From fa10d7fc947d0399360882f0826c114ee80d965f Mon Sep 17 00:00:00 2001
From: Konstantin Renner <konstantin@renner.uno>
Date: Fri, 26 Jun 2026 07:45:32 +0200
Subject: [PATCH] netbird-server: pin image versions (was :latest), to 0.73.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mesh control plane (management/signal/relay/reverse-proxy/dashboard)
ran on :latest — unpinned drift with no rollback and a non-reproducible
running version. Pin via two role vars:
  netbird_version: 0.73.2            # mgmt/signal/relay/reverse-proxy
  netbird_dashboard_version: v2.80.0 # dashboard (independent versioning)

0.73.2 is the current stable (0.75.0 is only -rc) and matches the agents
already on the mesh. >=0.71 is the floor that enables IPv6 overlay
addressing, which is the prerequisite for advertising fd99::/64 into the
mesh (IPv6-first ingress) — a follow-up, not done here.

Takes effect only when plays/install-netbird-server.yml is run on the
VPS. Before applying: confirm the currently-running version and SNAPSHOT
the host — a management version bump runs a one-way store migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ansible/roles/netbird-server/defaults/main.yml         |  8 ++++++++
 .../netbird-server/templates/docker-compose.yml.j2     | 10 +++++-----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/ansible/roles/netbird-server/defaults/main.yml b/ansible/roles/netbird-server/defaults/main.yml
index f3d5f9ff..10de9b4b 100644
--- a/ansible/roles/netbird-server/defaults/main.yml
+++ b/ansible/roles/netbird-server/defaults/main.yml
@@ -3,6 +3,14 @@
 netbird_server_host: netbird.renner.uno
 netbird_server_user: root
 
+# Pinned image versions (was :latest — unpinned drift on the mesh control
+# plane). management/signal/relay/reverse-proxy share one release line;
+# dashboard versions independently. >=0.71 is required for IPv6 overlay
+# addressing. Bump deliberately and snapshot the VPS before applying — a
+# management major bump runs a store migration.
+netbird_version: "0.73.2"
+netbird_dashboard_version: "v2.80.0"
+
 # Authentik OIDC configuration
 netbird_auth_audience: "qrCjbsFeOO32kXOVwF8OrunzettalsMJ5GoOKJAR"
 netbird_auth_client_id: "qrCjbsFeOO32kXOVwF8OrunzettalsMJ5GoOKJAR"
diff --git a/ansible/roles/netbird-server/templates/docker-compose.yml.j2 b/ansible/roles/netbird-server/templates/docker-compose.yml.j2
index b065542d..8877fc78 100644
--- a/ansible/roles/netbird-server/templates/docker-compose.yml.j2
+++ b/ansible/roles/netbird-server/templates/docker-compose.yml.j2
@@ -50,7 +50,7 @@ services:
 
   # UI Dashboard
   dashboard:
-    image: netbirdio/dashboard:latest
+    image: netbirdio/dashboard:{{ netbird_dashboard_version }}
     container_name: netbird-dashboard
     restart: unless-stopped
     depends_on:
@@ -85,7 +85,7 @@ services:
 
   # Signal Server
   signal:
-    image: netbirdio/signal:latest
+    image: netbirdio/signal:{{ netbird_version }}
     container_name: netbird-signal
     restart: unless-stopped
     depends_on:
@@ -119,7 +119,7 @@ services:
 
   # Relay Server
   relay:
-    image: netbirdio/relay:latest
+    image: netbirdio/relay:{{ netbird_version }}
     container_name: netbird-relay
     restart: unless-stopped
     environment:
@@ -144,7 +144,7 @@ services:
 
   # Management Server
   management:
-    image: netbirdio/management:latest
+    image: netbirdio/management:{{ netbird_version }}
     container_name: netbird-management
     restart: unless-stopped
     depends_on:
@@ -214,7 +214,7 @@ services:
 
   # Reverse Proxy Service (per docs.netbird.io/selfhosted/migration/enable-reverse-proxy)
   proxy:
-    image: netbirdio/reverse-proxy:latest
+    image: netbirdio/reverse-proxy:{{ netbird_version }}
     container_name: netbird-proxy
     restart: unless-stopped
     networks: