fix(ansible): netbird-client downloads the release on the controller

The first workstation run failed on proxy-1 with 'Network is
unreachable' fetching the release: proxy-1 is IPv6-only and github.com
has no IPv6 address. The tarball is now downloaded and checksum-verified
on the controller (~/.cache/ansible/netbird) and unarchive copies it to
the host, so the hosts need no route to GitHub.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ansible/roles/netbird-client/defaults/main.yml

@@ -11,6 +11,8 @@ netbird_management_url: "https://netbird.renner.uno"
 # Debian/Ubuntu follow the apt repository instead.
 netbird_client_version: "0.75.0"
 netbird_release_url: "https://github.com/netbirdio/netbird/releases/download/v{{ netbird_client_version }}"
+# On the controller; the archive is copied from there to the hosts.
+netbird_download_dir: "{{ lookup('ansible.builtin.env', 'HOME') }}/.cache/ansible/netbird"
 
 # Leave the host's DNS configuration alone (hosts with a pinned resolv.conf).
 netbird_disable_dns: false

ansible/roles/netbird-client/tasks/main.yml

@@ -33,22 +33,35 @@
         update_cache: true
 
 # Arch has no netbird package in its repositories; the release binary is
-# verified against the release's checksums file.
+# verified against the release's checksums file. It is downloaded on the
+# controller and copied over: github.com has no IPv6 address, and proxy-1 is
+# IPv6-only.
 - name: Install NetBird from the release tarball
   when: ansible_facts['os_family'] == 'Archlinux'
   block:
-    - name: Download the NetBird release
+    - name: Create the controller download directory
+      ansible.builtin.file:
+        path: "{{ netbird_download_dir }}"
+        state: directory
+        mode: "0755"
+      delegate_to: localhost
+      become: false
+      run_once: true
+
+    - name: Download the NetBird release on the controller
       ansible.builtin.get_url:
         url: "{{ netbird_release_url }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
-        dest: "/tmp/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
+        dest: "{{ netbird_download_dir }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
         checksum: "sha256:{{ netbird_release_url }}/netbird_{{ netbird_client_version }}_checksums.txt"
         mode: "0644"
+      delegate_to: localhost
+      become: false
+      run_once: true
 
     - name: Install the NetBird binary
       ansible.builtin.unarchive:
-        src: "/tmp/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
+        src: "{{ netbird_download_dir }}/netbird_{{ netbird_client_version }}_linux_amd64.tar.gz"
         dest: /usr/local/bin
-        remote_src: true
         include:
           - netbird
         owner: root