netbird-server: pin image versions (was :latest), to 0.73.2 — IPv6 prereq #32

2026-06-26T05:45:53Z

k.renner commented

2026-06-26 05:45:53 +00:00

Pin the NetBird mesh-control-plane images (was `:latest`)

Prereq for IPv6-first ingress, and a drift fix in its own right.

ansible/roles/netbird-server ran everything on :latest — management, signal, relay, reverse-proxy, dashboard. That's unpinned drift on the mesh control plane: the running version is whatever was last pulled, with no rollback and no reproducibility. Pinned via two role vars:

netbird_version: "0.73.2"            # management / signal / relay / reverse-proxy
netbird_dashboard_version: "v2.80.0" # dashboard (versions independently)

0.73.2 is the current stable (0.75.0 is only -rc) and matches the agents already on the mesh. >=0.71 is the floor that enables IPv6 overlay addressing (NetBird v0.71) — the prerequisite for advertising fd99::/64 into the mesh so the rootless routing peer can serve IPv6-first. That follow-up is not in this PR.

⚠️ This is a git change only — applying it is a deliberate, risky step

It takes effect when plays/install-netbird-server.yml runs on the VPS. Before that:

Confirm the currently-running version (dashboard footer, or Settings → Network shows the IPv6 toggle iff already >=0.71). We don't know it — the role was :latest, and SSH to the prod VPS is (correctly) off-limits.
Snapshot the VPS. A management version bump runs a one-way store migration; a large jump from an old :latest is the real risk.
Then run the play. Existing peer WireGuard sessions survive a brief control-plane restart; config sync pauses during it.

After it's on `>=0.71`, to actually get IPv6-first ingress (separate work)

Enable IPv6 in Settings → Network (group-gated — the routing-peer group + your client group).
Ensure your laptop agent is >=0.71.
Add an fd99::/64 NetBird route via the netbird-ingress peer.
The rootless userspace peer then dials fd99::* over its own v6 socket → kills the ~0.6 s Happy-Eyeballs penalty we measured off-LAN.

🤖 Generated with Claude Code

## Pin the NetBird mesh-control-plane images (was `:latest`) Prereq for IPv6-first ingress, and a drift fix in its own right. `ansible/roles/netbird-server` ran **everything on `:latest`** — management, signal, relay, reverse-proxy, dashboard. That's unpinned drift on the mesh control plane: the running version is whatever was last pulled, with no rollback and no reproducibility. Pinned via two role vars: ```yaml netbird_version: "0.73.2" # management / signal / relay / reverse-proxy netbird_dashboard_version: "v2.80.0" # dashboard (versions independently) ``` `0.73.2` is the current stable (`0.75.0` is only `-rc`) and matches the agents already on the mesh. **`>=0.71` is the floor that enables IPv6 overlay addressing** ([NetBird v0.71](https://netbird.io/knowledge-hub/ipv6-overlay-addressing)) — the prerequisite for advertising `fd99::/64` into the mesh so the rootless routing peer can serve IPv6-first. That follow-up is **not** in this PR. ### ⚠️ This is a git change only — applying it is a deliberate, risky step It takes effect when `plays/install-netbird-server.yml` runs on the VPS. Before that: 1. **Confirm the currently-running version** (dashboard footer, or Settings → Network shows the IPv6 toggle iff already `>=0.71`). We don't know it — the role was `:latest`, and SSH to the prod VPS is (correctly) off-limits. 2. **Snapshot the VPS.** A management version bump runs a **one-way store migration**; a large jump from an old `:latest` is the real risk. 3. Then run the play. Existing peer WireGuard sessions survive a brief control-plane restart; config sync pauses during it. ### After it's on `>=0.71`, to actually get IPv6-first ingress (separate work) - Enable IPv6 in **Settings → Network** (group-gated — the routing-peer group + your client group). - Ensure your laptop agent is `>=0.71`. - Add an `fd99::/64` NetBird route via the `netbird-ingress` peer. - The rootless userspace peer then dials `fd99::*` over its own v6 socket → kills the ~0.6 s Happy-Eyeballs penalty we measured off-LAN. 🤖 Generated with Claude Code

k.renner added 1 commit 2026-06-26 05:45:54 +00:00

netbird-server: pin image versions (was :latest), to 0.73.2 fa10d7fc94

The mesh control plane (management/signal/relay/reverse-proxy/dashboard)
ran on :latest — unpinned drift with no rollback and a non-reproducible
running version. Pin via two role vars:
  netbird_version: 0.73.2            # mgmt/signal/relay/reverse-proxy
  netbird_dashboard_version: v2.80.0 # dashboard (independent versioning)

0.73.2 is the current stable (0.75.0 is only -rc) and matches the agents
already on the mesh. >=0.71 is the floor that enables IPv6 overlay
addressing, which is the prerequisite for advertising fd99::/64 into the
mesh (IPv6-first ingress) — a follow-up, not done here.

Takes effect only when plays/install-netbird-server.yml is run on the
VPS. Before applying: confirm the currently-running version and SNAPSHOT
the host — a management version bump runs a one-way store migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 65816d3469 into master

2026-06-26 05:46:58 +00:00

k.renner referenced this issue from a commit

2026-06-26 05:46:59 +00:00

Merge pull request 'netbird-server: pin image versions (was :latest), to 0.73.2 — IPv6 prereq' (#32) from netbird-server-pin-versions into master

k.renner referenced this issue from a commit

2026-06-26 05:53:43 +00:00

ci: add deploy-netbird-server pipeline (mirrors deploy-caddy)

k.renner referenced this pull request

2026-06-26 05:54:02 +00:00

ci: add deploy-netbird-server pipeline (the missing deploy path for #32) #33

k.renner referenced this issue from a commit