nixos-config/hosts/m3-atlas/services/containers/netbird.nix

{
  config,
  pkgs,
  ...
}: let
  serviceName = "netbird";

  stunPort = config.m3ta.ports.get "netbird-stun";
  proxyTlsPort = config.m3ta.ports.get "netbird-proxy";
  metricsPort = config.m3ta.ports.get "netbird-metrics";
  healthPort = config.m3ta.ports.get "netbird-health";
  postgresPort = config.m3ta.ports.get "postgres";
  wireguardPort = config.m3ta.ports.get "wireguard";

  domain = "v.m3ta.dev";
  proxyDomain = "p.m3ta.dev";

  ipBase = "10.89.0";
  ipOffset = 50;

  dashboardIp = "${ipBase}.${toString ipOffset}";
  serverIp = "${ipBase}.${toString (ipOffset + 1)}";
  proxyIp = "${ipBase}.${toString (ipOffset + 2)}";

  # Database configuration
  dbName = "netbird";
  dbUser = "netbird";
  dbHost = "${ipBase}.1";

  # NetBird config as Nix attribute set
  netbirdConfig = {
    server = {
      listenAddress = ":80";
      exposedAddress = "https://${domain}:443";
      stunPorts = [stunPort];
      metricsPort = metricsPort;
      healthcheckAddress = ":${toString healthPort}";
      logLevel = "info";
      logFile = "console";
      dataDir = "/var/lib/netbird";

      auth = {
        issuer = "https://${domain}/oauth2";
        localAuthDisabled = true;
        signKeyRefreshEnabled = true;
        dashboardRedirectURIs = [
          "https://${domain}/nb-auth"
          "https://${domain}/nb-silent-auth"
        ];
        cliRedirectURIs = ["http://localhost:53000/"];
      };

      reverseProxy = {
        trustedHTTPProxies = ["${ipBase}.1/32"];
      };

      # Proxy feature
      proxy = {
        enabled = true;
        domain = proxyDomain;
      };

      store = {
        engine = "postgres";
        postgres = {
          host = dbHost;
          port = postgresPort;
          database = dbName;
          username = dbUser;
        };
      };
    };
  };

  # Generate YAML from Nix attribute set
  yamlFormat = pkgs.formats.yaml {};
  configYamlBase = yamlFormat.generate "netbird-config-base.yaml" netbirdConfig;

  # Script that injects secrets at runtime
  configGenScript = pkgs.writeShellScript "netbird-gen-config" ''
    set -euo pipefail

    AUTH_SECRET=$(cat "$1")
    DB_PASSWORD=$(cat "$2")
    ENCRYPTION_KEY=$(cat "$3")

    ${pkgs.yq-go}/bin/yq eval "
      .server.authSecret = \"$AUTH_SECRET\" |
      .server.store.encryptionKey = \"$ENCRYPTION_KEY\" |
      .server.store.postgres.password = \"$DB_PASSWORD\"
    " ${configYamlBase}
  '';
in {
  age.secrets."${serviceName}-auth-secret".file = ../../../../secrets/${serviceName}-auth-secret.age;
  age.secrets."${serviceName}-db-password".file = ../../../../secrets/${serviceName}-db-password.age;
  age.secrets."${serviceName}-encryption-key".file = ../../../../secrets/${serviceName}-encryption-key.age;
  age.secrets."${serviceName}-dashboard-env".file = ../../../../secrets/${serviceName}-dashboard-env.age;
  age.secrets."${serviceName}-server-env".file = ../../../../secrets/${serviceName}-server-env.age;
  age.secrets."${serviceName}-proxy-env".file = ../../../../secrets/${serviceName}-proxy-env.age;
  # Oneshot systemd service that generates the config with injected secrets
  systemd.services."${serviceName}-config" = {
    description = "Generate NetBird config with secrets";
    wantedBy = ["multi-user.target"];
    before = ["podman-${serviceName}-server.service"];
    requiredBy = ["podman-${serviceName}-server.service"];

