Getting Started Implementation as YAML Playbook - #49
Open
PizzaLovingNerd wants to merge 5 commits into
Open
Conversation
…rted.sh Great for testing or automated installations of NetBird.
…s docs and a file renamed.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a complete Ansible playbook for deploying NetBird with configurable reverse-proxy modes, generated secrets and configuration, optional proxy installation, service orchestration, health checks, and comprehensive operator documentation. ChangesNetBird Deployment Flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant Ansible
participant DockerCompose
participant ReverseProxy
participant NPMAPI
participant NetBirdServer
Operator->>Ansible: run getting_started.yml
Ansible->>DockerCompose: start selected services
Ansible->>ReverseProxy: install or reload proxy configuration
Ansible->>NPMAPI: configure proxy host when enabled
Ansible->>NetBirdServer: create proxy token
Ansible->>DockerCompose: start NetBird proxy
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@playbooks/getting_started.yml`:
- Around line 168-173: Require a non-empty traefik_external_network in the
external Traefik validation block for every reverse_proxy_type ==
'external_traefik' deployment, regardless of external_traefik_install_config;
add an ansible.builtin.assert alongside the existing traefik_entrypoint check
with a clear failure message.
- Around line 1028-1032: Update the Nginx gRPC location regex in
getting_started.yml and the corresponding regex in npm-advanced-config.txt to
include management\.ProxyService alongside the existing SignalExchange and
ManagementService routes, ensuring these requests use the h2c gRPC backend
instead of the dashboard route.
- Around line 471-506: Protect existing proxy configurations in the Nginx and
Traefik Compose-rendering tasks. Before each copy operation, check whether the
target docker-compose.yml already exists and fail with a clear message unless a
dedicated explicit override variable is enabled; only permit replacement when
that override is supplied. Update the task blocks around the Nginx Compose
rendering and the corresponding Traefik task, preserving normal installation
behavior when no existing file is present.
- Around line 107-116: The “use-ip” domain option must only be accepted for the
manual reverse-proxy path. Update the assertions in “Require NetBird domain” so
that when netbird_domain is “use-ip”, reverse_proxy_type must equal “manual”,
while preserving the existing FQDN validation and error guidance.
- Around line 627-635: Quote the interpolated netbird_project_dir path in the
shell redirections for both “Generate relay auth secret when missing” and
“Generate datastore encryption key when missing” tasks, using safe shell quoting
so operator-provided values cannot alter command execution.
- Around line 692-733: Change the `ansible.builtin.copy` task rendering
`config.yaml` to use mode `0600` instead of `0640`, ensuring the combined
`authSecret` and `encryptionKey` remain readable only by the owner while
preserving the existing secret-handling behavior.
- Around line 461-506: Protect the NPM bootstrap credentials rendered by the
compose task: update “Create Nginx Proxy Manager project directory when install
is requested” to use owner-only directory permissions, update “Render Nginx
Proxy Manager docker-compose.yml when install is requested” to create the file
with owner-only permissions, and add no_log: true to the rendering task to
prevent credentials from appearing in Ansible output or --diff.
- Around line 1453-1462: In the “Wait for NetBird server through public
endpoint” task, remove validate_certs: false so the HTTPS health check validates
the public TLS certificate; leave the HTTP use-ip path unchanged.
- Around line 913-920: The catch-all proxy-passthrough TCP router using
HostSNI('*') currently claims all TLS traffic on websecure; update the Traefik
labels for proxy-passthrough to use a dedicated entrypoint or a narrowly scoped
SNI/hostname rule, and configure the corresponding entrypoint or contract so
dashboard/API HTTP routers remain reachable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ae0d71fd-f476-4354-9dd7-d6bd3f678a98
📒 Files selected for processing (2)
docs/getting_started.mdplaybooks/getting_started.yml
Comment on lines
+1028
to
+1032
| location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ { | ||
| grpc_pass grpc://netbird_server; | ||
| grpc_read_timeout 1d; | ||
| grpc_send_timeout 1d; | ||
| grpc_socket_keepalive on; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Route management.ProxyService through gRPC too.
The Traefik configuration explicitly sends /management.ProxyService/ to the h2c backend, but the Nginx and NPM regexes omit it. Those requests fall through to the dashboard route instead.
Proposed fix
- location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ {
+ location ~ ^/(signalexchange\.SignalExchange|management\.(ManagementService|ProxyService))/ {Apply the same expression to npm-advanced-config.txt.
Also applies to: 1123-1128
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@playbooks/getting_started.yml` around lines 1028 - 1032, Update the Nginx
gRPC location regex in getting_started.yml and the corresponding regex in
npm-advanced-config.txt to include management\.ProxyService alongside the
existing SignalExchange and ManagementService routes, ensuring these requests
use the h2c gRPC backend instead of the dashboard route.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds an Ansible implementation of the NetBird self-hosted getting-started flow, along with an operator-focused guide.
What changed
playbooks/getting_started.ymlfor deploying a self-hosted NetBird server.docs/getting_started.mdcovering requirements, inventory, variables, deployment examples, troubleshooting, and security considerations.Validation
Confirmed
playbooks/getting_started.ymlparses successfully as YAML.This playbook was testing with the following proxy configurations:
Summary by CodeRabbit