreciate seeing this implemented. |
|
Just as an update. I don't use netbird anymore, and currently don't intend to switch back to it anytime soon, so my motivation to keep pushing this PR is limited. If anyone wants to adopt it I'd be more than happy to hand it over. I think it should be basically merge ready for now, so the only thing missing is someone willing to pester committers to get it over the line. |
I'm curious, do you use something else or do you not need a self hosted VPN anymore? I'm not terribly happy with the multi-user situation in netbird right now, most features are only available on their cloud version.
Assuming I don't end up switching as well I could probably pick that up, but not sure when I'll have time. Is it mostly just resolving merge conflicts or does it need release notes and upgrade documentation as well? |
I've switched to firezone. Their network model seems to fit my use-case better.
I think it should just be merge conflicts, as far as I can tell. |
@TheRealGramdalf Could you elaborate on what you mean with the multi-user situation? We're currently evaluating using netbird in an enterprise environment. BTW with version 0.64.0 (released yesterday) coturn is not required anymore: https://github.com/netbirdio/netbird/releases/tag/v0.64.0 |
|
i have resolved the merge conflicts aswell as tested 0.63.0 yesterday. (going to do 0.64 today i guess) Btw ive been running netbird based on this PR for about 5 months now |
As far as I'm aware, the self hosted version does not allow you to sync permissions based on information from your IDP - it also seems like each user has their own network with their own individual peers, and I haven't found a way to link multiple accounts together so that user A can access peers from user B. Syncing permissions is available on the cloud version, not sure about multi-user networks. |
|
@RafaelKr Actually an update on this, I was just looking through the docs and it appears that group syncing is available on the self hosted version now. Not sure which release added that, though I'd guess 0.63.0 (when configuring IDPs via the dashboard was added). I'm not sure about the multi-user situation yet though, I'll have to check out the new version and see how it works out. |
I've been using netbird for around one and a half years now and group sync was already available when I started so definitely not a new thing. I'm not sure whether I understand you multi-user needs correctly but maybe single-account-mode is what you want: https://docs.netbird.io/selfhosted/selfhosted-guide#step-4-disable-single-account-mode-optional |
Thanks @schromp , I don't think there is a way I can hand over this PR? So I think you'll have to open a new one. |
|
This PR (schromp's clone) is working for me. With netbird-relay 0.64.1 (recently merged: #483538) coturn is not required at all. That seems to simplify things significantly. My config (hacked together, can probably be simplified): |
|
Is there any update on this PR or a new one? @schromp |
|
hey @PatrickDaG is it okay if I start new PR's based on your work? Since you are not using netbird anymore, I want to slowly start pushing one module at a time (starting with the relay). I have to run everything on my configuration first to make sure it works. Any advice I should keep in mind? |
|
Absolutely, go for it. You might also want to look at #487367 and the people who commented, so you don't get in each others way. It's been so long since I've run this stack, I don't remember much, sorry. |
20 participants
This is a pretty hefty rework of the nixos netbird modules.
First of all I split the package into three because currently you cannot have the client installed without the server components coming with it, now it's three packages, a client, a client with gui and a server.
You still have the option to build a package containing everything but I don't think most people need that.
Secondly I wrote a basic test for the server, now we at least know if it starts, which it currently doesn't cause upstream introduced clashing ports for all server, that cannot be disabled.
I would love further testing but I think that would need actually logging in into the kanidm instance inside the testing framework, which is something for another day.
The test also currently depend on #353681.
Netbird is currently switching away from coturn in favour of their own relay implementation, which this pull adds.
Their communication towards whether coturn will be needed going forward is a bit confusing, but I'm pretty sure right now you need both their relay and coturn, maybe in a few updates we can remove coturn.
Lastly I reworked the nginx setup, realizing you don't necesarrily need it, apart from serving the dashboard.
I removed it from all services and the default setup should now work without it, but you have to forward and open all relevant ports, for the management, signal, coturn, dashboard and relay.
To make it easier for people using nginx as a reverse proxy I've added the proxy, module which is written and maintained completely by myself and has no affiliation to upstream netbird. I do plan on using this and think it's valuable to have even just as a documentation of nginx options to use with netbird, but I am scared that people have problems with this module and complain to upstream netbird. Don't really know what to do whether to include or not, feedback appreciated.
In general this isn't extensively tested yet, but I would be very happy if people help me test it.
It has to wait for branch off anyway because it contains a bunch of breaking changes.
Also should probably write more documentation especially regarding the proxy module.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.