    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = pkgs.writeShellScript "netbird-write-config" ''
        mkdir -p /var/lib/${serviceName}
        ${configGenScript} \
          ${config.age.secrets."${serviceName}-auth-secret".path} \
          ${config.age.secrets."${serviceName}-db-password".path} \
          ${config.age.secrets."${serviceName}-encryption-key".path} \
          > /var/lib/${serviceName}/config.yaml
        chmod 600 /var/lib/${serviceName}/config.yaml
      '';
    };
  };

  virtualisation.oci-containers.containers = {
    "${serviceName}-dashboard" = {
      image = "netbirdio/dashboard:latest";
      autoStart = true;
      environmentFiles = [config.age.secrets."${serviceName}-dashboard-env".path];
      extraOptions = [
        "--ip=${dashboardIp}"
        "--network=web"
      ];
    };

    "${serviceName}-server" = {
      image = "netbirdio/netbird-server:latest";
      autoStart = true;
      ports = ["${toString stunPort}:${toString stunPort}/udp"];
      environmentFiles = [config.age.secrets."${serviceName}-server-env".path];
      volumes = [
        "${serviceName}_data:/var/lib/netbird"
        "/var/lib/${serviceName}/config.yaml:/etc/netbird/config.yaml:ro"
      ];
      cmd = ["--config" "/etc/netbird/config.yaml"];
      extraOptions = [
        "--ip=${serverIp}"
        "--network=web"
      ];
    };

    "${serviceName}-proxy" = {
      image = "netbirdio/reverse-proxy:latest";
      autoStart = true;
      ports = ["${toString wireguardPort}:${toString wireguardPort}/udp"];
      volumes = [
        "${serviceName}_proxy_certs:/certs"
      ];
      environmentFiles = [config.age.secrets."${serviceName}-proxy-env".path];
      cmd = [
        "--domain=${proxyDomain}"
        "--mgmt=https://${domain}:443"
        "--addr=:${toString proxyTlsPort}"
        "--cert-dir=/certs"
        "--acme-certs"
        "--trusted-proxies=${ipBase}.1/32"
      ];
      dependsOn = ["${serviceName}-server"];
      extraOptions = [
        "--ip=${proxyIp}"
        "--network=web"
      ];
    };
  };

  services.traefik.dynamicConfigOptions = {
    # HTTP services and routers
    http = {
      services = {
        "${serviceName}-dashboard".loadBalancer.servers = [
          {url = "http://${dashboardIp}:80/";}
        ];

        "${serviceName}-server".loadBalancer.servers = [
          {url = "http://${serverIp}:80/";}
        ];

        "${serviceName}-server-h2c".loadBalancer.servers = [
          {url = "h2c://${serverIp}:80";}
        ];
      };

      routers = {
        # gRPC (Signal + Management)
        "${serviceName}-grpc" = {
          rule = "Host(`${domain}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))";
          entrypoints = "websecure";
          tls.certResolver = "godaddy";
          service = "${serviceName}-server-h2c";
          priority = 100;
        };
        # Backend (relay, WebSocket, API, OAuth2)
        "${serviceName}-backend" = {
          rule = "Host(`${domain}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))";
          entrypoints = "websecure";
          tls.certResolver = "godaddy";
          service = "${serviceName}-server";
          priority = 100;
        };

        # Dashboard (catch-all, lowest priority)
        "${serviceName}-dashboard" = {
          rule = "Host(`${domain}`)";
          entrypoints = "websecure";
          tls.certResolver = "godaddy";
          service = "${serviceName}-dashboard";
          priority = 1;
        };
      };
    };

    # TCP for proxy TLS passthrough
    tcp = {
      services."${serviceName}-proxy-tls".loadBalancer.servers = [
        {address = "${proxyIp}:${toString proxyTlsPort}";}
      ];

      routers."${serviceName}-proxy-passthrough" = {
        entryPoints = ["websecure"];
        rule = "HostSNI(`*`)";
        service = "${serviceName}-proxy-tls";
        priority = 1;
        tls.passthrough = true;
      };
    };

    # ServersTransport for Proxy Protocol v2 (optional)
    serversTransports."pp-v2" = {
      proxyProtocol.version = 2;
    };
  };

  networking.firewall.allowedUDPPorts = [
    stunPort # STUN
    wireguardPort # WireGuard for proxy
  ];
}